- dtucker@cvs.openbsd.org 2010/01/12 01:31:05

     [session.c]
     Do not allow logins if /etc/nologin exists but is not readable by the user
     logging in.  Noted by Jan.Pechanec at Sun, ok djm@ deraadt@

diff --git a/ChangeLog b/ChangeLog
index 0317221eef83d5603de13c277cc1870412a409c3..ddfa8af4438b0c0dcdc372c3a700ac02d0c870f1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,6 +27,10 @@
      [roaming_common.c]
      delete with extreme prejudice a debug() that fired with every keypress;
      ok dtucker deraadt
+   - dtucker@cvs.openbsd.org 2010/01/12 01:31:05
+     [session.c]
+     Do not allow logins if /etc/nologin exists but is not readable by the user
+     logging in.  Noted by Jan.Pechanec at Sun, ok djm@ deraadt@
 
 20100110
  - (dtucker) [configure.ac misc.c readconf.c servconf.c ssh-keyscan.c]

diff --git a/session.c b/session.c
index 733b5a9095c225885a30dc50bd6cb767050fbb90..6cd07d4fe8e295088bb60881a2ac7b68f19bf1b2 100644 (file)
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.249 2009/11/20 00:15:41 dtucker Exp $ */
+/* $OpenBSD: session.c,v 1.250 2010/01/12 01:31:05 dtucker Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -1387,10 +1387,12 @@ do_nologin(struct passwd *pw)
        if (pw->pw_uid)
                f = fopen(_PATH_NOLOGIN, "r");
 #endif
-       if (f) {
+       if (f != NULL || errno == EPERM) {
                /* /etc/nologin exists.  Print its contents and exit. */
                logit("User %.100s not allowed because %s exists",
                    pw->pw_name, _PATH_NOLOGIN);
+               if (f == NULL)
+                       exit(254);
                while (fgets(buf, sizeof(buf), f))
                        fputs(buf, stderr);
                fclose(f);