Attachment 2128 Details for Bug 1979 – Patch versus 5.9p1

[patch] Patch versus 5.9p1

restrict-sftp-commands-59p1.patch (text/plain), 9.64 KB, created by Jeremy Monin on 2012-02-13 06:39:04 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Monin

Created: 2012-02-13 06:39:04 AEDT

Size: 9.64 KB

patch

obsolete

>diff -ur orig/openssh-5.9p1/servconf.c jm/openssh-5.9p1/servconf.c
>--- orig/openssh-5.9p1/servconf.c	2011-06-22 18:30:03.000000000 -0400
>+++ jm/openssh-5.9p1/servconf.c	2012-02-12 13:42:22.000000000 -0500
>@@ -138,6 +138,7 @@
> 	options->authorized_principals_file = NULL;
> 	options->ip_qos_interactive = -1;
> 	options->ip_qos_bulk = -1;
>+	options->restrict_sftp_sys_to_basics = -1;
> }
> 
> void
>@@ -277,6 +278,8 @@
> 		options->ip_qos_interactive = IPTOS_LOWDELAY;
> 	if (options->ip_qos_bulk == -1)
> 		options->ip_qos_bulk = IPTOS_THROUGHPUT;
>+	if (options->restrict_sftp_sys_to_basics == -1)
>+		options->restrict_sftp_sys_to_basics = 0;
> 
> 	/* Turn privilege separation on by default */
> 	if (use_privsep == -1)
>@@ -324,6 +327,7 @@
> 	sZeroKnowledgePasswordAuthentication, sHostCertificate,
> 	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
> 	sKexAlgorithms, sIPQoS,
>+	sRestrictSftpSysToBasics,
> 	sDeprecated, sUnsupported
> } ServerOpCodes;
> 
>@@ -448,6 +452,7 @@
> 	{ "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
> 	{ "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
> 	{ "ipqos", sIPQoS, SSHCFG_ALL },
>+	{ "restrictsftpsystobasics", sRestrictSftpSysToBasics, SSHCFG_ALL },
> 	{ NULL, sBadOption, 0 }
> };
> 
>@@ -1395,6 +1400,10 @@
> 		}
> 		break;
> 
>+	case sRestrictSftpSysToBasics:
>+		intptr = &options->restrict_sftp_sys_to_basics;
>+		goto parse_flag;
>+
> 	case sDeprecated:
> 		logit("%s line %d: Deprecated option %s",
> 		    filename, linenum, arg);
>@@ -1513,6 +1522,7 @@
> 	M_CP_INTOPT(max_authtries);
> 	M_CP_INTOPT(ip_qos_interactive);
> 	M_CP_INTOPT(ip_qos_bulk);
>+	M_CP_INTOPT(restrict_sftp_sys_to_basics);
> 
> 	/* See comment in servconf.h */
> 	COPY_MATCH_STRING_OPTS();
>@@ -1745,6 +1755,7 @@
> 	dump_cfg_fmtint(sUseDNS, o->use_dns);
> 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
> 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
>+	dump_cfg_fmtint(sRestrictSftpSysToBasics, o->restrict_sftp_sys_to_basics);
> 
> 	/* string arguments */
> 	dump_cfg_string(sPidFile, o->pid_file);
>diff -ur orig/openssh-5.9p1/servconf.h jm/openssh-5.9p1/servconf.h
>--- orig/openssh-5.9p1/servconf.h	2011-06-22 18:30:03.000000000 -0400
>+++ jm/openssh-5.9p1/servconf.h	2012-02-12 11:33:14.000000000 -0500
>@@ -166,6 +166,13 @@
> 	char   *revoked_keys_file;
> 	char   *trusted_user_ca_keys;
> 	char   *authorized_principals_file;
>+	int	restrict_sftp_sys_to_basics; /*
>+					* Internal sftp subsystem:
>+					* Allow basic commands only
>+					* (prohibit mkdir, rmdir, rename,
>+					*  symlink, hardlink, setstat, statvfs,
>+					*  and their variants)
>+					*/
> }       ServerOptions;
> 
> /*
>diff -ur orig/openssh-5.9p1/session.c jm/openssh-5.9p1/session.c
>--- orig/openssh-5.9p1/session.c	2011-05-19 21:23:10.000000000 -0400
>+++ jm/openssh-5.9p1/session.c	2012-02-12 11:22:12.000000000 -0500
>@@ -1775,7 +1775,7 @@
> #ifdef WITH_SELINUX
> 		ssh_selinux_change_context("sftpd_t");
> #endif
>-		exit(sftp_server_main(i, argv, s->pw));
>+		exit(sftp_server_main(i, argv, s->pw, options.restrict_sftp_sys_to_basics));
