SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: make sure that if PAMName= is set we always do the full user changing even if no user is specified explicitly

Browse Source 
When PAMName= is set this should be enough to go through our entire user
changing story, so that PAM is definitely run, and environment variables
definitely pulled in and so on.

Previously, it would happen that under some circumstances we might no do
this when transitioning from root to root itself even though PAM was
enabled.

Fixes: #34682
This commit is contained in:
Lennart Poettering
2024-10-24 22:37:00 +02:00
parent 4167e9e210
commit e4b4d9cc7a
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/exec-invoke.c
+18 -3
View File
@@ -4061,7 +4061,7 @@ int exec_invoke(
int r, ngids = 0;
_cleanup_free_ gid_t *supplementary_gids = NULL;
const char *username = NULL, *groupname = NULL;
_cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL;
_cleanup_free_ char *home_buffer = NULL, *memory_pressure_path = NULL, *own_user = NULL;
const char *home = NULL, *shell = NULL;
char **final_argv = NULL;
dev_t journal_stream_dev = 0;
@@ -4298,8 +4298,23 @@ int exec_invoke(
username = runtime->dynamic_creds->user->name;
} else {
if (context->user) {
r = get_fixed_user(context->user, &username, &uid, &gid, &home, &shell);
const char *u;
if (context->user)
u = context->user;
else if (context->pam_name) {
/* If PAM is enabled but no user name is explicitly selected, then use our own one. */
own_user = getusername_malloc();
if (!own_user) {
*exit_status = EXIT_USER;
return log_exec_error_errno(context, params, r, "Failed to determine my own user ID: %m");
}
u = own_user;
} else
u = NULL;
if (u) {
r = get_fixed_user(u, &username, &uid, &gid, &home, &shell);
if (r < 0) {
*exit_status = EXIT_USER;
return log_exec_error_errno(context, params, r, "Failed to determine user credentials: %m");