CVS commit: src/lib/libpam/modules/pam_ksu

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

Module Name:    src
Committed By:   riastradh
Date:           Thu Sep  7 11:27:57 UTC 2023

Modified Files:
        src/lib/libpam/modules/pam_ksu: pam_ksu.c

Log Message:
pam_ksu(8): Allow homedir access during kuserok.

Otherwise, the default kuserok logic to look at ~targetuser/.k5login
would be blocked by the security measure to thwart NetBSD-SA2023-005.

(There are other ways, e.g. setting SYSTEM-K5LOGIN in /etc/krb5.conf
so the file is /etc/k5login.d/user instead of ~user/.k5login, but
that's not the default configuration and there are plenty of
deployments that rely on ~user/.k5login today.)

I reviewed libkrb5 for homedir access checks.  There are three:

1. krb5_config_parse_file_multi, called only by:
   - verify_krb5_conf -- not relevant
   - krb5_config_parse_file -- not used here as far as I can tell,
     only by libhdb ldap logic and test code in heimdal
   - krb5_set_config_files -- used here only via krb5_init_context,
     which is done at this point

2. plugin_get_hosts in krbhst.c, used to look up hosts for KDC I/O,
   which shouldn't be happening at this point, so this is almost
   certainly unreachable; also it only appears to control whether
   some old plugin API can be used, long after we have read the krb5
   config controlling which plugins are available, so this is
   probably harmless

3. krb5_kuserok, which is the one we want to allow

Note: This will have to be updated again in the next Heimdal update,
which eliminates the global homedir access flag in favour of making
the default per-context homedir access flag conditional on !issuid.

XXX pullup-10
XXX pullup-9
XXX pullup-8


To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 src/lib/libpam/modules/pam_ksu/pam_ksu.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.