author | Tomas Kuthan <tomas.kuthan@oracle.com> |
Wed, 29 Oct 2014 08:04:59 -0700 | |
changeset 2181 | e4bedf346edf |
permissions | -rw-r--r-- |
2181
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
1 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
2 |
# OpenSSH verifies, that changing [ug]id back to 0 fails, after it |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
3 |
# was set to the values of the user logging in. |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
4 |
# On Solaris, if that user was given PRIV_PROC_SETUID privilege, |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
5 |
# set[gu]id(0) succeeds. But in this case this is not an error in |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
6 |
# dropping privilege, such user is supposed to be able to do that. |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
7 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
8 |
# This fix removes this check entirely. Skipping the check only in |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
9 |
# case PRIV_PROC_SETUID is asserted in the effective set was considered |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
10 |
# but decided against. The check is redundant, because inability to |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
11 |
# restore uid=0 can be inferred from successful run of setreuid(uid, uid). |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
12 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
13 |
# The fix is implemented by replacing an OS-related HAVE_CYGWIN guard |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
14 |
# with a functional NO_UID_RESTORATION_TEST and by defining the new |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
15 |
# symbol in the component Makefile. |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
16 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
17 |
# This patch was submitted upstream: |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
18 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
19 |
# https://bugzilla.mindrot.org/show_bug.cgi?id=2299 |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
20 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
21 |
# See the above URL for details on if/when it might be accepted. |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
22 |
# |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
23 |
diff -ur old/uidswap.c new/uidswap.c |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
24 |
--- old/uidswap.c 2014-01-18 01:43:50.000000000 -0800 |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
25 |
+++ new/uidswap.c 2014-09-04 06:26:32.965065384 -0700 |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
26 |
@@ -134,7 +134,7 @@ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
27 |
void |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
28 |
permanently_drop_suid(uid_t uid) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
29 |
{ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
30 |
-#ifndef HAVE_CYGWIN |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
31 |
+#ifndef NO_UID_RESTORATION_TEST |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
32 |
uid_t old_uid = getuid(); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
33 |
#endif |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
34 |
|
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
35 |
@@ -142,7 +142,7 @@ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
36 |
if (setresuid(uid, uid, uid) < 0) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
37 |
fatal("setresuid %u: %.100s", (u_int)uid, strerror(errno)); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
38 |
|
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
39 |
-#ifndef HAVE_CYGWIN |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
40 |
+#ifndef NO_UID_RESTORATION_TEST |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
41 |
/* Try restoration of UID if changed (test clearing of saved uid) */ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
42 |
if (old_uid != uid && |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
43 |
(setuid(old_uid) != -1 || seteuid(old_uid) != -1)) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
44 |
@@ -199,7 +199,7 @@ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
45 |
void |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
46 |
permanently_set_uid(struct passwd *pw) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
47 |
{ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
48 |
-#ifndef HAVE_CYGWIN |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
49 |
+#ifndef NO_UID_RESTORATION_TEST |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
50 |
uid_t old_uid = getuid(); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
51 |
gid_t old_gid = getgid(); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
52 |
#endif |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
53 |
@@ -227,7 +227,7 @@ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
54 |
if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) < 0) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
55 |
fatal("setresuid %u: %.100s", (u_int)pw->pw_uid, strerror(errno)); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
56 |
|
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
57 |
-#ifndef HAVE_CYGWIN |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
58 |
+#ifndef NO_UID_RESTORATION_TEST |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
59 |
/* Try restoration of GID if changed (test clearing of saved gid) */ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
60 |
if (old_gid != pw->pw_gid && pw->pw_uid != 0 && |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
61 |
(setgid(old_gid) != -1 || setegid(old_gid) != -1)) |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
62 |
@@ -241,7 +241,7 @@ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
63 |
(u_int)pw->pw_gid); |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
64 |
} |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
65 |
|
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
66 |
-#ifndef HAVE_CYGWIN |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
67 |
+#ifndef NO_UID_RESTORATION_TEST |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
68 |
/* Try restoration of UID if changed (test clearing of saved uid) */ |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
69 |
if (old_uid != pw->pw_uid && |
e4bedf346edf
18898794 ssh connections fail with openssh, same config works with sunssh
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
70 |
(setuid(old_uid) != -1 || seteuid(old_uid) != -1)) |