Solaris PAM: Cannot delete credentials

[Hans Werner Strube]

> As has been reported several times, openssh with PAM in Solaris gives
> a debug message on logout: Cannot delete credentials.
> Here is a patch for auth-pam.c (possibly Solaris-specific).
> The line numbers hold at least for 2.9.9p2 through 3.0.1p1.
> Note that seteuid() is not sufficient, one must use setuid().
> It would be more efficient to save the uid of the session and pass it,
> in order to avoid pam_get_item() and getpwnam(), but this would me a
> major change.

Here is the "major change", involving auth-pam.c, auth-pam.h, session.c.
The change of the first argument of do_pam_session() is possible, because
this argument has not been used in the original version.
Please treat with caution, since I have no actual overview over the
global interdependence and calling sequence of the functions in sshd.
But it worked for a login connection as well as a tty-less connection in
Solaris 7, without yielding the debug message "Cannot delete credentials."

*** auth-pam.c.ORI	Fri Nov  9 21:22:17 2001
--- auth-pam.c	Thu Nov 22 12:30:29 2001
***************
*** 62,67 ****
--- 62,68 ----
  /* Remember what has been initialised */
  static int session_opened = 0;
  static int creds_set = 0;
+ static uid_t session_uid = 0;
  
  /* accessor which allows us to switch conversation structs according to
   * the authentication method being used */
***************
*** 184,190 ****
--- 185,196 ----
  	}
  
  	if (__pamh && creds_set) {
+ 		int flag=1;
+ 		if (session_uid != 0 && getuid() == 0)
+ 			flag = setuid(session_uid);
  		pam_retval = pam_setcred(__pamh, PAM_DELETE_CRED);
+ 		if (!flag)
+ 			setuid(0);
  		if (pam_retval != PAM_SUCCESS)
  			debug("Cannot delete credentials[%d]: %.200s", 
  			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
***************
*** 267,273 ****
  }
  
  /* Do PAM-specific session initialisation */
! void do_pam_session(char *username, const char *ttyname)
  {
  	int pam_retval;
  
--- 273,279 ----
  }
  
  /* Do PAM-specific session initialisation */
! void do_pam_session(uid_t uid, const char *ttyname)
  {
  	int pam_retval;
  
***************
*** 287,292 ****
--- 293,299 ----
  		    pam_retval, PAM_STRERROR(__pamh, pam_retval));
  
  	session_opened = 1;
+ 	session_uid = uid;
  }
  
  /* Set PAM credentials */
*** auth-pam.h.ORI	Tue Mar 27 08:12:24 2001
--- auth-pam.h	Thu Nov 22 12:28:39 2001
***************
*** 11,17 ****
  char **fetch_pam_environment(void);
  int do_pam_authenticate(int flags);
  int do_pam_account(char *username, char *remote_user);
! void do_pam_session(char *username, const char *ttyname);
  void do_pam_setcred(int init);
  void print_pam_messages(void);
  int is_pam_password_change_required(void);
--- 11,17 ----
  char **fetch_pam_environment(void);
  int do_pam_authenticate(int flags);
  int do_pam_account(char *username, char *remote_user);
! void do_pam_session(uid_t uid, const char *ttyname);
  void do_pam_setcred(int init);
  void print_pam_messages(void);
  int is_pam_password_change_required(void);
*** session.c.ORI	Mon Nov 19 16:44:42 2001
--- session.c	Thu Nov 22 12:24:39 2001
***************
*** 437,443 ****
  	session_proctitle(s);
  
  #if defined(USE_PAM)
! 	do_pam_session(s->pw->pw_name, NULL);
  	do_pam_setcred(1);
  	if (is_pam_password_change_required())
  		packet_disconnect("Password change required but no "
--- 437,443 ----
  	session_proctitle(s);
  
  #if defined(USE_PAM)
! 	do_pam_session(s->pw->pw_uid, NULL);
  	do_pam_setcred(1);
  	if (is_pam_password_change_required())
  		packet_disconnect("Password change required but no "
***************
*** 555,561 ****
  	ttyfd = s->ttyfd;
  
  #if defined(USE_PAM)
! 	do_pam_session(s->pw->pw_name, s->tty);
  	do_pam_setcred(1);
  #endif
  
--- 555,561 ----
  	ttyfd = s->ttyfd;
  
  #if defined(USE_PAM)
! 	do_pam_session(s->pw->pw_uid, s->tty);
  	do_pam_setcred(1);
  #endif