openssh/openssh-7.2p2-chroot-capabilities.patch
Jakub Jelen ecc9f8d02b When doing chroot
* we should not drop any capabilities for root
 * we should not clear bounding capabilities for other users
 * we should probably retain the supplement groups
2016-10-21 14:50:42 +02:00

104 lines
3.0 KiB
Diff

diff --git a/configure.ac b/configure.ac
index aeef42a..d01e67e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4998,6 +4998,37 @@ if test -n "$conf_lastlog_location"; then
[Define if you want to specify the path to your lastlog file])
fi
+AC_ARG_WITH(libcap-ng,
+ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],,
+ with_libcap_ng=auto)
+
+dnl libcap-ng detection
+if test x$with_libcap_ng = xno ; then
+ have_libcap_ng=no;
+else
+ # Start by checking for header file
+ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
+
+ # See if we have libcap-ng library
+ AC_CHECK_LIB(cap-ng, capng_clear, CAPNG_LDADD=-lcap-ng,)
+
+ # Check results are usable
+ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
+ AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
+ fi
+ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
+ AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
+ fi
+fi
+AC_MSG_CHECKING(whether to use libcap-ng)
+if test x$CAPNG_LDADD != x ; then
+ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
+ SSHDLIBS="$SSHDLIBS -lcap-ng"
+ AC_MSG_RESULT(yes)
+else
+ AC_MSG_RESULT(no)
+fi
+
dnl utmp detection
AC_MSG_CHECKING([if your system defines UTMP_FILE])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
diff --git a/session.c b/session.c
index 6cfcba4..80d2806 100644
--- a/session.c
+++ b/session.c
@@ -96,6 +96,10 @@
#include "monitor_wrap.h"
#include "sftp.h"
+#ifdef HAVE_LIBCAP_NG
+#include <cap-ng.h>
+#endif
+
#if defined(KRB5) && defined(USE_AFS)
#include <kafs.h>
#endif
@@ -1586,6 +1590,7 @@ void
do_setusercontext(struct passwd *pw)
{
char *chroot_path, *tmp;
+ int dropped_suid = -1;
platform_setusercontext(pw);
@@ -1619,10 +1624,25 @@ do_setusercontext(struct passwd *pw)
pw->pw_uid);
chroot_path = percent_expand(tmp, "h", pw->pw_dir,
"u", pw->pw_name, (char *)NULL);
+#ifdef HAVE_LIBCAP_NG
+ /* drop suid soon, retain SYS_CHROOT capability */
+ capng_clear(CAPNG_SELECT_BOTH);
+ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_CHROOT);
+ if (pw->pw_uid != 0 &&
+ (dropped_suid = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_INIT_SUPP_GRP)) != 0)
+ logit("capng_change_id() = %d (failure): Try to drop UID later", dropped_suid);
+#endif
#ifdef WITH_SELINUX
sshd_selinux_copy_context();
#endif
safely_chroot(chroot_path, pw->pw_uid);
+#ifdef HAVE_LIBCAP_NG
+ /* Drop chroot capability. Already used */
+ if (dropped_suid == 0) {
+ capng_clear(CAPNG_SELECT_BOTH);
+ capng_apply(CAPNG_SELECT_BOTH);
+ }
+#endif
free(tmp);
free(chroot_path);
/* Make sure we don't attempt to chroot again */
@@ -1654,8 +1673,9 @@ do_setusercontext(struct passwd *pw)
if (!in_chroot && set_id(pw->pw_name) != 0)
fatal("set_id(%s) Failed", pw->pw_name);
# endif /* USE_LIBIAF */
- /* Permanently switch to the desired uid. */
- permanently_set_uid(pw);
+ /* Permanently switch to the desired uid if not yet done. */
+ if (dropped_suid != 0)
+ permanently_set_uid(pw);
#endif
#ifdef WITH_SELINUX