diff options
Diffstat (limited to 'auth.c')
-rw-r--r-- | auth.c | 9 |
1 files changed, 3 insertions, 6 deletions
@@ -423,8 +423,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host, | |||
423 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); | 423 | user_hostfile = tilde_expand_filename(userfile, pw->pw_uid); |
424 | if (options.strict_modes && | 424 | if (options.strict_modes && |
425 | (stat(user_hostfile, &st) == 0) && | 425 | (stat(user_hostfile, &st) == 0) && |
426 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | 426 | !secure_permissions(&st, pw->pw_uid)) { |
427 | (st.st_mode & 022) != 0)) { | ||
428 | logit("Authentication refused for %.100s: " | 427 | logit("Authentication refused for %.100s: " |
429 | "bad owner or modes for %.200s", | 428 | "bad owner or modes for %.200s", |
430 | pw->pw_name, user_hostfile); | 429 | pw->pw_name, user_hostfile); |
@@ -486,8 +485,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir, | |||
486 | snprintf(err, errlen, "%s is not a regular file", buf); | 485 | snprintf(err, errlen, "%s is not a regular file", buf); |
487 | return -1; | 486 | return -1; |
488 | } | 487 | } |
489 | if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) || | 488 | if (!secure_permissions(stp, uid)) { |
490 | (stp->st_mode & 022) != 0) { | ||
491 | snprintf(err, errlen, "bad ownership or modes for file %s", | 489 | snprintf(err, errlen, "bad ownership or modes for file %s", |
492 | buf); | 490 | buf); |
493 | return -1; | 491 | return -1; |
@@ -502,8 +500,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir, | |||
502 | strlcpy(buf, cp, sizeof(buf)); | 500 | strlcpy(buf, cp, sizeof(buf)); |
503 | 501 | ||
504 | if (stat(buf, &st) < 0 || | 502 | if (stat(buf, &st) < 0 || |
505 | (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) || | 503 | !secure_permissions(&st, uid)) { |
506 | (st.st_mode & 022) != 0) { | ||
507 | snprintf(err, errlen, | 504 | snprintf(err, errlen, |
508 | "bad ownership or modes for directory %s", buf); | 505 | "bad ownership or modes for directory %s", buf); |
509 | return -1; | 506 | return -1; |