Description: Runs PAM_REINITIALIZE_CRED after fork to apply correct rights to child process.
Author: Jorge Rocha Gualtieri <jorge@jrg.com.br>
Last-Update: 2021-03-01
Bug-Debian: https://bugs.debian.org/983817
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1917350
Index: cron-3.0pl1/do_command.c
===================================================================
--- cron-3.0pl1.orig/do_command.c
+++ cron-3.0pl1/do_command.c
@@ -304,6 +304,12 @@ child_process(e, u)
                  exit(ERROR_EXIT);
                }
 # endif
+
+#if defined(USE_PAM)
+                if (pamh != NULL) {
+                        pam_setcred(pamh, PAM_REINITIALIZE_CRED | PAM_SILENT);
+                }
+#endif
                if (setuid(e->uid) !=0) { /* we aren't root after this... */
                        char msg[256];
                        snprintf(msg, 256, "do_command:setuid(%lu) failed: %s",