Expose list of completed auth methods to PAM

bz#2408; ok dtucker@

1 files changed, 20 insertions, 6 deletions

diff --git a/session.c b/session.c
index a2588e74..698eaa87 100644
--- a/session.c
+++ b/session.c
@@ -984,8 +984,9 @@ read_etc_default_login(char ***env, u_int *envsize, uid_t uid)
 }
 #endif /* HAVE_ETC_DEFAULT_LOGIN */
 
-void
-copy_environment(char **source, char ***env, u_int *envsize)
+static void
+copy_environment_blacklist(char **source, char ***env, u_int *envsize,
+    const char *blacklist)
 {
 	char *var_name, *var_val;
 	int i;
@@ -1001,13 +1002,22 @@ copy_environment(char **source, char ***env, u_int *envsize)
 		}
 		*var_val++ = '\0';
 
-		debug3("Copy environment: %s=%s", var_name, var_val);
-		child_set_env(env, envsize, var_name, var_val);
+		if (blacklist == NULL ||
+		    match_pattern_list(var_name, blacklist, 0) != 1) {
+			debug3("Copy environment: %s=%s", var_name, var_val);
+			child_set_env(env, envsize, var_name, var_val);
+		}
 
 		free(var_name);
 	}
 }
 
+void
+copy_environment(char **source, char ***env, u_int *envsize)
+{
+	copy_environment_blacklist(source, env, envsize, NULL);
+}
+
 static char **
 do_setup_env(Session *s, const char *shell)
 {
@@ -1169,12 +1179,16 @@ do_setup_env(Session *s, const char *shell)
 	if (options.use_pam) {
 		char **p;
 
+		/*
+		 * Don't allow SSH_AUTH_INFO variables posted to PAM to leak
+		 * back into the environment.
+		 */
 		p = fetch_pam_child_environment();
-		copy_environment(p, &env, &envsize);
+		copy_environment_blacklist(p, &env, &envsize, "SSH_AUTH_INFO*");
 		free_pam_environment(p);
 
 		p = fetch_pam_environment();
-		copy_environment(p, &env, &envsize);
+		copy_environment_blacklist(p, &env, &envsize, "SSH_AUTH_INFO*");
 		free_pam_environment(p);
 	}
 #endif /* USE_PAM */