- djm@cvs.openbsd.org 2005/06/17 02:44:33

[openssh.git] / session.c

diff --git a/session.c b/session.c
index 7a70b82e68406c87fe67fcc17ff995cc867251e5..a1dc6835a2a609fb61a099feb7dd52c297f973ae 100644 (file)
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.180 2004/07/28 09:40:29 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.182 2005/06/17 02:44:33 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -245,6 +245,10 @@ do_authenticated1(Authctxt *authctxt)
        u_int proto_len, data_len, dlen, compression_level = 0;
 
        s = session_new();
+       if (s == NULL) {
+               error("no more sessions");
+               return;
+       }
        s->authctxt = authctxt;
        s->pw = authctxt->pw;
 
@@ -661,11 +665,15 @@ do_exec(Session *s, const char *command)
                debug("Forced command '%.900s'", command);
        }
 
-#ifdef GSSAPI
-       if (options.gss_authentication) {
-               temporarily_use_uid(s->pw);
-               ssh_gssapi_storecreds();
-               restore_uid();
+#ifdef SSH_AUDIT_EVENTS
+       if (command != NULL)
+               PRIVSEP(audit_run_command(command));
+       else if (s->ttyfd == -1) {
+               char *shell = s->pw->pw_shell;
+
+               if (shell[0] == '\0')   /* empty shell means /bin/sh */
+                       shell =_PATH_BSHELL;
+               PRIVSEP(audit_run_command(shell));
        }
 #endif
 
@@ -938,7 +946,8 @@ read_etc_default_login(char ***env, u_int *envsize, uid_t uid)
 }
 #endif /* HAVE_ETC_DEFAULT_LOGIN */
 
-void copy_environment(char **source, char ***env, u_int *envsize)
+void
+copy_environment(char **source, char ***env, u_int *envsize)
 {
        char *var_name, *var_val;
        int i;
@@ -1086,14 +1095,24 @@ do_setup_env(Session *s, const char *shell)
                child_set_env(&env, &envsize, "TMPDIR", cray_tmpdir);
 #endif /* _UNICOS */
 
+       /*
+        * Since we clear KRB5CCNAME at startup, if it's set now then it
+        * must have been set by a native authentication method (eg AIX or
+        * SIA), so copy it to the child.
+        */
+       {
+               char *cp;
+
+               if ((cp = getenv("KRB5CCNAME")) != NULL)
+                       child_set_env(&env, &envsize, "KRB5CCNAME", cp);
+       }
+
 #ifdef _AIX
        {
                char *cp;
 
                if ((cp = getenv("AUTHSTATE")) != NULL)
                        child_set_env(&env, &envsize, "AUTHSTATE", cp);
-               if ((cp = getenv("KRB5CCNAME")) != NULL)
-                       child_set_env(&env, &envsize, "KRB5CCNAME", cp);
                read_environment_file(&env, &envsize, "/etc/environment");
        }
 #endif
@@ -1253,6 +1272,13 @@ do_setusercontext(struct passwd *pw)
 # ifdef __bsdi__
                setpgid(0, 0);
 # endif
+#ifdef GSSAPI
+               if (options.gss_authentication) {
+                       temporarily_use_uid(pw);
+                       ssh_gssapi_storecreds();
+                       restore_uid();
+               }
+#endif
 # ifdef USE_PAM
                if (options.use_pam) {
                        do_pam_session();
@@ -1283,6 +1309,13 @@ do_setusercontext(struct passwd *pw)
                        exit(1);
                }
                endgrent();
+#ifdef GSSAPI
+               if (options.gss_authentication) {
+                       temporarily_use_uid(pw);
+                       ssh_gssapi_storecreds();
+                       restore_uid();
+               }
+#endif
 # ifdef USE_PAM
                /*
                 * PAM credentials may take the form of supplementary groups.
@@ -1320,7 +1353,12 @@ do_pwchange(Session *s)
        if (s->ttyfd != -1) {
                fprintf(stderr,
                    "You must change your password now and login again!\n");
+#ifdef PASSWD_NEEDS_USERNAME
+               execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
+                   (char *)NULL);
+#else
                execl(_PATH_PASSWD_PROG, "passwd", (char *)NULL);
+#endif
                perror("passwd");
        } else {
                fprintf(stderr,
@@ -1434,13 +1472,14 @@ do_child(Session *s, const char *command)
                 * generated messages, so if this in an interactive
                 * login then display them too.
                 */
-               if (command == NULL)
+               if (!check_quietlogin(s, command))
                        display_loginmsg();
 #endif /* HAVE_OSF_SIA */
        }
 
 #ifdef USE_PAM
-       if (options.use_pam && !is_pam_session_open()) {
+       if (options.use_pam && !options.use_login && !is_pam_session_open()) {
+               debug3("PAM session not opened, exiting");
                display_loginmsg();
                exit(254);
        }
@@ -1762,7 +1801,7 @@ session_subsystem_req(Session *s)
        u_int len;
        int success = 0;
        char *cmd, *subsys = packet_get_string(&len);
-       int i;
+       u_int i;
 
        packet_check_eom();
        logit("subsystem request for %.100s", subsys);
@@ -2068,7 +2107,7 @@ session_exit_message(Session *s, int status)
 void
 session_close(Session *s)
 {
-       int i;
+       u_int i;
 
        debug("session_close: session %d pid %ld", s->self, (long)s->pid);
        if (s->ttyfd != -1)