From 2c978bab94a0a62e5b8bc0d52a777dca394d90cb Mon Sep 17 00:00:00 2001
From: "Dmitry V. Levin" <ldv@strace.io>
Date: Tue, 27 May 2025 08:00:00 +0000
Subject: [PATCH 3/3] pam_namespace: secure_opendir: do not look at the group
 ownership

When the directory is not group-writable, the group ownership does
not matter, and when it is group-writable, there should not be any
exceptions for the root group as there is no guarantee that the root
group does not include non-root users.

Conflict:NA
Reference:https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/pam/1.5.3-5ubuntu5.4/pam_1.5.3-5ubuntu5.4.debian.tar.xz

---
 modules/pam_namespace/pam_namespace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -243,8 +243,7 @@ static int secure_opendir(const char *pa
 			if (dfd_next == -1)
 				goto error;
 		} else if (st.st_uid != 0
-		           || (st.st_gid != 0 && (st.st_mode & S_IWGRP))
-		           || (st.st_mode & S_IWOTH)) {
+		           || (st.st_mode & (S_IWGRP|S_IWOTH))) {
 			/* do not follow symlinks on subdirectories */
 			flags |= O_NOFOLLOW;
 		}