Skip to content

Commit d712861

Browse files
authored
[TACACS] Fix when set TACACS to "tacacs+, local" user can run blocked command with local permission issue. (#17749)
Fix when set TACACS to "tacacs+, local" user can run blocked command with local permission issue. #### Why I did it When set TACACS to "tacacs+, local", user still can run a blocked command with local permission. ##### Work item tracking - Microsoft ADO: 26399545 #### How I did it Fix code to reject command when authorized failed from TACACS server side. #### How to verify it Pass all UT. ### Description for the changelog Fix when set TACACS to "tacacs+, local" user can run blocked command with local permission issue.
1 parent b557488 commit d712861

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

src/tacacs/bash_tacplus/bash_tacplus.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -471,8 +471,9 @@ int on_shell_execve (char *user, int shell_level, char *cmd, char **argv)
471471
fprintf(stdout, "%s not authorized by TACACS+ with given arguments, not executing\n", cmd);
472472
break;
473473
default:
474+
// when command reject by server, authorization will failed immediately
474475
fprintf(stdout, "%s authorize failed by TACACS+ with given arguments, not executing\n", cmd);
475-
break;
476+
return ret;
476477
}
477478

478479
if ((tacacs_ctrl & AUTHORIZATION_FLAG_LOCAL) == 0) {

0 commit comments

Comments
 (0)