Bug 969

Summary:	early setpcred() stomps on PAM
Product:	Portable OpenSSH	Reporter:	David Leonard <David.Leonard>
Component:	sshd	Assignee:	OpenSSH Bugzilla mailing list <openssh-bugs>
Status:	CLOSED INVALID
Severity:	normal
Priority:	P2
Version:	3.9p1
Hardware:	All
OS:	AIX

Description David Leonard 2005-01-05 13:08:31 AEDT

The early call to setpcred() in do_setusercontext() seems to drop the euid to
the user's uid on AIX5.1. This stops the future call to initgroups() from
working if setpcred() doesn't get the supplementary group list right. Which it
doesn't with PAM.

The symptoms are a 'successful' login, but the session exits immediately, with
sshd logging "initgroups: Permission denied".

setpcred() must still be called at some stage to correctly set up the process
rlimits and auditing class. I found that moving it to the end of
do_setusercontext() works.

Comment 1 David Leonard 2005-01-05 14:59:16 AEDT

I just found a similar kind of setpcred problem fixed in
http://archives.neohapsis.com/archives/aix/2002-q3/0003.html:

| A call to initgroups failed after a call to
| setpcred. Changed order of calls so initgroups
| is called first.

Comment 2 Darren Tucker 2005-01-06 10:02:00 AEDT

I'll take a look at this.

One thought off the top of my head: what if some module in the PAM stack causes
pam_setcred to drop the privs setpcred needs?

Comment 3 David Leonard 2005-01-06 18:15:14 AEDT

someone here pointed out the aix system I was using is at maintennance level
(oslevel -r) 5100-02.

I've upgraded to 5100-07 and the problem has gone away!!
It seems to be an AIX bug, so I'm marking this bug invalid.

Comment 4 Darren Tucker 2006-10-07 11:38:28 AEST

Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.