openssh bugs - Jul 2007 - [Bug 1343] New: Privilege separation does not work on QNX

http://bugzilla.mindrot.org/show_bug.cgi?id=1343

           Summary: Privilege separation does not work on QNX
           Product: Portable OpenSSH
           Version: 4.6p1
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: sshd
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: kraai at ftbfs.org


Privilege separation does not work on QNX: recvmsg returns -1 and sets
errno to EPERM when it is called to receive a file descriptor.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343


Matt Kraai <kraai at ftbfs.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         OS/Version|Linux                       |Other




-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343





--- Comment #1 from Matt Kraai <kraai at ftbfs.org>  2007-07-22 05:12:15
---
Created an attachment (id=1328)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1328)
Define DISABLE_FD_PASSING on QNX systems

The attached patch fixes this problem by defining DISABLE_FD_PASSING on
QNX systems.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |dtucker at zip.com.au
             Blocks|                            |1289




--- Comment #2 from Darren Tucker <dtucker at zip.com.au>  2007-07-22
13:14:22 ---
Seems reasonable, however I don't have access to QNX to confirm.  I
also wonder if this applies to specific QNX versions or all of them. 
Which version did you observe the behaviour on?


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343





--- Comment #3 from Matt Kraai <kraai at ftbfs.org>  2007-07-22 14:34:30
---
(In reply to comment #2)
> Seems reasonable, however I don't have access to QNX to confirm.  I
> also wonder if this applies to specific QNX versions or all of them. 
> Which version did you observe the behaviour on?
6.3.0.  I think it's been this way since 6.0.0, the first NTO version,
but I don't have access to a system running that version to verify.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
Attachment #1328 is|0                           |1
           obsolete|                            |




--- Comment #4 from Darren Tucker <dtucker at zip.com.au>  2007-07-22
15:18:18 ---
Created an attachment (id=1330)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1330)
Disable fd passing only on qnx6.
> 6.3.0.  I think it's been this way since 6.0.0,
In that case I would prefer to see it set only for the versions known
to need it.  Other versions can be added if it proves necessary.

Could you please confirm that this patch does the right thing?  Thanks.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343





--- Comment #5 from Matt Kraai <kraai at ftbfs.org>  2007-07-22 15:31:27
---
(In reply to comment #4)
> Created an attachment (id=1330)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1330)
[details]
> Disable fd passing only on qnx6.
> 
> > 6.3.0.  I think it's been this way since 6.0.0,
> 
> In that case I would prefer to see it set only for the versions known
> to need it.  Other versions can be added if it proves necessary.
> 
> Could you please confirm that this patch does the right thing?  Thanks.
Sure, I'll test it Monday.

NTO only matches QNX 6, so the only difference this patch makes is to
skip this definition for future versions.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343





--- Comment #6 from Matt Kraai <kraai at ftbfs.org>  2007-07-24 16:00:25
---
(In reply to comment #4)
> Created an attachment (id=1330)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1330)
[details]
> Disable fd passing only on qnx6.
...
> Could you please confirm that this patch does the right thing?  Thanks.
I had to hand-regenerate configure, but after I did so, the problem was
fixed.  Thanks.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1305




--- Comment #7 from Darren Tucker <dtucker at zip.com.au>  2007-07-24
16:18:58 ---
(In reply to comment #6)
> I had to hand-regenerate configure, but after I did so,
We don't automatically regenerate configure so you need to either run
"autoreconf" or "make -f Makefile.in distprep"
>  the problem was fixed.  Thanks.
Thanks for confirming, we will put this in for the next release.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

http://bugzilla.mindrot.org/show_bug.cgi?id=1343


Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED




--- Comment #8 from Darren Tucker <dtucker at zip.com.au>  2007-08-10
14:36:37 ---
Applied, thanks.  It will be in the 4.7 release.


-- 
Configure bugmail: http://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1343


Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added                       
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED                      




--- Comment #9 from Damien Miller <djm at mindrot.org>  2008-04-04
10:00:12 ---
Close resolved bugs after release.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.