openssh/openssh-6.6p1-keyperm.patch
2014-06-03 16:51:07 +02:00

26 lines
814 B
Diff

diff -up openssh-6.6p1/authfile.c.keyperm openssh-6.6p1/authfile.c
--- openssh-6.6p1/authfile.c.keyperm 2014-02-04 01:20:15.000000000 +0100
+++ openssh-6.6p1/authfile.c 2014-05-05 15:20:43.075246776 +0200
@@ -54,6 +54,7 @@
#include <errno.h>
#include <fcntl.h>
+#include <grp.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@@ -979,6 +980,13 @@ key_perm_ok(int fd, const char *filename
#ifdef HAVE_CYGWIN
if (check_ntsec(filename))
#endif
+ if (st.st_mode & 040) {
+ struct group *gr;
+
+ if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid))
+ st.st_mode &= ~040;
+ }
+
if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: UNPROTECTED PRIVATE KEY FILE! @");