File krb5-appl-MITKRB5-SA-2011-005.dif of Package krb5-appl.import5593

Index: krb5-appl-1.0/configure.ac
===================================================================
--- krb5-appl-1.0.orig/configure.ac
+++ krb5-appl-1.0/configure.ac
@@ -107,6 +107,7 @@ AC_CHECK_FUNCS(_getpty cgetent getcwd ge
 AC_CHECK_FUNCS(getutmpx grantpt inet_aton initgroups isatty killpg killpg)
 AC_CHECK_FUNCS(line_push ptsname revoke rmufile rresvport_af)
 AC_CHECK_FUNCS(seteuid setlogin setpgid setpriority setresuid setreuid)
+AC_CHECK_FUNCS(setegid setregid setresgid)
 AC_CHECK_FUNCS(setutent setutsent setutxent strsave tcgetpgrp tcsetpgrp)
 AC_CHECK_FUNCS(ttyname unsetenv updwtmp updwtmpx utimes utmpname utmpxname)
 AC_CHECK_FUNCS(vhangup vsnprintf waitpid)
Index: krb5-appl-1.0/gssftp/ftpd/ftpd.c
===================================================================
--- krb5-appl-1.0.orig/gssftp/ftpd/ftpd.c
+++ krb5-appl-1.0/gssftp/ftpd/ftpd.c
@@ -986,9 +986,14 @@ login(passwd, logincode)
 #endif
 	}
 
-	(void) krb5_setegid((gid_t)pw->pw_gid);
-	(void) initgroups(pw->pw_name, pw->pw_gid);
-
+	if (krb5_setegid((gid_t)pw->pw_gid) < 0) {
+		reply(550, "Can't set egid.");
+		goto bad;
+	}
+	if (geteuid() == 0 && initgroups(pw->pw_name, pw->pw_gid) < 0) {
+		reply(550, "Can't initgroups");
+		goto bad;
+	}
 	/* open wtmp before chroot */
 	(void) snprintf(ttyline, sizeof(ttyline), "ftp%ld", (long) getpid());
 	pty_logwtmp(ttyline, pw->pw_name, rhost_sane);
Index: krb5-appl-1.0/k5-util.h
===================================================================
--- krb5-appl-1.0.orig/k5-util.h
+++ krb5-appl-1.0/k5-util.h
@@ -69,8 +69,7 @@
 #elif defined(HAVE_SETREUID)
 #  define krb5_seteuid(EUID)	setreuid(geteuid(), (uid_t)(EUID))
 #else
-   /* You need to add a case to deal with this operating system.*/
-#  define krb5_seteuid(EUID)	(errno = EPERM, -1)
+#  error "You need to add a case to deal with this operating system."
 #endif
 
 #ifdef HAVE_SETEGID
@@ -80,8 +79,7 @@
 #elif defined(HAVE_SETREGID)
 #  define krb5_setegid(EGID)	(setregid(getegid(), (gid_t)(EGID)))
 #else
-   /* You need to add a case to deal with this operating system.*/
-#  define krb5_setegid(EGID)	(errno = EPERM, -1)
+#  error "You need to add a case to deal with this operating system."
 #endif
 
 #endif