Package: libpam-tmpdir
Version: 0.05-2
Severity: important
I use grsecurity on my server and pam_tmpdir sets TMP='(null)/1001' - I
looked at the source and came over this snippet in get_tmp_dir:
/* Start paranoia checks */
if (check_path(confdir) != 0) {
return NULL;
}
The problem with that code is that the calling function does not check
for NULL values. If you have grsecurity and hide / from sshd (that was
my problem), you get such strange paths. I would suggest emitting a
syslog error and returning DEFAULT_SYSUSRTMP in this place, so it works
the same way as if the user has no config file for pam_tmpdir.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.14.2-grsec
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Versions of packages libpam-tmpdir depends on:
ii libc6 2.3.2.ds1-22 GNU C Library: Shared libraries an
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
