Bug 2426

Summary: OpenSSH doesn't need the second call to do_pam_setcred() on non-Linux platforms
Product: Portable OpenSSH Reporter: brent.paulson
Component: PAM supportAssignee: Assigned to nobody <unassigned-bugs>
Status: NEW ---    
Severity: minor CC: djm
Priority: P5    
Version: 6.9p1   
Hardware: SPARC   
OS: Solaris   

Description brent.paulson 2015-07-07 20:09:27 AEST
There is a second call to do_pam_setcred() in
platform.c:platform_setusercontext_post_groups() which was made via the
following changeset which doesn't mention a bugID:

https://anongit.mindrot.org/openssh.git/commit/platform.c?id=cc12418e18242ce1f61d7035da4956274ba13a96

The comment mentions initgroups(3C) wiping out supplementary groups
which only applies in the Linux world if the LinuxPAM pam_group(8)
module has been installed and configured which allows one to assign
additional secondary groups to a user using /etc/security/group.conf in
addition to /etc/group.  Note that there is an OpenPAM PAM module of the
same name, pam_group(8), which has different functionality, it performs
access control based on group membership.

There is an earlier call to do_pam_setcred() in main() so this
additional call to do_pam_setcred() doesn't need to be called on
non-Linux platforms.  I don't see any config.h #defines for Linux PAM so
this code could be ifdef'ed out for Solaris by including a check for
PAM_SUN_CODEBASE.
Comment 1 Damien Miller 2015-07-17 12:20:07 AEST
Does the additional call hurt?