- (dtucker) [session.c openbsd-compat/port-aix.h] Bugs #1249 and #1567: move

   the setpcred call on AIX to immediately before the permanently_set_uid().
   Ensures that we still have privileges when we call chroot and
   pam_open_sesson.  Based on a patch from David Leonard.

1 files changed, 4 insertions, 5 deletions

diff --git a/session.c b/session.c
index cdbf88ab7..f4a363543 100644
--- a/session.c
+++ b/session.c
@@ -1466,11 +1466,6 @@ do_setusercontext(struct passwd *pw)
         if (getuid() == 0 || geteuid() == 0)
 #endif /* HAVE_CYGWIN */
         {
-
-#ifdef HAVE_SETPCRED
-                if (setpcred(pw->pw_name, (char **)NULL) == -1)
-                        fatal("Failed to set process credentials");
-#endif /* HAVE_SETPCRED */
 #ifdef HAVE_LOGIN_CAP
 # ifdef __bsdi__
                 setpgid(0, 0);
@@ -1538,6 +1533,10 @@ do_setusercontext(struct passwd *pw)
                         free(chroot_path);
                 }
 
+#ifdef HAVE_SETPCRED
+                if (setpcred(pw->pw_name, (char **)NULL) == -1)
+                        fatal("Failed to set process credentials");
+#endif /* HAVE_SETPCRED */
 #ifdef HAVE_LOGIN_CAP
                 if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUSER) < 0) {
                         perror("unable to set user context (setuser)");