diff options
-rw-r--r-- | contrib/cvs/src/server.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/contrib/cvs/src/server.c b/contrib/cvs/src/server.c index 62bff8f..ddc3488 100644 --- a/contrib/cvs/src/server.c +++ b/contrib/cvs/src/server.c @@ -5237,10 +5237,11 @@ error ENOMEM Virtual memory exhausted.\n"); #if defined (HAVE_KERBEROS) || defined (AUTH_SERVER_SUPPORT) || defined (HAVE_GSSAPI) -static void switch_to_user PROTO((const char *)); +static void switch_to_user PROTO((const char *, const char *)); static void -switch_to_user (username) +switch_to_user (cvs_username, username) + const char *cvs_username; /* Only used for error messages. */ const char *username; { struct passwd *pw; @@ -5257,6 +5258,20 @@ error 0 %s: no such user\n", username); error_exit (); } + if (pw->pw_uid == 0) + { +#ifdef HAVE_SYSLOG_H + /* FIXME: Can the IP address of the connecting client be retrieved + * and printed here? + */ + syslog (LOG_DAEMON | LOG_ALERT, + "attempt to root from account: %s", cvs_username + ); +#endif + printf("error 0: root not allowed\n"); + error_exit (); + } + #if HAVE_INITGROUPS if (initgroups (pw->pw_name, pw->pw_gid) < 0 # ifdef EPERM @@ -5834,7 +5849,7 @@ pserver_authenticate_connection () strcpy (Pserver_Repos, repository); /* Switch to run as this user. */ - switch_to_user (host_user); + switch_to_user (username, host_user); free (host_user); free (tmp); free (repository); @@ -6027,7 +6042,7 @@ gserver_authenticate_connection () error (1, errno, "fwrite failed"); } - switch_to_user (buf); + switch_to_user ("GSSAPI", buf); printf ("I LOVE YOU\n"); fflush (stdout); |