google / google/google-authenticator-libpam
Process exits: failure to restore uid on Mac
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
On Mac, there is no setfsuid, so the module is using seteuid to control the UID of the filesystem checks.
If the user does not exist, then the "nobody" user is used as a fallback.
However, after switching euid to "nobody" the module is unable to switch back to root, and _exit is called after logging the error at level LOG_EMERG.
To reproduce on MacOS:
```
auth pam_opendirectory.so
auth pam_google_authenticator.so
```
Then connect to a running service and enter a bogus username/password.
_exit is called from within pam_google_authenticator.so, which abruptly terminates the process, after logging "We switched users from 0 to 4294967294, but can't switch back".
Contributor guide
Assessment
This issue has not been assessed yet.