search for: temporarily_use_uid_effective

...d ids also work with seteuid, even though that is not part of the posix specification. */ - +#define SAVED_IDS_WORK_WITH_SETEUID +/* Saved effective uid. */ +static uid_t saved_euid = 0; +static gid_t saved_egid = 0; +#endif + /* Saved effective uid. */ static int privileged = 0; static int temporarily_use_uid_effective = 0; -static uid_t saved_euid = 0; -static gid_t saved_egid; static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; static int saved_egroupslen = -1, user_groupslen = -1; - + /* * Temporarily changes to the given uid. If the effective user * id is not root, this does nothing. T...

All, Could someone explain the purpose of the uidswap functions with respect to ssh ( the client ). From what I gathered , ssh installs as setuid root and swaps ids when reading potential key files that may be read only by root. Also , I think when binding to a privileged port ssh swaps id. Is that so? What are the consequnences if you do not install ssh setuid root? ( As far I as know no uid

...====================================== RCS file: /cvs/openssh/uidswap.c,v retrieving revision 1.42 diff -u -u -r1.42 uidswap.c --- uidswap.c 17 Dec 2003 07:53:26 -0000 1.42 +++ uidswap.c 19 Feb 2004 23:50:38 -0000 @@ -38,7 +38,7 @@ /* Saved effective uid. */ static int privileged = 0; static int temporarily_use_uid_effective = 0; -static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; +static gid_t *saved_egroups, *user_groups; static int saved_egroupslen = -1, user_groupslen = -1; /* @@ -68,17 +68,27 @@ privileged = 1; temporarily_use_uid_effective = 1; - saved_egroupslen = getgroups(NGROUPS_MAX,...

...ivileges that a suid-non-root binary might have. This might be a bit cleaner and needs a little more changing (I haven't done this yet, but can do on demand). Regards, Daniel M?ller --- uidswap.c~ Thu Aug 16 01:17:22 2001 +++ uidswap.c Thu Mar 7 16:12:25 2002 @@ -147,6 +147,7 @@ { if (temporarily_use_uid_effective) fatal("restore_uid: temporarily_use_uid effective"); + if (geteuid() != 0) return; if (setgid(pw->pw_gid) < 0) fatal("setgid %u: %.100s", (u_int) pw->pw_gid, strerror(errno)); if (setuid(pw->pw_uid) < 0) ------- You are receiving this mail because: --...

...al Priority: P2 Component: Build system AssignedTo: openssh-unix-dev at mindrot.org ReportedBy: gert at greenie.muc.de patch needed: --- uidswap.c 23 Jul 2002 21:29:50 -0000 1.34 +++ uidswap.c 30 Jul 2002 19:21:20 -0000 @@ -114,8 +114,8 @@ if (!temporarily_use_uid_effective) fatal("restore_uid: temporarily_use_uid not effective"); - debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid); #ifdef SAVED_IDS_WORK_WITH_SETEUID + debug("restore_uid: %u/%u", (u_int)saved_euid, (u_int)saved_egid);...

If we can get people to test their platforms against the last snapshot/cvs tree I'd be greatful. (http://www.openssh.com/portable.html) I know NeXT platform has problems. I'm going to spend tonight looking at it. Also, take a moment to see what manpage type ./configure decided for your system and if it's 'cat' please let us know. Thanks. - Ben