1 files changed, 45 insertions, 16 deletions

diff --git a/session.c b/session.c
index 15bdb1bee..14df2262c 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.266 2013/07/19 07:37:48 markus Exp $ */
+/* $OpenBSD: session.c,v 1.269 2014/01/18 09:36:26 dtucker Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -442,7 +442,7 @@ do_authenticated1(Authctxt *authctxt)
         }
 }
 
-#define USE_PIPES
+#define USE_PIPES 1
 /*
  * This is called to fork and execute a command when we have no tty.  This
  * will call do_child from the child, and server_loop from the parent after
@@ -795,27 +795,50 @@ int
 do_exec(Session *s, const char *command)
 {
         int ret;
+        const char *forced = NULL;
+        char session_type[1024], *tty = NULL;
 
         if (options.adm_forced_command) {
                 original_command = command;
                 command = options.adm_forced_command;
-                if (IS_INTERNAL_SFTP(command)) {
-                        s->is_subsystem = s->is_subsystem ?
-                            SUBSYSTEM_INT_SFTP : SUBSYSTEM_INT_SFTP_ERROR;
-                } else if (s->is_subsystem)
-                        s->is_subsystem = SUBSYSTEM_EXT;
-                debug("Forced command (config) '%.900s'", command);
+                forced = "(config)";
         } else if (forced_command) {
                 original_command = command;
                 command = forced_command;
+                forced = "(key-option)";
+        }
+        if (forced != NULL) {
                 if (IS_INTERNAL_SFTP(command)) {
                         s->is_subsystem = s->is_subsystem ?
                             SUBSYSTEM_INT_SFTP : SUBSYSTEM_INT_SFTP_ERROR;
                 } else if (s->is_subsystem)
                         s->is_subsystem = SUBSYSTEM_EXT;
-                debug("Forced command (key option) '%.900s'", command);
+                snprintf(session_type, sizeof(session_type),
+                    "forced-command %s '%.900s'", forced, command);
+        } else if (s->is_subsystem) {
+                snprintf(session_type, sizeof(session_type),
+                    "subsystem '%.900s'", s->subsys);
+        } else if (command == NULL) {
+                snprintf(session_type, sizeof(session_type), "shell");
+        } else {
+                /* NB. we don't log unforced commands to preserve privacy */
+                snprintf(session_type, sizeof(session_type), "command");
+        }
+
+        if (s->ttyfd != -1) {
+                tty = s->tty;
+                if (strncmp(tty, "/dev/", 5) == 0)
+                        tty += 5;
         }
 
+        verbose("Starting session: %s%s%s for %s from %.200s port %d",
+            session_type,
+            tty == NULL ? "" : " on ",
+            tty == NULL ? "" : tty,
+            s->pw->pw_name,
+            get_remote_ipaddr(),
+            get_remote_port());
+
 #ifdef SSH_AUDIT_EVENTS
         if (command != NULL)
                 PRIVSEP(audit_run_command(command));
@@ -1538,6 +1561,11 @@ do_setusercontext(struct passwd *pw, const char *role)
                  */
                 (void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUMASK);
 #else
+# ifdef USE_LIBIAF
+        if (set_id(pw->pw_name) != 0) {
+                fatal("set_id(%s) Failed", pw->pw_name);
+        }
+# endif /* USE_LIBIAF */
                 /* Permanently switch to the desired uid. */
                 permanently_set_uid(pw);
 #endif
@@ -2048,7 +2076,7 @@ session_pty_req(Session *s)
         u_int len;
         int n_bytes;
 
-        if (no_pty_flag) {
+        if (no_pty_flag || !options.permit_tty) {
                 debug("Allocating a pty not permitted for this authentication.");
                 return 0;
         }
@@ -2109,15 +2137,16 @@ session_subsystem_req(Session *s)
         struct stat st;
         u_int len;
         int success = 0;
-        char *prog, *cmd, *subsys = packet_get_string(&len);
+        char *prog, *cmd;
         u_int i;
 
+        s->subsys = packet_get_string(&len);
         packet_check_eom();
-        logit("subsystem request for %.100s by user %s", subsys,
+        debug2("subsystem request for %.100s by user %s", s->subsys,
             s->pw->pw_name);
 
         for (i = 0; i < options.num_subsystems; i++) {
-                if (strcmp(subsys, options.subsystem_name[i]) == 0) {
+                if (strcmp(s->subsys, options.subsystem_name[i]) == 0) {
                         prog = options.subsystem_command[i];
                         cmd = options.subsystem_args[i];
                         if (strcmp(INTERNAL_SFTP_NAME, prog) == 0) {
@@ -2136,10 +2165,9 @@ session_subsystem_req(Session *s)
         }
 
         if (!success)
-                logit("subsystem request for %.100s failed, subsystem not found",
-                    subsys);
+                logit("subsystem request for %.100s by user %s failed, "
+                    "subsystem not found", s->subsys, s->pw->pw_name);
 
-        free(subsys);
         return success;
 }
 
@@ -2494,6 +2522,7 @@ session_close(Session *s)
         free(s->auth_display);
         free(s->auth_data);
         free(s->auth_proto);
+        free(s->subsys);
         if (s->env != NULL) {
                 for (i = 0; i < s->num_env; i++) {
                         free(s->env[i].name);