From 60f4b54d8f5dbd102ad8406d17e605ff52a9bd36 Mon Sep 17 00:00:00 2001 From: Dag-Erling Smørgrav Date: Tue, 6 Jan 2004 09:47:24 +0000 Subject: When root tries to su to a non-existent user, pam_authenticate() will normally succeed (because root can su to anyone), but pam_acct_mgmt() will most likely fail, causing su to log a confusing "pam_acct_mgmt: error in service module" message. To avoid this, call getpwnam() before pam_acct_mgmt(). Sponsored by: registrar.no --- usr.bin/su/su.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/usr.bin/su/su.c b/usr.bin/su/su.c index b70e994993d7..e3c193fd63b4 100644 --- a/usr.bin/su/su.c +++ b/usr.bin/su/su.c @@ -254,6 +254,9 @@ main(int argc, char *argv[]) else syslog(LOG_ERR, "pam_get_item(PAM_USER): %s", pam_strerror(pamh, retcode)); + pwd = getpwnam(user); + if (pwd == NULL) + errx(1, "unknown login: %s", user); retcode = pam_acct_mgmt(pamh, 0); if (retcode == PAM_NEW_AUTHTOK_REQD) { @@ -271,10 +274,7 @@ main(int argc, char *argv[]) errx(1, "Sorry"); } - /* get target login information, default to root */ - pwd = getpwnam(user); - if (pwd == NULL) - errx(1, "unknown login: %s", user); + /* get target login information */ if (class == NULL) lc = login_getpwclass(pwd); else { -- cgit v1.3