execute: don't invoke pam_setcred, since we are not running on a tty where the user...

[elogind.git] / src / execute.c

diff --git a/src/execute.c b/src/execute.c
index 6f0f5d09d96b551239e7707d71290305ee825026..1a5f09d324d6f12d47a7c08bfa1c2432bdfda079 100644 (file)
--- a/src/execute.c
+++ b/src/execute.c
@@ -817,9 +817,6 @@ static int setup_pam(
 
         close_session = true;
 
-        if ((pam_code = pam_setcred(handle, PAM_ESTABLISH_CRED | PAM_SILENT)) != PAM_SUCCESS)
-                goto fail;
-
         if ((!(e = pam_getenvlist(handle)))) {
                 pam_code = PAM_BUF_ERR;
                 goto fail;
@@ -886,7 +883,7 @@ static int setup_pam(
          * cleanups, so forget about the handle here. */
         handle = NULL;
 
-        /* Unblock SIGSUR1 again in the parent */
+        /* Unblock SIGTERM again in the parent */
         if (sigprocmask(SIG_SETMASK, &old_ss, NULL) < 0)
                 goto fail;
 
@@ -1255,6 +1252,14 @@ int exec_spawn(ExecCommand *command,
                                 }
                 }
 
+                if (apply_permissions)
+                        if (enforce_groups(context, username, uid) < 0) {
+                                r = EXIT_GROUP;
+                                goto fail_child;
+                        }
+
+                umask(context->umask);
+
 #ifdef HAVE_PAM
                 if (context->pam_name && username) {
                         if (setup_pam(context->pam_name, username, context->tty_path, &pam_env, fds, n_fds) < 0) {
@@ -1264,14 +1269,6 @@ int exec_spawn(ExecCommand *command,
                 }
 #endif
 
-                if (apply_permissions)
-                        if (enforce_groups(context, username, uid) < 0) {
-                                r = EXIT_GROUP;
-                                goto fail_child;
-                        }
-
-                umask(context->umask);
-
                 if (strv_length(context->read_write_dirs) > 0 ||
                     strv_length(context->read_only_dirs) > 0 ||
                     strv_length(context->inaccessible_dirs) > 0 ||