6927e7
diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
6927e7
--- at-3.1.20/at.c.pam	2016-06-28 22:18:00.000000000 +0200
6927e7
+++ at-3.1.20/at.c	2016-07-01 09:44:22.251683924 +0200
6927e7
@@ -144,18 +144,13 @@ sigc(int signo)
6927e7
 /* If the user presses ^C, remove the spool file and exit 
6927e7
  */
6927e7
     if (fcreated) {
6927e7
-	/*
6927e7
         PRIV_START
6927e7
-
6927e7
+        /*
6927e7
         We need the unprivileged uid here since the file is owned by the real
6927e7
         (not effective) uid.
6927e7
         */
6927e7
-        setregid(real_gid, effective_gid);
6927e7
-	    unlink(atfile);
6927e7
-        setregid(effective_gid, real_gid);
6927e7
-        /*
6927e7
+	unlink(atfile);
6927e7
 	PRIV_END
6927e7
-        */
6927e7
     }
6927e7
     exit(EXIT_FAILURE);
6927e7
 }
6927e7
@@ -315,26 +310,19 @@ writefile(time_t runtimer, char queue)
6927e7
 	 * bit.  Yes, this is a kluge.
6927e7
 	 */
6927e7
 	cmask = umask(S_IRUSR | S_IWUSR | S_IXUSR);
6927e7
-        seteuid(real_uid);
6927e7
+       if ((seteuid(effective_uid)) < 0)
6927e7
+	    perr("Error in seteuid: %s", errno);
6927e7
 	if ((fd = open(atfile, O_CREAT | O_EXCL | O_TRUNC | O_WRONLY, S_IRUSR)) == -1)
6927e7
 	    perr("Cannot create atjob file %.500s", atfile);
6927e7
-        seteuid(effective_uid);
6927e7
 
6927e7
 	if ((fd2 = dup(fd)) < 0)
6927e7
 	    perr("Error in dup() of job file");
6927e7
 
6927e7
-        /*
6927e7
 	if (fchown(fd2, real_uid, real_gid) != 0)
6927e7
-	    perr("Cannot give away file");
6927e7
-        */
6927e7
+	    perr("Cannot give real_uid and real_gid the file");
6927e7
 
6927e7
     PRIV_END
6927e7
 
6927e7
-    /* We no longer need suid root; now we just need to be able to write
6927e7
-     * to the directory, if necessary.
6927e7
-     */
6927e7
-
6927e7
-    REDUCE_PRIV(daemon_uid, daemon_gid)
6927e7
     /* We've successfully created the file; let's set the flag so it 
6927e7
      * gets removed in case of an interrupt or error.
6927e7
      */
6927e7
@@ -673,7 +661,7 @@ process_jobs(int argc, char **argv, int
6927e7
                     We need the unprivileged uid here since the file is owned by the real
6927e7
                     (not effective) uid.
6927e7
                     */
6927e7
-                    setregid(real_gid, effective_gid);
6927e7
+		    PRIV_START
6927e7
 
6927e7
 		    if (queue == '=') {
6927e7
 			fprintf(stderr, "Warning: deleting running job\n");
6927e7
@@ -682,8 +670,8 @@ process_jobs(int argc, char **argv, int
6927e7
 			perr("Cannot unlink %.500s", dirent->d_name);
6927e7
 			rc = EXIT_FAILURE;
6927e7
 		    }
6927e7
+		    PRIV_END
6927e7
 
6927e7
-                    setregid(effective_gid, real_gid);
6927e7
 		    done = 1;
6927e7
 
6927e7
 		    break;
6927e7
@@ -693,7 +681,7 @@ process_jobs(int argc, char **argv, int
6927e7
 			FILE *fp;
6927e7
 			int ch;
6927e7
 
6927e7
-			setregid(real_gid, effective_gid);
6927e7
+			PRIV_START
6927e7
 			fp = fopen(dirent->d_name, "r");
6927e7
 
6927e7
 			if (fp) {
6927e7
@@ -706,7 +694,7 @@ process_jobs(int argc, char **argv, int
6927e7
 			    perr("Cannot open %.500s", dirent->d_name);
6927e7
 			    rc = EXIT_FAILURE;
6927e7
 			}
6927e7
-			setregid(effective_gid, real_gid);
6927e7
+			PRIV_END
6927e7
 		    }
6927e7
 		    break;
6927e7
 
