openssh bugs - Dec 2018 - [Bug 2940] New: Installing in $HOME should not require root privileges

https://bugzilla.mindrot.org/show_bug.cgi?id=2940

            Bug ID: 2940
           Summary: Installing in $HOME should not require root privileges
           Product: Portable OpenSSH
           Version: 7.9p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: minor
          Priority: P5
         Component: Build system
          Assignee: unassigned-bugs at mindrot.org
          Reporter: openssh at blazemonger.com

I tried installing OpenSSH 7.9p1 in my home directory, which be
possible without root privileges. "make install" failed with a
permissions error. This is on Ubuntu 16.04.5 LTS:

$ ./configure --prefix=$HOME/tmp/openssh
$ make
$ make install
...
/bin/mkdir -p /home/smith/tmp/openssh/bin
/bin/mkdir -p /home/smith/tmp/openssh/sbin
/bin/mkdir -p /home/smith/tmp/openssh/share/man/man1
/bin/mkdir -p /home/smith/tmp/openssh/share/man/man5
/bin/mkdir -p /home/smith/tmp/openssh/share/man/man8
/bin/mkdir -p /home/smith/tmp/openssh/libexec
/bin/mkdir -p -m 0755 /var/empty
/bin/mkdir: cannot create directory ?/var/empty?: Permission denied
Makefile:330: recipe for target 'install-files' failed
make: *** [install-files] Error 1

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2940

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #1 from Darren Tucker <dtucker at dtucker.net> ---
sshd requires a directory to chroot to  which by default is
"/var/empty".   If your system has one and uses a different path you
can tell configure to use -with-privsep-path=/somewhere else.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2940

Ryan Williams <ryan.blake.williams at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ryan.blake.williams at gmail.c
                   |                            |om

--- Comment #2 from Ryan Williams <ryan.blake.williams at gmail.com> ---
Minor note: the flag is "--with-privsep-path" (two leading dashes)

It seems like "--prefix" should also be prepended to this
"/var/empty"
path, by default.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2940

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WORKSFORME
             Status|NEW                         |RESOLVED

--- Comment #3 from Darren Tucker <dtucker at dtucker.net> ---
(In reply to Ryan Williams from comment #2)
> It seems like "--prefix" should also be prepended to this
> "/var/empty" path, by default.
No, the usual path for that (/var/empty) is outside the usual prefix
(/usr or /usr/local).  "make install" does already prepend DESTDIR
(which defaults to an empty string) to all install paths including that
one:

$(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)

Assuming you don't want to run an unprivileged sshd you can do what you
want with

$ ./configure --prefix=/ && make install-nokeys
DESTDIR=/home/smith/tmp/openssh

If you want the host keys you would probably need to set them up by
hand or fiddle with --sysconfdir.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=2940

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
Close bugs fixed in openssh-8.1 release cycle

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.