Imported Upstream version 1.8.3

[debian/sudo] / plugins / sudoers / auth / pam.c

diff --git a/plugins/sudoers/auth/pam.c b/plugins/sudoers/auth/pam.c
index d66e30285c8a2bebb87d109bb09cf03dc4592f0a..70e916e0ef2ddb643b8bda817e88f3116451b0f9 100644 (file)
--- a/plugins/sudoers/auth/pam.c
+++ b/plugins/sudoers/auth/pam.c
@@ -80,7 +80,7 @@ static int gotintr;
 static pam_handle_t *pamh;
 
 int
-pam_init(struct passwd *pw, char **promptp, sudo_auth *auth)
+pam_init(struct passwd *pw, sudo_auth *auth)
 {
     static struct pam_conv pam_conv;
     static int pam_status;
@@ -184,10 +184,11 @@ pam_cleanup(struct passwd *pw, sudo_auth *auth)
     int *pam_status = (int *) auth->data;
 
     /* If successful, we can't close the session until pam_end_session() */
-    if (auth->status == AUTH_SUCCESS)
+    if (*pam_status == AUTH_SUCCESS)
        return AUTH_SUCCESS;
 
     *pam_status = pam_end(pamh, *pam_status | PAM_DATA_SILENT);
+    pamh = NULL;
     return *pam_status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE;
 }
 
@@ -209,10 +210,6 @@ pam_begin_session(struct passwd *pw, sudo_auth *auth)
        goto done;
     }
 
-    /* If the user did not have to authenticate there is no pam handle yet. */
-    if (pamh == NULL)
-       pam_init(pw, NULL, NULL);
-
     /*
      * Update PAM_USER to reference the user we are running the command
      * as, as opposed to the user we authenticated as.
@@ -242,16 +239,23 @@ done:
 }
 
 int
-pam_end_session(sudo_auth *auth)
+pam_end_session(struct passwd *pw, sudo_auth *auth)
 {
     int status = PAM_SUCCESS;
 
-    if (pamh) {
+    if (pamh != NULL) {
 #ifndef NO_PAM_SESSION
+       /*
+        * Update PAM_USER to reference the user we are running the command
+        * as to match the call to pam_open_session().
+        */
+       (void) pam_set_item(pamh, PAM_USER, pw->pw_name);
        (void) pam_close_session(pamh, PAM_SILENT);
 #endif
        status = pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT);
+       pamh = NULL;
     }
+
     return status == PAM_SUCCESS ? AUTH_SUCCESS : AUTH_FAILURE;
 }