summaryrefslogtreecommitdiffstats
path: root/debian/patches/ssh-agent-setgid.patch
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 14:40:05 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 14:40:05 +0000
commite21fe8c3a4007c4a10f67e9e8107c3f083002f06 (patch)
tree926b3c2a4d3fd0decde08f6a4d22862ef03a7046 /debian/patches/ssh-agent-setgid.patch
parentAdding upstream version 1:9.2p1. (diff)
downloadopenssh-e21fe8c3a4007c4a10f67e9e8107c3f083002f06.tar.xz
openssh-e21fe8c3a4007c4a10f67e9e8107c3f083002f06.zip
Adding debian version 1:9.2p1-2+deb12u2.debian/1%9.2p1-2+deb12u2
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'debian/patches/ssh-agent-setgid.patch')
-rw-r--r--debian/patches/ssh-agent-setgid.patch40
1 files changed, 40 insertions, 0 deletions
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
new file mode 100644
index 0000000..14478d3
--- /dev/null
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -0,0 +1,40 @@
+From bf54d67a00bf4d408f0e52236c4248cecfb5177f Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Sun, 9 Feb 2014 16:10:13 +0000
+Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
+
+Bug-Debian: http://bugs.debian.org/711623
+Forwarded: no
+Last-Update: 2020-02-21
+
+Patch-Name: ssh-agent-setgid.patch
+---
+ ssh-agent.1 | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/ssh-agent.1 b/ssh-agent.1
+index b0bf65da8..ba418bb41 100644
+--- a/ssh-agent.1
++++ b/ssh-agent.1
+@@ -230,6 +230,21 @@ socket and stores its pathname in this variable.
+ It is accessible only to the current user,
+ but is easily abused by root or another instance of the same user.
+ .El
++.Pp
++In Debian,
++.Nm
++is installed with the set-group-id bit set, to prevent
++.Xr ptrace 2
++attacks retrieving private key material.
++This has the side-effect of causing the run-time linker to remove certain
++environment variables which might have security implications for set-id
++programs, including
++.Ev LD_PRELOAD ,
++.Ev LD_LIBRARY_PATH ,
++and
++.Ev TMPDIR .
++If you need to set any of these environment variables, you will need to do
++so in the program executed by ssh-agent.
+ .Sh FILES
+ .Bl -tag -width Ds
+ .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>