> 	}
> 
> 	fflush(NULL);
>diff -ur orig/openssh-5.9p1/sftp-server-main.c jm/openssh-5.9p1/sftp-server-main.c
>--- orig/openssh-5.9p1/sftp-server-main.c	2009-02-21 16:47:02.000000000 -0500
>+++ jm/openssh-5.9p1/sftp-server-main.c	2012-02-12 11:16:42.000000000 -0500
>@@ -47,5 +47,5 @@
> 		return 1;
> 	}
> 
>-	return (sftp_server_main(argc, argv, user_pw));
>+	return (sftp_server_main(argc, argv, user_pw, 0));
> }
>diff -ur orig/openssh-5.9p1/sftp-server.c jm/openssh-5.9p1/sftp-server.c
>--- orig/openssh-5.9p1/sftp-server.c	2011-06-20 00:42:52.000000000 -0400
>+++ jm/openssh-5.9p1/sftp-server.c	2012-02-12 12:25:50.000000000 -0500
>@@ -63,6 +63,9 @@
> struct passwd *pw = NULL;
> char *client_addr = NULL;
> 
>+/* Only basic operations allowed for client; RestrictSFtpSysToBasics in config */
>+int restrict_to_basics;
>+
> /* input and output queue */
> Buffer iqueue;
> Buffer oqueue;
>@@ -771,7 +774,7 @@
> 	name = get_string(NULL);
> 	a = get_attrib();
> 	debug("request %u: setstat name \"%s\"", id, name);
>-	if (readonly) {
>+	if (readonly || restrict_to_basics) {
> 		status = SSH2_FX_PERMISSION_DENIED;
> 		a->flags = 0;
> 	}
>@@ -825,7 +828,7 @@
> 	fd = handle_to_fd(handle);
> 	if (fd < 0)
> 		status = SSH2_FX_FAILURE;
>-	else if (readonly)
>+	else if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		char *name = handle_to_name(handle);
>@@ -1000,7 +1003,7 @@
> 	    a->perm & 07777 : 0777;
> 	debug3("request %u: mkdir", id);
> 	logit("mkdir name \"%s\" mode 0%o", name, mode);
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		ret = mkdir(name, mode);
>@@ -1021,7 +1024,7 @@
> 	name = get_string(NULL);
> 	debug3("request %u: rmdir", id);
> 	logit("rmdir name \"%s\"", name);
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		ret = rmdir(name);
>@@ -1071,7 +1074,7 @@
> 	debug3("request %u: rename", id);
> 	logit("rename old \"%s\" new \"%s\"", oldpath, newpath);
> 	status = SSH2_FX_FAILURE;
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else if (lstat(oldpath, &sb) == -1)
> 		status = errno_to_portable(errno);
>@@ -1157,7 +1160,7 @@
> 	debug3("request %u: symlink", id);
> 	logit("symlink old \"%s\" new \"%s\"", oldpath, newpath);
> 	/* this will fail if 'newpath' exists */
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		ret = symlink(oldpath, newpath);
>@@ -1178,7 +1181,7 @@
> 	newpath = get_string(NULL);
> 	debug3("request %u: posix-rename", id);
> 	logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath);
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		ret = rename(oldpath, newpath);
>@@ -1199,7 +1202,9 @@
> 	debug3("request %u: statfs", id);
> 	logit("statfs \"%s\"", path);
> 
>-	if (statvfs(path, &st) != 0)
>+	if (restrict_to_basics)
>+		send_status(id, SSH2_FX_PERMISSION_DENIED);
>+	else if (statvfs(path, &st) != 0)
> 		send_status(id, errno_to_portable(errno));
> 	else
> 		send_statvfs(id, &st);
>@@ -1219,7 +1224,9 @@
> 		send_status(id, SSH2_FX_FAILURE);
> 		return;
> 	}
>-	if (fstatvfs(fd, &st) != 0)
>+	if (restrict_to_basics)
>+		send_status(id, SSH2_FX_PERMISSION_DENIED);
>+	else if (fstatvfs(fd, &st) != 0)
> 		send_status(id, errno_to_portable(errno));
> 	else
> 		send_statvfs(id, &st);
>@@ -1235,7 +1242,7 @@
> 	newpath = get_string(NULL);
> 	debug3("request %u: hardlink", id);
> 	logit("hardlink old \"%s\" new \"%s\"", oldpath, newpath);
>-	if (readonly)
>+	if (readonly || restrict_to_basics)