6927e7
diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
6927e7
--- at-3.1.20/atd.c.pam	2016-06-28 22:14:39.000000000 +0200
6927e7
+++ at-3.1.20/atd.c	2016-07-01 09:44:22.251683924 +0200
6927e7
@@ -91,6 +91,10 @@ int selinux_enabled = 0;
6927e7
 
6927e7
 /* Macros */
6927e7
 
6927e7
+#ifndef LOG_ATD
6927e7
+#define LOG_ATD        LOG_DAEMON
6927e7
+#endif
6927e7
+
6927e7
 #define BATCH_INTERVAL_DEFAULT 60
6927e7
 #define CHECK_INTERVAL 3600
6927e7
 
6927e7
@@ -114,7 +118,7 @@ static int run_as_daemon = 0;
6927e7
 
6927e7
 static volatile sig_atomic_t term_signal = 0;
6927e7
 
6927e7
-#ifdef HAVE_PAM
6927e7
+#ifdef WITH_PAM
6927e7
 #include <security/pam_appl.h>
6927e7
 
6927e7
 static pam_handle_t *pamh = NULL;
6927e7
@@ -123,15 +127,7 @@ static const struct pam_conv conv = {
6927e7
 	NULL
6927e7
 };
6927e7
 
6927e7
-#define PAM_FAIL_CHECK if (retcode != PAM_SUCCESS) { \
6927e7
-	fprintf(stderr,"\n%s\n",pam_strerror(pamh, retcode)); \
6927e7
-	syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
6927e7
-	pam_end(pamh, retcode); exit(1); \
6927e7
-    }
6927e7
-#define PAM_END { retcode = pam_close_session(pamh,0); \
6927e7
-		pam_end(pamh,retcode); }
6927e7
-
6927e7
-#endif /* HAVE_PAM */
6927e7
+#endif /* WITH_PAM */
6927e7
 
6927e7
 /* Signal handlers */
6927e7
 RETSIGTYPE 
6927e7
@@ -292,7 +288,7 @@ run_file(const char *filename, uid_t uid
6927e7
     char fmt[64];
6927e7
     unsigned long jobno;
6927e7
     int rc;
6927e7
-#ifdef HAVE_PAM
6927e7
+#ifdef WITH_PAM
6927e7
     int retcode;
6927e7
 #endif
6927e7
 
6927e7
@@ -449,17 +445,11 @@ run_file(const char *filename, uid_t uid
6927e7
     fstat(fd_out, &buf;;
6927e7
     size = buf.st_size;
6927e7
 
6927e7
-#ifdef HAVE_PAM
6927e7
-    PRIV_START
6927e7
-    retcode = pam_start("atd", pentry->pw_name, &conv, &pamh);
6927e7
-    PAM_FAIL_CHECK;
6927e7
-    retcode = pam_acct_mgmt(pamh, PAM_SILENT);
6927e7
-    PAM_FAIL_CHECK;
6927e7
-    retcode = pam_open_session(pamh, PAM_SILENT);
6927e7
-    PAM_FAIL_CHECK;
6927e7
-    retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT);
6927e7
-    PAM_FAIL_CHECK;
6927e7
-    PRIV_END
6927e7
+#ifdef WITH_PAM
6927e7
+    AT_START_PAM;
6927e7
+    AT_OPEN_PAM_SESSION;
6927e7
+    closelog(); 
6927e7
+    openlog("atd", LOG_PID, LOG_ATD);
6927e7
 #endif
6927e7
 
6927e7
     close(STDIN_FILENO);
6927e7
@@ -473,7 +463,14 @@ run_file(const char *filename, uid_t uid
6927e7
     else if (pid == 0) {
6927e7
 	char *nul = NULL;
6927e7
 	char **nenvp = &nul;
6927e7
+	char **pam_envp=0L;
6927e7
 
6927e7
+	PRIV_START
6927e7
+#ifdef WITH_PAM
6927e7
+	pam_envp = pam_getenvlist(pamh);
6927e7
+	if ( ( pam_envp != 0L ) && (pam_envp[0] != 0L) )
6927e7
+		nenvp = pam_envp;
6927e7
+#endif
6927e7
 	/* Set up things for the child; we want standard input from the
6927e7
 	 * input file, and standard output and error sent to our output file.
6927e7
 	 */
6927e7
@@ -492,8 +489,6 @@ run_file(const char *filename, uid_t uid
6927e7
 	close(fd_in);
6927e7
 	close(fd_out);
6927e7
 
6927e7
-	PRIV_START
6927e7
-
6927e7
 	    nice((tolower((int) queue) - 'a' + 1) * 2);
6927e7
 
