From 49e82bb9d7a769b7973d8a08202b24e1ef4e76ab Mon Sep 17 00:00:00 2001
From: djm <djm>
Date: Tue, 2 Sep 2003 13:18:52 +0000
Subject: [PATCH]  - (djm) Bug #423: reorder setting of PAM_TTY and calling of
 PAM session    management (now done in do_setusercontext). Largely from   
 michael_steffens AT hp.com

---
 ChangeLog  |  3 +++
 auth-pam.c | 17 +++++++++++------
 auth-pam.h |  3 ++-
 session.c  |  7 ++++---
 4 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b3fb9086..495fb467 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -49,6 +49,9 @@
      fix leak
  - (djm) Don't initialise pam_conv structures inline. Avoids HP/UX compiler
    error. Part of Bug #423, patch from  michael_steffens AT hp.com
+ - (djm) Bug #423: reorder setting of PAM_TTY and calling of PAM session 
+   management (now done in do_setusercontext). Largely from 
+   michael_steffens AT hp.com
 
 20030829
  - (bal) openbsd-compat/ clean up.  Considate headers, add in Id on our
diff --git a/auth-pam.c b/auth-pam.c
index 46976eda..4cfa2002 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -534,13 +534,23 @@ do_pam_account(void)
 }
 
 void
-do_pam_session(const char *user, const char *tty)
+do_pam_session(void)
 {
 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, 
 	    (const void *)&null_conv);
 	if (sshpam_err != PAM_SUCCESS)
 		fatal("PAM: failed to set PAM_CONV: %s",
 		    pam_strerror(sshpam_handle, sshpam_err));
+	sshpam_err = pam_open_session(sshpam_handle, 0);
+	if (sshpam_err != PAM_SUCCESS)
+		fatal("PAM: pam_open_session(): %s",
+		    pam_strerror(sshpam_handle, sshpam_err));
+	sshpam_session_open = 1;
+}
+
+void
+do_pam_set_tty(const char *tty)
+{
 	if (tty != NULL) {
 		debug("PAM: setting PAM_TTY to \"%s\"", tty);
 		sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
@@ -548,11 +558,6 @@ do_pam_session(const char *user, const char *tty)
 			fatal("PAM: failed to set PAM_TTY: %s",
 			    pam_strerror(sshpam_handle, sshpam_err));
 	}
-	sshpam_err = pam_open_session(sshpam_handle, 0);
-	if (sshpam_err != PAM_SUCCESS)
-		fatal("PAM: pam_open_session(): %s",
-		    pam_strerror(sshpam_handle, sshpam_err));
-	sshpam_session_open = 1;
 }
 
 void
diff --git a/auth-pam.h b/auth-pam.h
index 06ba9e10..6b77872d 100644
--- a/auth-pam.h
+++ b/auth-pam.h
@@ -34,7 +34,8 @@
 void start_pam(const char *);
 void finish_pam(void);
 u_int do_pam_account(void);
-void do_pam_session(const char *, const char *);
+void do_pam_session(void);
+void do_pam_set_tty(const char *);
 void do_pam_setcred(int );
 int is_pam_password_change_required(void);
 void do_pam_chauthtok(void);
diff --git a/session.c b/session.c
index 5463eebe..35328ecb 100644
--- a/session.c
+++ b/session.c
@@ -396,7 +396,6 @@ do_exec_no_pty(Session *s, const char *command)
 
 #if defined(USE_PAM)
 	if (options.use_pam) {
-		do_pam_session(s->pw->pw_name, NULL);
 		do_pam_setcred(1);
 		if (is_pam_password_change_required())
 			packet_disconnect("Password change required but no "
@@ -525,7 +524,7 @@ do_exec_pty(Session *s, const char *command)
 
 #if defined(USE_PAM)
 	if (options.use_pam) {
-		do_pam_session(s->pw->pw_name, s->tty);
+		do_pam_set_tty(s->tty);
 		do_pam_setcred(1);
 	}
 #endif
@@ -1205,8 +1204,10 @@ do_setusercontext(struct passwd *pw)
 		 * These will have been wiped by the above initgroups() call.
 		 * Reestablish them here.
 		 */
-		if (options.use_pam)
+		if (options.use_pam) {
+			do_pam_session();
 			do_pam_setcred(0);
+		}
 # endif /* USE_PAM */
 # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
 		irix_setusercontext(pw);
-- 
2.45.2