google / google/google-authenticator-libpam

Process exits: failure to restore uid on Mac

Open
#111 7 comments 0 reactions 1 assignee Claimed by @ThomasHabets View on GitHub
bug macOS
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

On Mac, there is no setfsuid, so the module is using seteuid to control the UID of the filesystem checks.

If the user does not exist, then the "nobody" user is used as a fallback.

However, after switching euid to "nobody" the module is unable to switch back to root, and _exit is called after logging the error at level LOG_EMERG.

To reproduce on MacOS:

```
auth pam_opendirectory.so
auth pam_google_authenticator.so
```

Then connect to a running service and enter a bogus username/password.

_exit is called from within pam_google_authenticator.so, which abruptly terminates the process, after logging "We switched users from 0 to 4294967294, but can't switch back".

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.