--- openssh-5.2p1/session.c 2009-03-20 18:08:11.263662384 +0100 +++ openssh-5.2p1/session.c 2009-03-20 18:26:29.925498409 +0100 @@ -1408,6 +1408,7 @@ const char *cp; char component[MAXPATHLEN]; struct stat st; + int last; if (*path != '/') fatal("chroot path does not begin at root"); @@ -1419,7 +1420,7 @@ * root-owned directory with strict permissions. */ for (cp = path; cp != NULL;) { - if ((cp = strchr(cp, '/')) == NULL) + if (((last = ((cp = strchr(cp, '/')) == NULL)))) strlcpy(component, path, sizeof(component)); else { cp++; @@ -1432,7 +1433,7 @@ if (stat(component, &st) != 0) fatal("%s: stat(\"%s\"): %s", __func__, component, strerror(errno)); - if (st.st_uid != 0 || (st.st_mode & 022) != 0) + if ((st.st_uid != 0 || (st.st_mode & 022) != 0) && !(last && st.st_uid == uid)) fatal("bad ownership or modes for chroot " "directory %s\"%s\"", cp == NULL ? "" : "component ", component);