6927e7
 #ifdef WITH_SELINUX
6927e7
@@ -514,9 +509,9 @@ run_file(const char *filename, uid_t uid
6927e7
 
6927e7
 	    chdir("/");
6927e7
 
6927e7
-	    if (execle("/bin/sh", "sh", (char *) NULL, nenvp) != 0)
6927e7
-		perr("Exec failed for /bin/sh");
6927e7
-
6927e7
+	    execle("/bin/sh", "sh", (char *) NULL, nenvp);
6927e7
+	    perr("Exec failed for /bin/sh");
6927e7
+            /* perr exits, the PRIV_END is just for nice form */
6927e7
 	PRIV_END
6927e7
     }
6927e7
     /* We're the parent.  Let's wait.
6927e7
@@ -529,14 +524,6 @@ run_file(const char *filename, uid_t uid
6927e7
      */
6927e7
     waitpid(pid, (int *) NULL, 0);
6927e7
 
6927e7
-#ifdef HAVE_PAM
6927e7
-    PRIV_START
6927e7
-	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT);
6927e7
-	retcode = pam_close_session(pamh, PAM_SILENT);
6927e7
-	pam_end(pamh, retcode);
6927e7
-    PRIV_END
6927e7
-#endif
6927e7
-
6927e7
     /* Send mail.  Unlink the output file after opening it, so it
6927e7
      * doesn't hang around after the run.
6927e7
      */
6927e7
@@ -567,8 +554,13 @@ run_file(const char *filename, uid_t uid
6927e7
     unlink(newname);
6927e7
     free(newname);
6927e7
 
6927e7
+#ifdef ATD_MAIL_PROGRAM
6927e7
     if (((send_mail != -1) && (buf.st_size != size)) || (send_mail == 1)) {
6927e7
+       int mail_pid = -1;
6927e7
 
6927e7
+     mail_pid = fork();
6927e7
+
6927e7
+     if ( mail_pid == 0 ) {
6927e7
 	PRIV_START
6927e7
 
6927e7
 	    if (initgroups(pentry->pw_name, pentry->pw_gid))
6927e7
@@ -590,7 +582,20 @@ run_file(const char *filename, uid_t uid
6927e7
 	    perr("Exec failed for mail command");
6927e7
 
6927e7
 	PRIV_END
6927e7
+     }
6927e7
+     else if ( mail_pid == -1 ) {
6927e7
+           syslog(LOG_ERR, "fork of mailer failed: %m");
6927e7
+     }
6927e7
+     /* Parent */
6927e7
+     waitpid(mail_pid, (int *) NULL, 0);
6927e7
     }
6927e7
+
6927e7
+#ifdef WITH_PAM
6927e7
+    AT_CLOSE_PAM;
6927e7
+    closelog();
6927e7
+    openlog("atd", LOG_PID, LOG_ATD);
6927e7
+#endif
6927e7
+#endif
6927e7
     exit(EXIT_SUCCESS);
6927e7
 }
6927e7
 
6927e7
diff -up at-3.1.20/config.h.in.pam at-3.1.20/config.h.in
6927e7
--- at-3.1.20/config.h.in.pam	2015-12-18 21:29:24.000000000 +0100
6927e7
+++ at-3.1.20/config.h.in	2016-07-01 09:44:22.251683924 +0200
6927e7
@@ -68,8 +68,8 @@
6927e7
 /* Define to 1 if you have the <nlist.h> header file. */
6927e7
 #undef HAVE_NLIST_H
6927e7
 
6927e7
-/* Define to 1 for PAM support */
6927e7
-#undef HAVE_PAM
6927e7
+/* Define if you are building with_pam */
6927e7
+#undef WITH_PAM
6927e7
 
6927e7
 /* Define to 1 if you have the `pstat_getdynamic' function. */
6927e7
 #undef HAVE_PSTAT_GETDYNAMIC
6927e7
diff -up at-3.1.20/configure.ac.pam at-3.1.20/configure.ac
6927e7
--- at-3.1.20/configure.ac.pam	2016-06-28 22:55:52.000000000 +0200
6927e7
+++ at-3.1.20/configure.ac	2016-07-01 09:45:23.268092527 +0200
6927e7
@@ -78,7 +78,7 @@ AC_FUNC_GETLOADAVG
6927e7
 AC_CHECK_FUNCS(getcwd mktime strftime setreuid setresuid sigaction waitpid)
6927e7
 AC_CHECK_HEADERS(security/pam_appl.h, [
6927e7
   PAMLIB="-lpam"
6927e7
-  AC_DEFINE(HAVE_PAM, 1, [Define to 1 for PAM support])
6927e7
+  AC_DEFINE(WITH_PAM, 1, [Define to 1 for PAM support])
6927e7
 ])
6927e7
 
