Re: pam_setcred parameter

On Mon, 21 Jan 2019 11:54:58 +0100, Radovan Sroka wrote:

> I think that sudo uses pam_setcred incorrectly.
>
> https://www.sudo.ws/repos/sudo/rev/ec23c3bf41bb
>
> After this commit sudo uses PAM_REINITIALIZE_CRED instead of
> PAM_ESTABLISH_CRED which is wrong. Reinitialize flag can be used only in
> case when Establish was already used and there was some change like UID or
> something.

Please see https://bugzilla.sudo.ws/show_bug.cgi?id=642 for the
reason for this chaange.  Since sudo is changing the uid of an
already-established user session, PAM_REINITIALIZE_CRED is appropriate.

> Some pam modules like pam_cap.so ignore Reinitialize and support only
> Establish and that's why it is not working with sudo since that commit and
> does not apply capabilities to new process.

That sounds like a bug in those PAM modules, not sudo.

 - todd
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers