Drop to the user's UID when reading user keys with -a.

1 files changed, 3 insertions, 0 deletions

diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
index 8e1f11f79..52667199c 100644
--- a/ssh-vulnkey.c
+++ b/ssh-vulnkey.c
@@ -41,6 +41,7 @@
 #include "key.h"
 #include "authfile.h"
 #include "pathnames.h"
+#include "uidswap.h"
 #include "misc.h"
 
 extern char *__progname;
@@ -330,8 +331,10 @@ main(int argc, char **argv)
 
                 while ((pw = getpwent()) != NULL) {
                         if (pw->pw_dir) {
+                                temporarily_use_uid(pw);
                                 if (!do_user(pw->pw_dir))
                                         ret = 0;
+                                restore_uid();
                         }
                 }
         } else if (optind == argc) {