- (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h

   openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being
   inherited by the child.  ok djm@

diff --git a/configure.ac b/configure.ac
index dadcd018b5bbb976493fc3c1fe922cb18c6f7e87..5529a25bbf2bffc81783d2dd06c3562482247e7f 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -802,7 +802,7 @@ AC_CHECK_FUNCS(\
        setproctitle setregid setreuid setrlimit \
        setsid setvbuf sigaction sigvec snprintf socketpair strerror \
        strlcat strlcpy strmode strnvis strtoul sysconf tcgetpgrp \
-       truncate updwtmpx utimes vhangup vsnprintf waitpid \
+       truncate unsetenv updwtmpx utimes vhangup vsnprintf waitpid \
 )
 
 # IRIX has a const char return value for gai_strerror()

diff --git a/openbsd-compat/bsd-misc.h b/openbsd-compat/bsd-misc.h
index aabc3955670af1f49d0306836c6bebcb53daca31..f74665350f02e63a512663eb055756924b35cd35 100644 (file)
--- a/openbsd-compat/bsd-misc.h
+++ b/openbsd-compat/bsd-misc.h
@@ -89,6 +89,10 @@ pid_t tcgetpgrp(int);
 int tcsendbreak(int, int);
 #endif
 
+#ifndef HAVE_UNSETENV
+void unsetenv(const char *);
+#endif
+
 /* wrapper for signal interface */
 typedef void (*mysig_t)(int);
 mysig_t mysignal(int sig, mysig_t act);

diff --git a/openbsd-compat/setenv.c b/openbsd-compat/setenv.c
index b7ba0ce83b89c2ec68625e0032514561026a7809..c3a86c651cbc52260548c8d16b450104c77bc498 100644 (file)
--- a/openbsd-compat/setenv.c
+++ b/openbsd-compat/setenv.c
@@ -30,7 +30,7 @@
  */
 
 #include "includes.h"
-#ifndef HAVE_SETENV
+#if !defined(HAVE_SETENV) || !defined(HAVE_UNSETENV)
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char *rcsid = "$OpenBSD: setenv.c,v 1.6 2003/06/02 20:18:38 millert Exp $";
@@ -77,6 +77,7 @@ __findenv(name, offset)
        return (NULL);
 }
 
+#ifndef HAVE_SETENV
 /*
  * setenv --
  *     Set the value of the environmental variable "name" to be
@@ -138,7 +139,9 @@ setenv(name, value, rewrite)
                ;
        return (0);
 }
+#endif /* HAVE_SETENV */
 
+#ifndef HAVE_UNSETENV
 /*
  * unsetenv(name) --
  *     Delete environmental variable "name".
@@ -157,5 +160,6 @@ unsetenv(name)
                        if (!(*P = *(P + 1)))
                                break;
 }
+#endif /* HAVE_UNSETENV */
 
-#endif /* HAVE_SETENV */
+#endif /* !defined(HAVE_SETENV) || !defined(HAVE_UNSETENV) */

diff --git a/sshd.c b/sshd.c
index 2c224b9c3d315cf0aaa7fb2267d3c28f46d8ee6e..3247091a4c1fd6ccba844d142d5a01f440138aa7 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -939,6 +939,13 @@ main(int ac, char **av)
            SYSLOG_FACILITY_AUTH : options.log_facility,
            log_stderr || !inetd_flag);
 
+#ifdef _AIX
+       /*
+        * Unset KRB5CCNAME, otherwise the user's session may inherit it from
+        * root's environment
+        */ 
+       unsetenv("KRB5CCNAME");
+#endif /* _AIX */
 #ifdef _UNICOS
        /* Cray can define user privs drop all prives now!
         * Not needed on PRIV_SU systems!