This patch fixes symlink and environment variable problems in su,
login and telnetd.
Apply by doing:
cd /usr/src
patch -p0 < 008_kerberos.patch
And the rebuild su, login and telnetd
cd usr.bin/su
make obj
make depend
make
make install
cd ../login
make obj
make depend
make
make install
cd ../../libexec/telnetd
make obj
make depend
make
make install
Index: libexec/telnetd/state.c
===================================================================
RCS file: /cvs/src/libexec/telnetd/state.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -w -r1.10 -r1.11
--- libexec/telnetd/state.c 2000/09/15 07:13:47 1.10
+++ libexec/telnetd/state.c 2000/12/06 16:50:15 1.11
@@ -1,4 +1,4 @@
-/* $OpenBSD: state.c,v 1.10 2000/09/15 07:13:47 deraadt Exp $ */
+/* $OpenBSD: state.c,v 1.11 2000/12/06 16:50:15 hin Exp $ */
/* $NetBSD: state.c,v 1.9 1996/02/28 20:38:19 thorpej Exp $ */
/*
@@ -39,7 +39,7 @@
static char sccsid[] = "@(#)state.c 8.5 (Berkeley) 5/30/95";
static char rcsid[] = "$NetBSD: state.c,v 1.9 1996/02/28 20:38:19 thorpej Exp $";
#else
-static char rcsid[] = "$OpenBSD: state.c,v 1.10 2000/09/15 07:13:47 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: state.c,v 1.11 2000/12/06 16:50:15 hin Exp $";
#endif
#endif /* not lint */
@@ -1086,7 +1086,7 @@
"_RLD_",
"SHLIB_PATH=",
"LIBPATH=",
- "KRB_CONF",
+ "KRB",
"ENV=",
"BASH_ENV=",
NULL,
Index: usr.bin/login/klogin.c
===================================================================
RCS file: /cvs/src/usr.bin/login/klogin.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -w -r1.10 -r1.11
--- usr.bin/login/klogin.c 2000/07/17 16:43:14 1.10
+++ usr.bin/login/klogin.c 2000/12/02 22:44:36 1.11
@@ -1,4 +1,4 @@
-/* $OpenBSD: klogin.c,v 1.10 2000/07/17 16:43:14 millert Exp $ */
+/* $OpenBSD: klogin.c,v 1.11 2000/12/02 22:44:36 hin Exp $ */
/* $NetBSD: klogin.c,v 1.7 1996/05/21 22:07:04 mrg Exp $ */
/*-
@@ -38,7 +38,7 @@
#if 0
static char sccsid[] = "@(#)klogin.c 8.3 (Berkeley) 4/2/94";
#endif
-static char rcsid[] = "$OpenBSD: klogin.c,v 1.10 2000/07/17 16:43:14 millert Exp $";
+static char rcsid[] = "$OpenBSD: klogin.c,v 1.11 2000/12/02 22:44:36 hin Exp $";
#endif /* not lint */
#ifdef KERBEROS
@@ -80,7 +80,7 @@
struct passwd *pw;
char *instance, *localhost, *password;
{
- int kerror;
+ int kerror, fd;
AUTH_DAT authdata;
KTEXT_ST ticket;
struct hostent *hp;
@@ -97,6 +97,15 @@
}
#endif
+ /* If no srvtab file exists, fail immediatly. This will make
+ * login _much_ quicker on systems with sporadical contact with
+ * the outside world.
+ * We should really change the semantics for enabling kerberos.
