- (djm) Move PAM init to after fork for non-Solaris derived PAMs

diff --git a/ChangeLog b/ChangeLog
index 4266e5b1c07d86c4f14b225309d43cd66de95252..98f4b4adb8c6482d9995e929a99a8d559a33134b 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,7 @@
    <markm@swoon.net>
  - (djm) Search for -lcrypt on FreeBSD too
  - (djm) fatal() on OpenSSL version mismatch
+ - (djm) Move PAM init to after fork for non-Solaris derived PAMs
 
 20010226
  - (bal) Fixed bsd-snprinf.c so it now honors 'BROKEN_SNPRINTF' again.

diff --git a/session.c b/session.c
index ee14afa686228387a05242d3b555c7cfe166c870..d4053b4c947c88014da02406f7d5861da42fc2d7 100644 (file)
--- a/session.c
+++ b/session.c
@@ -487,7 +487,8 @@ do_exec_no_pty(Session *s, const char *command, struct passwd * pw)
 
        session_proctitle(s);
 
-#ifdef USE_PAM
+#if defined(USE_PAM) && defined(PAM_SUN_CODEBASE)
+       /* Solaris-derived PAMs don't like doing this after the fork() */
        do_pam_setcred();
 #endif /* USE_PAM */
 
@@ -603,10 +604,11 @@ do_exec_pty(Session *s, const char *command, struct passwd * pw)
        ptyfd = s->ptyfd;
        ttyfd = s->ttyfd;
 
-#ifdef USE_PAM
+#if defined(USE_PAM) && defined(PAM_SUN_CODEBASE)
+       /* Solaris-derived PAMs don't like doing this after the fork() */
        do_pam_session(pw->pw_name, s->tty);
        do_pam_setcred();
-#endif /* USE_PAM */
+#endif
 
        /* Fork the child. */
        if ((pid = fork()) == 0) {
@@ -1032,6 +1034,11 @@ do_child(const char *command, struct passwd * pw, const char *term,
 #endif /* WITH_IRIX_ARRAY */
 #endif /* WITH_IRIX_JOBS */
 
+#if defined(USE_PAM) && !defined(PAM_SUN_CODEBASE)
+       /* Solaris-derived PAMs don't like doing this after the fork() */
+       do_pam_session(pw->pw_name, s->tty);
+       do_pam_setcred();
+#endif
 
        /* login(1) is only called if we execute the login shell */
        if (options.use_login && command != NULL)