kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
f8987c
diff -up openssh-6.6p1/configure.ac.chroot-cap openssh-6.6p1/configure.ac
f8987c
--- openssh-6.6p1/configure.ac.chroot-cap	2016-07-28 10:08:11.183483309 +0200
f8987c
+++ openssh-6.6p1/configure.ac	2016-07-28 10:08:11.273483277 +0200
f8987c
@@ -4783,6 +4783,37 @@ if test -n "$conf_lastlog_location"; the
f8987c
 		[Define if you want to specify the path to your lastlog file])
f8987c
 fi
f8987c
 
f8987c
+AC_ARG_WITH(libcap-ng,
f8987c
+	[  --with-libcap-ng=[auto/yes/no]  Add Libcap-ng support [default=auto]],,
f8987c
+	with_libcap_ng=auto)
f8987c
+
f8987c
+dnl libcap-ng detection
f8987c
+if test x$with_libcap_ng = xno ; then
f8987c
+	have_libcap_ng=no;
f8987c
+else
f8987c
+	# Start by checking for header file
f8987c
+	AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
f8987c
+
f8987c
+	# See if we have libcap-ng library
f8987c
+	AC_CHECK_LIB(cap-ng, capng_clear, CAPNG_LDADD=-lcap-ng,)
f8987c
+
f8987c
+	# Check results are usable
f8987c
+	if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
f8987c
+	AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
f8987c
+	fi
f8987c
+	if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
f8987c
+	AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
f8987c
+	fi
f8987c
+fi
f8987c
+AC_MSG_CHECKING(whether to use libcap-ng)
f8987c
+if test x$CAPNG_LDADD != x ; then
f8987c
+	AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
f8987c
+	SSHDLIBS="$SSHDLIBS -lcap-ng"
f8987c
+	AC_MSG_RESULT(yes)
f8987c
+else
f8987c
+	AC_MSG_RESULT(no)
f8987c
+fi
f8987c
+
f8987c
 dnl utmp detection
f8987c
 AC_MSG_CHECKING([if your system defines UTMP_FILE])
f8987c
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
f8987c
diff -up openssh-6.6p1/session.c.chroot-cap openssh-6.6p1/session.c
f8987c
--- openssh-6.6p1/session.c.chroot-cap	2016-07-28 10:08:11.269483278 +0200
f8987c
+++ openssh-6.6p1/session.c	2016-07-28 10:09:10.458455211 +0200
f8987c
@@ -95,6 +95,10 @@
f8987c
 #include "monitor_wrap.h"
f8987c
 #include "sftp.h"
f8987c
 
f8987c
+#ifdef HAVE_LIBCAP_NG
f8987c
+#include <cap-ng.h>
f8987c
+#endif
f8987c
+
f8987c
 #if defined(KRB5) && defined(USE_AFS)
f8987c
 #include <kafs.h>
f8987c
 #endif
f8987c
@@ -1569,6 +1573,7 @@ void
f8987c
 do_setusercontext(struct passwd *pw)
f8987c
 {
f8987c
 	char *chroot_path, *tmp;
f8987c
+	int dropped_suid = -1;
f8987c
 
f8987c
 	platform_setusercontext(pw);
f8987c
 
1bd961
@@ -1602,10 +1607,25 @@ do_setusercontext(struct passwd *pw)
f8987c
 			    pw->pw_uid);
f8987c
 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
f8987c
 			    "u", pw->pw_name, (char *)NULL);
f8987c
+#ifdef HAVE_LIBCAP_NG
f8987c
+			/* drop suid soon, retain SYS_CHROOT capability */
f8987c
+			capng_clear(CAPNG_SELECT_BOTH);
f8987c
+			capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_CHROOT);
1bd961
+			if (pw->pw_uid != 0 &&
1bd961
+			    (dropped_suid = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_INIT_SUPP_GRP)) != 0)
f8987c
+				logit("capng_change_id() = %d (failure): Try to drop UID later", dropped_suid);
f8987c
+#endif
f8987c
 #ifdef WITH_SELINUX
f8987c
 			sshd_selinux_copy_context();
f8987c
 #endif
f8987c
 			safely_chroot(chroot_path, pw->pw_uid);
f8987c
+#ifdef HAVE_LIBCAP_NG
f8987c
+			/* Drop chroot capability. Already used */
f8987c
+			if (dropped_suid == 0) {
f8987c
+				capng_clear(CAPNG_SELECT_BOTH);
f8987c
+				capng_apply(CAPNG_SELECT_BOTH);
f8987c
+			}
f8987c
+#endif
f8987c
 			free(tmp);
f8987c
 			free(chroot_path);
f8987c
 			/* Make sure we don't attempt to chroot again */
f8987c
@@ -1629,8 +1648,9 @@ do_setusercontext(struct passwd *pw)
f8987c
 		fatal("set_id(%s) Failed", pw->pw_name);
f8987c
 	}
f8987c
 # endif /* USE_LIBIAF */
f8987c
-		/* Permanently switch to the desired uid. */
f8987c
-		permanently_set_uid(pw);
f8987c
+		/* Permanently switch to the desired uid if not yet done. */
f8987c
+		if (dropped_suid != 0)
f8987c
+			permanently_set_uid(pw);
f8987c
 #endif
f8987c
 
f8987c
 #ifdef WITH_SELINUX