+ */
+ if((fd = open(KEYFILE, O_RDONLY, 0)) < 0)
+ return 1;
+ close(fd);
+
/*
* Root logins don't use Kerberos (or at least shouldn't be
* sending kerberos passwords around in cleartext), so don't
@@ -119,8 +128,8 @@
*/
if (strcmp(instance, "root") != 0)
- snprintf(tkt_location, sizeof(tkt_location), "%s%d.%s",
- TKT_ROOT, pw->pw_uid, tty);
+ snprintf(tkt_location, sizeof(tkt_location), "%s%d",
+ TKT_ROOT, pw->pw_uid);
else
snprintf(tkt_location, sizeof(tkt_location), "%s_root_%d.%s",
TKT_ROOT, pw->pw_uid, tty);
@@ -155,8 +164,19 @@
return (1);
}
- if (chown(TKT_FILE, pw->pw_uid, pw->pw_gid) < 0)
- syslog(LOG_ERR, "chown tkfile (%s): %m", TKT_FILE);
+ /*
+ * Set the owner of the ticket file to root but bail if someone
+ * has nefariously swapped a link in place of the file.
+ */
+ fd = open(TKT_FILE, O_RDWR|O_NOFOLLOW, 0);
+ if (fd == -1) {
+ syslog(LOG_ERR, "unable to open ticket file: %m");
+ dest_tkt();
+ return (1);
+ }
+ if (fchown(fd, pw->pw_uid, pw->pw_gid) < 0)
+ syslog(LOG_ERR, "fchown tkfile (%s): %m", TKT_FILE);
+ close(fd);
(void)strlcpy(savehost, krb_get_phost(localhost), sizeof(savehost));
Index: usr.bin/su/su.c
===================================================================
RCS file: /cvs/src/usr.bin/su/su.c,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -w -r1.34 -r1.35
--- usr.bin/su/su.c 2000/09/15 07:13:50 1.34
+++ usr.bin/su/su.c 2000/12/02 22:44:49 1.35
@@ -1,4 +1,4 @@
-/* $OpenBSD: su.c,v 1.34 2000/09/15 07:13:50 deraadt Exp $ */
+/* $OpenBSD: su.c,v 1.35 2000/12/02 22:44:49 hin Exp $ */
/*
* Copyright (c) 1988 The Regents of the University of California.
@@ -41,7 +41,7 @@
#ifndef lint
/*static char sccsid[] = "from: @(#)su.c 5.26 (Berkeley) 7/6/91";*/
-static char rcsid[] = "$OpenBSD: su.c,v 1.34 2000/09/15 07:13:50 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: su.c,v 1.35 2000/12/02 22:44:49 hin Exp $";
#endif /* not lint */
#include <sys/param.h>
@@ -59,6 +59,7 @@
#include <string.h>
#include <syslog.h>
#include <unistd.h>
+#include <fcntl.h>
#ifdef SKEY
#include <skey.h>
@@ -358,11 +359,16 @@
KTEXT_ST ticket;
AUTH_DAT authdata;
struct hostent *hp;
- int kerno;
+ int kerno, fd;
in_addr_t faddr;
char hostname[MAXHOSTNAMELEN], savehost[MAXHOSTNAMELEN];
char *ontty(), *krb_get_phost();
+ /* Don't bother with Kerberos if there is no srvtab file */
+ if ((fd = open(KEYFILE, O_RDONLY, 0)) < 0)
+ return (1);
+ close(fd);
+
if (koktologin(username, lrealm, user) && !uid) {
(void)fprintf(stderr, "kerberos su: not in %s's ACL.\n", user);
return (1);
@@ -407,11 +413,22 @@
return (1);
}
- if (chown(krbtkfile, uid, -1) < 0) {
- warn("chown");
+ /*
+ * Set the owner of the ticket file to root but bail if someone
+ * has nefariously swapped a link in place of the file.
+ */
+ fd = open(krbtkfile, O_RDWR|O_NOFOLLOW, 0);
+ if (fd == -1) {
+ warn("unable to open ticket file");
+ (void)unlink(krbtkfile);
+ return (1);
+ }
+ if (fchown(fd, uid, -1) < 0) {
+ warn("fchown");
(void)unlink(krbtkfile);
return (1);
}
+ close(fd);
(void)setpriority(PRIO_PROCESS, 0, -2);