> 		status = SSH2_FX_PERMISSION_DENIED;
> 	else {
> 		ret = link(oldpath, newpath);
>@@ -1396,7 +1403,7 @@
> }
> 
> int
>-sftp_server_main(int argc, char **argv, struct passwd *user_pw)
>+sftp_server_main(int argc, char **argv, struct passwd *user_pw, int restrict_client_to_basics)
> {
> 	fd_set *rset, *wset;
> 	int in, out, max, ch, skipargs = 0, log_stderr = 0;
>@@ -1464,6 +1471,7 @@
> 		client_addr = xstrdup("UNKNOWN");
> 
> 	pw = pwcopy(user_pw);
>+	restrict_to_basics = restrict_client_to_basics;
> 
> 	logit("session opened for local user %s from [%s]",
> 	    pw->pw_name, client_addr);
>diff -ur orig/openssh-5.9p1/sftp.h jm/openssh-5.9p1/sftp.h
>--- orig/openssh-5.9p1/sftp.h	2008-06-12 20:22:54.000000000 -0400
>+++ jm/openssh-5.9p1/sftp.h	2012-02-12 11:16:01.000000000 -0500
>@@ -97,5 +97,5 @@
> 
> struct passwd;
> 
>-int	sftp_server_main(int, char **, struct passwd *);
>+int	sftp_server_main(int, char **, struct passwd *, int);
> void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
>diff -ur orig/openssh-5.9p1/sshd_config.0 jm/openssh-5.9p1/sshd_config.0
>--- orig/openssh-5.9p1/sshd_config.0	2011-09-06 19:16:30.000000000 -0400
>+++ jm/openssh-5.9p1/sshd_config.0	2012-02-12 12:38:38.000000000 -0500
>@@ -408,8 +408,8 @@
>              KerberosAuthentication, MaxAuthTries, MaxSessions,
>              PasswordAuthentication, PermitEmptyPasswords, PermitOpen,
>              PermitRootLogin, PermitTunnel, PubkeyAuthentication,
>-             RhostsRSAAuthentication, RSAAuthentication, X11DisplayOffset,
>-             X11Forwarding and X11UseLocalHost.
>+             RestrictSFtpSysToBasics, RhostsRSAAuthentication, RSAAuthentication, 
>+             X11DisplayOffset, X11Forwarding and X11UseLocalHost.
> 
>      MaxAuthTries
>              Specifies the maximum number of authentication attempts permitted
>@@ -517,6 +517,11 @@
>              default is ``yes''.  Note that this option applies to protocol
>              version 2 only.
> 
>+     RestrictSFtpSysToBasics
>+             Specifies that the internal SFTP subsystem should permit only
>+             basic commands like get, put, readdir, and readlink, and prohibit
>+             mkdir, rmdir, rename, symlink and setstat.  The default is ``no''.
>+
>      RevokedKeys
>              Specifies a list of revoked public keys.  Keys listed in this
>              file will be refused for public key authentication.  Note that if
>diff -ur orig/openssh-5.9p1/sshd_config.5 jm/openssh-5.9p1/sshd_config.5
>--- orig/openssh-5.9p1/sshd_config.5	2011-08-05 16:17:33.000000000 -0400
>+++ jm/openssh-5.9p1/sshd_config.5	2012-02-12 12:38:02.000000000 -0500
>@@ -724,6 +724,7 @@
> .Cm PermitRootLogin ,
> .Cm PermitTunnel ,
> .Cm PubkeyAuthentication ,
>+.Cm RestrictSFtpSysToBasics ,
> .Cm RhostsRSAAuthentication ,
> .Cm RSAAuthentication ,
> .Cm X11DisplayOffset ,
>@@ -915,6 +916,12 @@
> The default is
> .Dq yes .
> Note that this option applies to protocol version 2 only.
>+.It Cm RestrictSFtpSysToBasics
>+Specifies that the internal SFTP subsystem should permit only
>+basic commands like get, put, readdir, and readlink, and prohibit
>+mkdir, rmdir, rename, symlink and setstat.
>+The default is
>+.Dq no .
> .It Cm RevokedKeys
> Specifies a list of revoked public keys.
> Keys listed in this file will be refused for public key authentication.

Actions: View | Diff

Attachments on bug 1979: 2128 | 2129