Fix security botch in "UseLogin Yes" case: commands are executed with

uid 0. Obtained from: OpenBSD
2000-06-10 22:32:57 +00:00 · 2000-06-10 22:32:57 +00:00 · 95e2a710ad
commit 95e2a710ad
parent a931d243fa
1 changed files with 4 additions and 0 deletions
--- a/crypto/openssh/session.c
+++ b/crypto/openssh/session.c
@ -858,6 +858,10 @@ do_child(const char *command, struct passwd * pw, const char *term,
 	struct stat st;
 	char *argv[10];

+	/* login(1) is only called if we execute the login shell */
+	if (options.use_login && command != NULL)
+		options.use_login = 0;
+
 #ifdef LOGIN_CAP
 	login_cap_t *lc;