6927e7
 dnl Checking for programs
6927e7
@@ -239,6 +239,13 @@ AC_ARG_WITH(daemon_username,
6927e7
 )
6927e7
 AC_SUBST(DAEMON_USERNAME)
6927e7
 
6927e7
+AC_ARG_WITH(pam,
6927e7
+[ --with-pam            Define to enable pam support ],
6927e7
+AC_DEFINE(WITH_PAM),
6927e7
+)
6927e7
+AC_CHECK_LIB(pam, pam_start, PAMLIB='-lpam -lpam_misc')
6927e7
+AC_SUBST(PAMLIB)
6927e7
+
6927e7
 AC_ARG_WITH(selinux,
6927e7
 [ --with-selinux       Define to run with selinux (default=check)],
6927e7
 [],
6927e7
diff -up at-3.1.20/Makefile.in.pam at-3.1.20/Makefile.in
6927e7
--- at-3.1.20/Makefile.in.pam	2016-07-01 09:44:22.250683901 +0200
6927e7
+++ at-3.1.20/Makefile.in	2016-07-01 09:44:22.252683947 +0200
6927e7
@@ -68,7 +68,7 @@ LIST = Filelist Filelist.asc
6927e7
 all: at atd atd.service atrun
6927e7
 
6927e7
 at: $(ATOBJECTS)
6927e7
-	$(CC) $(LDFLAGS) -pie -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
6927e7
+	$(CC) $(LDFLAGS) -pie -o at $(ATOBJECTS) $(LIBS) $(LEXLIB) $(PAMLIB)
6927e7
 	rm -f $(CLONES)
6927e7
 	$(LN_S) -f at atq
6927e7
 	$(LN_S) -f at atrm
6927e7
diff -up at-3.1.20/perm.c.pam at-3.1.20/perm.c
6927e7
--- at-3.1.20/perm.c.pam	2015-08-22 00:09:22.000000000 +0200
6927e7
+++ at-3.1.20/perm.c	2016-07-01 09:44:22.252683947 +0200
6927e7
@@ -51,6 +51,14 @@
6927e7
 #define PRIV_END while(0)
6927e7
 #endif
6927e7
 
6927e7
+#ifdef WITH_PAM
6927e7
+#include <security/pam_appl.h>
6927e7
+static pam_handle_t *pamh = NULL;
6927e7
+static const struct pam_conv conv = {
6927e7
+       NULL
6927e7
+};
6927e7
+#endif
6927e7
+
6927e7
 /* Structures and unions */
6927e7
 
6927e7
 
6927e7
@@ -108,18 +116,45 @@ user_in_file(const char *path, const cha
6927e7
 int
6927e7
 check_permission()
6927e7
 {
6927e7
-  uid_t uid = geteuid();
6927e7
+  uid_t euid = geteuid(), uid=getuid(), egid=getegid(), gid=getgid();
6927e7
   struct passwd *pentry;
6927e7
   int    allow = 0, deny = 1;
6927e7
 
6927e7
-  if (uid == 0)
6927e7
+  int    retcode = 0;
6927e7
+  if (euid == 0)
6927e7
     return 1;
6927e7
 
6927e7
-  if ((pentry = getpwuid(uid)) == NULL) {
6927e7
+  if ((pentry = getpwuid(euid)) == NULL) {
6927e7
     perror("Cannot access user database");
6927e7
     exit(EXIT_FAILURE);
6927e7
   }
6927e7
 
