diff --git a/openssh-6.7p1-sftp-force-permission.patch b/openssh-6.7p1-sftp-force-permission.patch new file mode 100644 index 0000000..05fff13 --- /dev/null +++ b/openssh-6.7p1-sftp-force-permission.patch @@ -0,0 +1,79 @@ +--- openssh-5.3p1/sftp-server.8 2015-02-10 10:08:09.611849984 +0100 ++++ openssh-5.3p1/sftp-server.8.perms 2015-02-10 10:08:52.204120509 +0100 +@@ -33,6 +33,7 @@ + .Op Fl P Ar blacklisted_requests + .Op Fl p Ar whitelisted_requests + .Op Fl u Ar umask ++.Op Fl m Ar force_file_perms + .Ek + .Nm + .Fl Q Ar protocol_feature +@@ -77,6 +78,10 @@ Sets an explicit + .Xr umask 2 + to be applied to newly-created files and directories, instead of the + user's default mask. ++.It Fl m Ar force_file_perms ++Sets explicit file permissions to be applied to newly-created files instead ++of the default or client requested mode. Numeric values include: ++777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set. + .El + .Pp + On some systems, +--- openssh-5.3p1/sftp-server.c 2015-02-10 10:08:09.611849984 +0100 ++++ openssh-5.3p1/sftp-server.c.perms 2015-02-10 10:39:00.855453028 +0100 +@@ -70,6 +70,10 @@ Buffer oqueue; + /* Version of client */ + static u_int version; + ++/* Force file permissions */ ++int permforce = 0; ++long permforcemode; ++ + /* SSH2_FXP_INIT received */ + static int init_done; + +@@ -551,6 +555,10 @@ process_open(void) + a = get_attrib(); + flags = flags_from_portable(pflags); + mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666; ++ if (permforce == 1) { /* Force perm if -m is set */ ++ mode = permforcemode; ++ (void)umask(0); /* so umask does not interfere */ ++ } + logit("open \"%s\" flags %s mode 0%o", + name, string_from_portable(pflags), mode); + if (readonly && +@@ -1322,7 +1330,7 @@ sftp_server_usage(void) + fprintf(stderr, + "usage: %s [-ehR] [-d start_directory] [-f log_facility] " + "[-l log_level]\n\t[-P blacklisted_requests] " +- "[-p whitelisted_requests] [-u umask]\n" ++ "[-p whitelisted_requests] [-u umask] [-m force_file_perms]\n" + " %s -Q protocol_feature\n", + __progname, __progname); + exit(1); +@@ -1343,7 +1351,7 @@ sftp_server_main(int argc, char **argv, + pw = pwcopy(user_pw); + + while (!skipargs && (ch = getopt(argc, argv, +- "d:f:l:P:p:Q:u:cehR")) != -1) { ++ "d:f:l:P:p:Q:u:m:cehR")) != -1) { + switch (ch) { + case 'Q': + if (strcasecmp(optarg, "requests") != 0) { +@@ -1373,6 +1381,15 @@ sftp_server_main(int argc, char **argv, + fatal("Invalid umask \"%s\"", optarg); + (void)umask((mode_t)mask); + break; ++ case 'm': ++ /* Force permissions on file received via sftp */ ++ permforce = 1; ++ permforcemode = strtol(optarg, &cp, 8); ++ if (permforcemode < 0 || permforcemode > 0777 || ++ *cp != '\0' || (permforcemode == 0 && ++ errno != 0)) ++ fatal("Invalid file mode \"%s\"", optarg); ++ break; + case 'h': + default: + sftp_server_usage(); diff --git a/openssh.spec b/openssh.spec index 865b528..bd7de85 100644 --- a/openssh.spec +++ b/openssh.spec @@ -220,6 +220,9 @@ Patch923: openssh-6.7p1-fix-ssh-copy-id-on-non-sh-shell.patch Patch924: openssh-6.7p1-seccomp-aarch64.patch # Solve issue with ssh-copy-id and keys without trailing newline (#1093168) Patch925: openssh-6.7p1-ssh-copy-id-truncated-keys.patch +# Add sftp option to force mode of created files (#1191055) +Patch926: openssh-6.7p1-sftp-force-permission.patch + License: BSD @@ -441,6 +444,7 @@ popd %patch923 -p1 -b .ssh-copy-id %patch924 -p1 -b .seccomp %patch925 -p1 -b .newline +%patch926 -p1 -b .sftp-force-mode %patch200 -p1 -b .audit %patch700 -p1 -b .fips