search for: child_root_sensitive_setup

...BEFORE it processes network data from the client. Thus, I think that all the sia stuff and pty allocation should be handled by the forked sshd process while it's still root, and then change to the user before going further. Perhaps you might want to lump all the stuff like this into a routine child_root_sensitive_setup() to make it clear. The PRIVSEP macro is: #define PRIVSEP(x) (use_privsep ? mm_##x : x) As far as I can tell, this merely calls different routines, depending on use_privsep. I don't see how the user's sshd process can revert to being root. If that were so, then the whole idea of priv...