6927e7
+#ifdef  WITH_PAM
6927e7
+/*
6927e7
+ *  We must check if the atd daemon userid will be allowed to gain the job owner user's
6927e7
+ *  credentials with PAM . If not, the user has been denied at(1) usage, eg. with pam_access.
6927e7
+ */
6927e7
+  if (setreuid(daemon_uid, daemon_uid) != 0) {
6927e7
+      fprintf(stderr, "cannot set egid: %s", strerror(errno));
6927e7
+      exit(1);
6927e7
+  }
6927e7
+  if (setregid(daemon_gid, daemon_gid) != 0) {
6927e7
+      fprintf(stderr, "cannot set euid: %s", strerror(errno));
6927e7
+      exit(1);
6927e7
+  }
6927e7
+
6927e7
+    AT_START_PAM;
6927e7
+    AT_CLOSE_PAM;
6927e7
+    if (setregid(gid,egid) != 0) {
6927e7
+        fprintf(stderr, "cannot set egid: %s", strerror(errno));
6927e7
+        exit(1);
6927e7
+    }
6927e7
+    if (setreuid(uid,euid) != 0) {
6927e7
+        fprintf(stderr, "cannot set euid: %s", strerror(errno));
6927e7
+        exit(1);
6927e7
+    }
6927e7
+#endif
6927e7
+
6927e7
   allow = user_in_file(ETCDIR "/at.allow", pentry->pw_name);
6927e7
   if (allow==0 || allow==1)
6927e7
     return allow;
6927e7
diff -up at-3.1.20/privs.h.pam at-3.1.20/privs.h
6927e7
--- at-3.1.20/privs.h.pam	2015-08-22 00:09:22.000000000 +0200
6927e7
+++ at-3.1.20/privs.h	2016-07-01 09:44:22.252683947 +0200
6927e7
@@ -144,3 +144,63 @@ extern gid_t real_gid, effective_gid, da
6927e7
 #error "Cannot implement user ID swapping without setreuid or setresuid"
6927e7
 #endif
6927e7
 #endif
6927e7
+
6927e7
+#ifdef WITH_PAM
6927e7
+/* PAM failed after session was open.  */
6927e7
+#define PAM_SESSION_FAIL if (retcode != PAM_SUCCESS) \
6927e7
+       pam_close_session(pamh,PAM_SILENT);
6927e7
+
6927e7
+/* syslog will be logging error messages */
6927e7
+#ifdef HAVE_UNISTD_H
6927e7
+#include <syslog.h>
6927e7
+#endif
6927e7
+
6927e7
+/* PAM fail even before opening the session */
6927e7
+#define PAM_FAIL_CHECK \
6927e7
+       do { if (retcode != PAM_SUCCESS) { \
6927e7
+               fprintf(stderr,"PAM failure: %s\n",pam_strerror(pamh, retcode)); \
6927e7
+               syslog(LOG_ERR,"%s",pam_strerror(pamh, retcode)); \
6927e7
+               if (pamh) \
6927e7
+                   pam_end(pamh, retcode); \
6927e7
+               if (setregid(getgid(),getegid()) != 0) { \
6927e7
+                   fprintf(stderr, "cannot set egid: %s", strerror(errno)); \
6927e7
+                   exit(1); \
6927e7
+               } \
6927e7
+               if (setreuid(getuid(),geteuid()) != 0) { \
6927e7
+                   fprintf(stderr, "cannot set euid: %s", strerror(errno)); \
6927e7
+                   exit(1); \
6927e7
+               } \
6927e7
+               exit(1); \
6927e7
+           } \
6927e7
+       } while (0) \
6927e7
+
6927e7
+static int pam_session_opened = 0;      //global for open session
6927e7
+
6927e7
+#define AT_START_PAM { \
6927e7
+        retcode = pam_start("atd", pentry->pw_name, &conv, &pamh); \
6927e7
+        PAM_FAIL_CHECK; \
6927e7
+        retcode = pam_set_item(pamh, PAM_TTY, "atd"); \
6927e7
+        PAM_FAIL_CHECK; \
6927e7
+        retcode = pam_acct_mgmt(pamh, PAM_SILENT); \
6927e7
+        PAM_FAIL_CHECK; \
6927e7
+} 
6927e7
+
6927e7
+#define AT_OPEN_PAM_SESSION { \
6927e7
+        retcode = pam_open_session(pamh, PAM_SILENT); \
6927e7
+        PAM_FAIL_CHECK; \
6927e7
+        retcode = pam_setcred(pamh, PAM_ESTABLISH_CRED | PAM_SILENT); \
6927e7
+        PAM_FAIL_CHECK; \
6927e7
+        if (retcode == PAM_SUCCESS) \
6927e7
+                pam_session_opened = 1; \
6927e7
+}
6927e7
+
6927e7
+#define AT_CLOSE_PAM { \
6927e7
+        if (pam_session_opened != 0) { \
6927e7
+                pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT); \
6927e7
+                pam_close_session(pamh, PAM_SILENT); \
6927e7
+        } \
6927e7
+        pam_end(pamh, PAM_SUCCESS); \
6927e7
+}
6927e7
+
6927e7
+#endif
6927e7
+