* Drop unaccepted (unapplying) coverity patches * Drop server support for SSH1 (server) * Workaround #2641 for systemd * UseLogin is gone * Drop upstream commit 28652bca * Tighten seccomp filter (cache credentials before entering sandbox) (#1395288)
184 lines
5.4 KiB
Diff
184 lines
5.4 KiB
Diff
diff -up openssh-7.4p1/monitor_wrap.c.audit-race openssh-7.4p1/monitor_wrap.c
|
|
--- openssh-7.4p1/monitor_wrap.c.audit-race 2016-12-23 16:35:52.694685771 +0100
|
|
+++ openssh-7.4p1/monitor_wrap.c 2016-12-23 16:35:52.697685772 +0100
|
|
@@ -1107,4 +1107,48 @@ mm_audit_destroy_sensitive_data(const ch
|
|
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
|
|
buffer_free(&m);
|
|
}
|
|
+
|
|
+int mm_forward_audit_messages(int fdin)
|
|
+{
|
|
+ u_char buf[4];
|
|
+ u_int blen, msg_len;
|
|
+ Buffer m;
|
|
+ int ret = 0;
|
|
+
|
|
+ debug3("%s: entering", __func__);
|
|
+ buffer_init(&m);
|
|
+ do {
|
|
+ blen = atomicio(read, fdin, buf, sizeof(buf));
|
|
+ if (blen == 0) /* closed pipe */
|
|
+ break;
|
|
+ if (blen != sizeof(buf)) {
|
|
+ error("%s: Failed to read the buffer from child", __func__);
|
|
+ ret = -1;
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ msg_len = get_u32(buf);
|
|
+ if (msg_len > 256 * 1024)
|
|
+ fatal("%s: read: bad msg_len %d", __func__, msg_len);
|
|
+ buffer_clear(&m);
|
|
+ buffer_append_space(&m, msg_len);
|
|
+ if (atomicio(read, fdin, buffer_ptr(&m), msg_len) != msg_len) {
|
|
+ error("%s: Failed to read the the buffer content from the child", __func__);
|
|
+ ret = -1;
|
|
+ break;
|
|
+ }
|
|
+ if (atomicio(vwrite, pmonitor->m_recvfd, buf, blen) != blen ||
|
|
+ atomicio(vwrite, pmonitor->m_recvfd, buffer_ptr(&m), msg_len) != msg_len) {
|
|
+ error("%s: Failed to write the message to the monitor", __func__);
|
|
+ ret = -1;
|
|
+ break;
|
|
+ }
|
|
+ } while (1);
|
|
+ buffer_free(&m);
|
|
+ return ret;
|
|
+}
|
|
+void mm_set_monitor_pipe(int fd)
|
|
+{
|
|
+ pmonitor->m_recvfd = fd;
|
|
+}
|
|
#endif /* SSH_AUDIT_EVENTS */
|
|
diff -up openssh-7.4p1/monitor_wrap.h.audit-race openssh-7.4p1/monitor_wrap.h
|
|
--- openssh-7.4p1/monitor_wrap.h.audit-race 2016-12-23 16:35:52.694685771 +0100
|
|
+++ openssh-7.4p1/monitor_wrap.h 2016-12-23 16:35:52.698685772 +0100
|
|
@@ -83,6 +83,8 @@ void mm_audit_unsupported_body(int);
|
|
void mm_audit_kex_body(int, char *, char *, char *, char *, pid_t, uid_t);
|
|
void mm_audit_session_key_free_body(int, pid_t, uid_t);
|
|
void mm_audit_destroy_sensitive_data(const char *, pid_t, uid_t);
|
|
+int mm_forward_audit_messages(int);
|
|
+void mm_set_monitor_pipe(int);
|
|
#endif
|
|
|
|
struct Session;
|
|
diff -up openssh-7.4p1/session.c.audit-race openssh-7.4p1/session.c
|
|
--- openssh-7.4p1/session.c.audit-race 2016-12-23 16:35:52.695685771 +0100
|
|
+++ openssh-7.4p1/session.c 2016-12-23 16:37:26.339730596 +0100
|
|
@@ -162,6 +162,10 @@ static Session *sessions = NULL;
|
|
login_cap_t *lc;
|
|
#endif
|
|
|
|
+#ifdef SSH_AUDIT_EVENTS
|
|
+int paudit[2];
|
|
+#endif
|
|
+
|
|
static int is_child = 0;
|
|
static int in_chroot = 0;
|
|
static int have_dev_log = 1;
|
|
@@ -289,6 +293,8 @@ xauth_valid_string(const char *s)
|
|
return 1;
|
|
}
|
|
|
|
