70 lines
1.8 KiB
Diff
70 lines
1.8 KiB
Diff
|
Avoid calling setgroups(2).
|
||
|
|
|
||
|
|
Hardcode and do not require absolute path.
|
||
|
|
|
||
|
|
diff -u -r ../openssh-6.6p1/sshd.c ./sshd.c
|
||
|
|
--- ../openssh-6.6p1/sshd.c 2014-02-27 00:20:08.000000000 +0100
|
||
|
|
+++ ./sshd.c 2014-06-04 13:25:00.476658070 +0200
|
||
|
|
@@ -647,8 +647,10 @@
|
||
|
|
do_setusercontext(privsep_pw);
|
||
|
|
#else
|
||
|
|
gidset[0] = privsep_pw->pw_gid;
|
||
|
|
+#ifndef __ANDROID__
|
||
|
|
if (setgroups(1, gidset) < 0)
|
||
|
|
fatal("setgroups: %.100s", strerror(errno));
|
||
|
|
+#endif
|
||
|
|
permanently_set_uid(privsep_pw);
|
||
|
|
#endif
|
||
|
|
}
|
||
|
|
@@ -1403,7 +1405,8 @@
|
||
|
|
saved_argc = ac;
|
||
|
|
rexec_argc = ac;
|
||
|
|
saved_argv = xcalloc(ac + 1, sizeof(*saved_argv));
|
||
|
|
- for (i = 0; i < ac; i++)
|
||
|
|
+ saved_argv[0] = "@TERMUX_PREFIX@/bin/sshd";
|
||
|
|
+ for (i = 1; i < ac; i++)
|
||
|
|
saved_argv[i] = xstrdup(av[i]);
|
||
|
|
saved_argv[i] = NULL;
|
||
|
|
|
||
|
|
@@ -1413,8 +1416,10 @@
|
||
|
|
av = saved_argv;
|
||
|
|
#endif
|
||
|
|
|
||
|
|
+#ifndef __ANDROID__
|
||
|
|
if (geteuid() == 0 && setgroups(0, NULL) == -1)
|
||
|
|
debug("setgroups(): %.200s", strerror(errno));
|
||
|
|
+#endif
|
||
|
|
|
||
|
|
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
|
||
|
|
sanitise_stdfd();
|
||
|
|
@@ -1543,8 +1548,6 @@
|
||
|
|
}
|
||
|
|
if (rexeced_flag || inetd_flag)
|
||
|
|
rexec_flag = 0;
|
||
|
|
- if (!test_flag && (rexec_flag && (av[0] == NULL || *av[0] != '/')))
|
||
|
|
- fatal("sshd re-exec requires execution with an absolute path");
|
||
|
|
if (rexeced_flag)
|
||
|
|
closefrom(REEXEC_MIN_FREE_FD);
|
||
|
|
else
|
||
|
|
@@ -1669,7 +1672,9 @@
|
||
|
|
free(privsep_pw->pw_passwd);
|
||
|
|
privsep_pw->pw_passwd = xstrdup("*");
|
||
|
|
}
|
||
|
|
+#ifndef __ANDROID__
|
||
|
|
endpwent();
|
||
|
|
+#endif
|
||
|
|
|
||
|
|
/* load host keys */
|
||
|
|
sensitive_data.host_keys = xcalloc(options.num_host_key_files,
|
||
|
|
@@ -1838,8 +1843,10 @@
|
||
|
|
* to create a file, and we can't control the code in every
|
||
|
|
* module which might be used).
|
||
|
|
*/
|
||
|
|
+#ifndef __ANDROID__
|
||
|
|
if (setgroups(0, NULL) < 0)
|
||
|
|
debug("setgroups() failed: %.200s", strerror(errno));
|
||
|
|
+#endif
|
||
|
|
|
||
|
|
if (rexec_flag) {
|
||
|
|
rexec_argv = xcalloc(rexec_argc + 2, sizeof(char *));
|