Skip to content

Commit

Permalink
calendar: don't setlogin(2) in the -a user handlers
Browse files Browse the repository at this point in the history
As of e67975d ("Fix 'calendar -a' in several ways."), `calendar -a`
will now fork off a new process for each user and do all of its own
processing in the user's own context.

As a side-effect, calendar(1) started calling setlogin(2) in each of the
forked processes and inadvertently hijacked the login name for the
session it was running under, which was typically not a fresh session
but rather that of whatever cron/periodic run spawned it.  Thus, daily
and security e-mails started coming from completely arbitrary user.

We could create a new session, but it appears that nothing calendar(1)
does really needs the login name to be clobbered; opt to just avoid the
setlogin(2) call entirely rather than incur the overhead of a new
session for each process.

PR:		280418
Reviewed by:	des, olce
Fixes:		e67975d ("Fix 'calendar -a' in several ways.")
Differential Revision:	https://reviews.freebsd.org/D46095
  • Loading branch information
kevans91 committed Aug 5, 2024
1 parent 1f628be commit 6cb8b61
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion usr.bin/calendar/calendar.c
Original file line number Diff line number Diff line change
Expand Up @@ -211,7 +211,7 @@ main(int argc, char *argv[])

lc = login_getpwclass(pw);
if (setusercontext(lc, pw, pw->pw_uid,
LOGIN_SETALL) != 0)
LOGIN_SETALL & ~LOGIN_SETLOGIN) != 0)
errx(1, "setusercontext");
setenv("HOME", pw->pw_dir, 1);
cal();
Expand Down

0 comments on commit 6cb8b61

Please sign in to comment.