From 7bdbafc261f807b68fd5622500c70bbf363ae7c0 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Fri, 23 Apr 2021 16:14:57 +0200
Subject: [PATCH] homectl: don't use password cache if we operate on other user

---
 src/basic/user-util.c | 13 +++++++++++++
 src/basic/user-util.h |  2 ++
 src/home/homectl.c    |  8 ++++++++
 3 files changed, 23 insertions(+)

diff --git a/src/basic/user-util.c b/src/basic/user-util.c
index 0ea4e409fa..3756e80c30 100644
--- a/src/basic/user-util.c
+++ b/src/basic/user-util.c
@@ -1072,3 +1072,16 @@ int fgetsgent_sane(FILE *stream, struct sgrp **sg) {
         return !!s;
 }
 #endif
+
+int is_this_me(const char *username) {
+        uid_t uid;
+        int r;
+
+        /* Checks if the specified username is our current one. Passed string might be a UID or a user name. */
+
+        r = get_user_creds(&username, &uid, NULL, NULL, NULL, USER_CREDS_ALLOW_MISSING);
+        if (r < 0)
+                return r;
+
+        return uid == getuid();
+}
diff --git a/src/basic/user-util.h b/src/basic/user-util.h
index 20ff415e2e..636c392870 100644
--- a/src/basic/user-util.h
+++ b/src/basic/user-util.h
@@ -109,3 +109,5 @@ int putsgent_sane(const struct sgrp *sg, FILE *stream);
 #endif
 
 bool is_nologin_shell(const char *shell);
+
+int is_this_me(const char *username);
diff --git a/src/home/homectl.c b/src/home/homectl.c
index 34363c4f70..3e2de319bf 100644
--- a/src/home/homectl.c
+++ b/src/home/homectl.c
@@ -220,6 +220,10 @@ static int acquire_existing_password(
                 return 1;
         }
 
+        /* If this is not our own user, then don't use the password cache */
+        if (is_this_me(user_name) <= 0)
+                SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);
+
         if (asprintf(&question, emphasize_current ?
                      "Please enter current password for user %s:" :
                      "Please enter password for user %s:",
@@ -269,6 +273,10 @@ static int acquire_token_pin(
                 return 1;
         }
 
+        /* If this is not our own user, then don't use the password cache */
+        if (is_this_me(user_name) <= 0)
+                SET_FLAG(flags, ASK_PASSWORD_ACCEPT_CACHED|ASK_PASSWORD_PUSH_CACHE, false);
+
         if (asprintf(&question, "Please enter security token PIN for user %s:", user_name) < 0)
                 return log_oom();