- (djm) Move PAM session setup back to before setuid to user. Fixes

   problems on Solaris-derived PAMs.

diff --git a/ChangeLog b/ChangeLog
index c7afbf985f81c69e1732745c535b5bcea6dbcde8..c915cf6ad7da16fa3c85dce3ba35c4474653afe9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20010215
+ - (djm) Move PAM session setup back to before setuid to user. Fixes 
+   problems on Solaris-derived PAMs.
+
 20010214
  - (djm) Don't try to close PAM session or delete credentials if the
    session has not been open or credentials not set. Based on patch from 

diff --git a/session.c b/session.c
index a595a53cc5493c7ae3dbbd752098fc5e354da89e..1cdc91ef4fb518f7eb2137150ba77e0469fae04c 100644 (file)
--- a/session.c
+++ b/session.c
@@ -1016,6 +1016,10 @@ do_child(const char *command, struct passwd * pw, const char *term,
 #endif /* WITH_IRIX_ARRAY */
 #endif /* WITH_IRIX_JOBS */
 
+#ifdef USE_PAM
+       do_pam_session(pw->pw_name, ttyname);
+       do_pam_setcred();
+#endif /* USE_PAM */
 
        /* login(1) is only called if we execute the login shell */
        if (options.use_login && command != NULL)
@@ -1129,11 +1133,6 @@ do_child(const char *command, struct passwd * pw, const char *term,
        shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
 #endif
 
-#ifdef USE_PAM
-       do_pam_session(pw->pw_name, ttyname);
-       do_pam_setcred();
-#endif /* USE_PAM */
-
 #ifdef AFS
        /* Try to get AFS tokens for the local cell. */
        if (k_hasafs()) {