openssh bugs - Jul 2019 - [Bug 3030] New: window change events not passed when using session multiplexing

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

            Bug ID: 3030
           Summary: window change events not passed when using session
                    multiplexing
           Product: Portable OpenSSH
           Version: 8.0p1
          Hardware: Other
                OS: Solaris
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: darren.moffat at oracle.com

Created attachment 3296
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3296&action=edit
Keep PRIV_PROC_SESSION for platform_pledge_mux

When the SSH client is multiplexing multiple shell sessions across a
single network connection to an SSH server the window change signal is
not being propagated.

When the ssh client code calls platform_pledge_mux() on Solaris it will
call solaris_drop_privs_root_pinfo_net_exec().  This function drops too
many privileges.

It is supposed to be equivalent to pledge("stdio proc tty", ...)

Note "proc" is kept because of the need to call kill(2).  The Solaris
implementation of this is currently dropping PRIV_PROC_SESSION which is
needed to be able to send signals to processes the user owns but are
outside of the current session.  Multiple client ssh processes using
the same mux are quite likely to be in different unix session groups,
for example multiple panes or windows in a terminal multiplexer such as
screen or tmux or mulitple xterm windows.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

--- Comment #1 from Darren Moffat <darren.moffat at oracle.com> ---
Pull Request: https://github.com/openssh/openssh-portable/pull/135

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |2988
                 CC|                            |dtucker at dtucker.net


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=2988
[Bug 2988] Tracking bug for 8.1 release
-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |djm at mindrot.org
   Attachment #3296|0                           |1
           is patch|                            |
   Attachment #3296|application/octet-stream    |text/plain
          mime type|                            |

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

--- Comment #2 from Damien Miller <djm at mindrot.org> ---
This is fine, but I have a couple of problems with the license change.

1) First, I don't think it is sensible to add rights-holders for a
change that solely deletes code (especially a single line).

2) Second, the proposed license change "Oracle and/or its affiliates"
does not unambiguously identify a rights-holder. If a user ever needed
to clarify their rights or obligations with all rights-holders, there
is no sure way they could determine whether they exhausted the
possibilities of the "affiliates" clause.

Now, #2 is moot because of #1 but it would certainly be a problem for
future contributions from Oracle that include this text. I understand
that it is probably your company lawyers that have stipulated this, so
please feel free to pass this on.

Unless you object, I'll commit the deletion part only.

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

--- Comment #3 from Darren Moffat <darren.moffat at oracle.com> ---
No issue at all with your copyright changes, thanks.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #4 from Damien Miller <djm at mindrot.org> ---
Patch applied - thanks!

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3030

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
closing resolved bugs as of 8.6p1 release

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.