+void child_destory_sensitive_data();
|
|
+
|
|
#define USE_PIPES 1
|
|
/*
|
|
* This is called to fork and execute a command when we have no tty. This
|
|
@@ -424,6 +430,8 @@ do_exec_no_pty(Session *s, const char *c
|
|
cray_init_job(s->pw); /* set up cray jid and tmpdir */
|
|
#endif
|
|
|
|
+ child_destory_sensitive_data();
|
|
+
|
|
/* Do processing for the child (exec command etc). */
|
|
do_child(s, command);
|
|
/* NOTREACHED */
|
|
@@ -547,6 +555,9 @@ do_exec_pty(Session *s, const char *comm
|
|
/* Close the extra descriptor for the pseudo tty. */
|
|
close(ttyfd);
|
|
|
|
+ /* Do this early, so we will not block large MOTDs */
|
|
+ child_destory_sensitive_data();
|
|
+
|
|
/* record login, etc. similar to login(1) */
|
|
#ifdef _UNICOS
|
|
cray_init_job(s->pw); /* set up cray jid and tmpdir */
|
|
@@ -717,6 +728,8 @@ do_exec(Session *s, const char *command)
|
|
}
|
|
if (s->command != NULL && s->ptyfd == -1)
|
|
s->command_handle = PRIVSEP(audit_run_command(s->command));
|
|
+ if (pipe(paudit) < 0)
|
|
+ fatal("pipe: %s", strerror(errno));
|
|
#endif
|
|
if (s->ttyfd != -1)
|
|
ret = do_exec_pty(s, command);
|
|
@@ -732,6 +745,20 @@ do_exec(Session *s, const char *command)
|
|
*/
|
|
buffer_clear(&loginmsg);
|
|
|
|
+#ifdef SSH_AUDIT_EVENTS
|
|
+ close(paudit[1]);
|
|
+ if (use_privsep && ret == 0) {
|
|
+ /*
|
|
+ * Read the audit messages from forked child and send them
|
|
+ * back to monitor. We don't want to communicate directly,
|
|
+ * because the messages might get mixed up.
|
|
+ * Continue after the pipe gets closed (all messages sent).
|
|
+ */
|
|
+ ret = mm_forward_audit_messages(paudit[0]);
|
|
+ }
|
|
+ close(paudit[0]);
|
|
+#endif /* SSH_AUDIT_EVENTS */
|
|
+
|
|
return ret;
|
|
}
|
|
|
|
@@ -1538,6 +1565,33 @@ child_close_fds(void)
|
|
endpwent();
|
|
}
|
|
|
|
+void
|
|
+child_destory_sensitive_data()
|
|
+{
|
|
+#ifdef SSH_AUDIT_EVENTS
|
|
+ int pparent = paudit[1];
|
|
+ close(paudit[0]);
|
|
+ /* Hack the monitor pipe to avoid race condition with parent */
|
|
+ if (use_privsep)
|
|
+ mm_set_monitor_pipe(pparent);
|
|
+#endif
|
|
+
|
|
+ /* remove hostkey from the child's memory */
|
|
+ destroy_sensitive_data(use_privsep);
|
|
+ /*
|
|
+ * We can audit this, because we hacked the pipe to direct the
|
|
+ * messages over postauth child. But this message requires answer
|
|
+ * which we can't do using one-way pipe.
|
|
+ */
|
|
+ packet_destroy_all(0, 1);
|
|
+
|
|
+#ifdef SSH_AUDIT_EVENTS
|
|
+ /* Notify parent that we are done */
|
|
+ close(pparent);
|
|
+#endif
|
|
+
|
|
+}
|
|
+
|
|
/*
|
|
* Performs common processing for the child, such as setting up the
|
|
* environment, closing extra file descriptors, setting the user and group
|
|
@@ -1554,12 +1608,6 @@ do_child(Session *s, const char *command
|
|
struct passwd *pw = s->pw;
|
|
int r = 0;
|
|
|
|
- /* remove hostkey from the child's memory */
|
|
- destroy_sensitive_data(1);
|
|
- /* Don't audit this - both us and the parent would be talking to the
|
|
- monitor over a single socket, with no synchronization. */
|
|
- packet_destroy_all(0, 1);
|
|
-
|
|
/* Force a password change */
|
|
if (s->authctxt->force_pwchange) {
|
|
do_setusercontext(pw);
|