Attachment 2809 Details for Bug 2440 – new patch file for per session xauth enhancement

[patch] new patch file for per session xauth enhancement

sshd_per_session_xauthfile.patch (text/plain), 4.86 KB, created by huieying.lee on 2016-04-26 09:59:54 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: huieying.lee

Created: 2016-04-26 09:59:54 AEST

Size: 4.86 KB

patch

obsolete

>#
># This patch is to change the location of the XAUTHORITY file from 
># $HOME/.Xauthority to per session Xauthority file in the /tmp directory,
># so that X11Forwarding will still work, when the user's home directory is
># read-only.
>#
>--- orig/session.c	Fri Apr 22 11:44:45 2016
>+++ new/session.c	Mon Apr 25 15:37:31 2016
>@@ -63,6 +63,10 @@
> #include <unistd.h>
> #include <limits.h>
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+#include <libgen.h>
>+#endif
>+
> #include "openbsd-compat/sys-queue.h"
> #include "xmalloc.h"
> #include "ssh.h"
>@@ -133,6 +137,11 @@
> 
> static int session_pty_req(Session *);
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+void   session_xauthfile_cleanup(Session *);
>+void   cleanup_all_session_xauthfile();
>+#endif
>+
> /* import */
> extern ServerOptions options;
> extern char *__progname;
>@@ -1242,6 +1251,11 @@
> 	if (getenv("TZ"))
> 		child_set_env(&env, &envsize, "TZ", getenv("TZ"));
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+        if (s->auth_file != NULL)
>+                child_set_env(&env, &envsize, "XAUTHORITY", s->auth_file);
>+#endif
>+
> 	/* Set custom environment options from RSA authentication. */
> 	if (!options.use_login) {
> 		while (custom_environment) {
>@@ -2189,6 +2203,11 @@
> {
> 	int success;
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+	int fd;
>+        char xauthdir[] = "/tmp/ssh-xauth-XXXXXX";
>+#endif
>+
> 	if (s->auth_proto != NULL || s->auth_data != NULL) {
> 		error("session_x11_req: session %d: "
> 		    "x11 forwarding already active", s->self);
>@@ -2213,6 +2232,50 @@
> 		s->auth_proto = NULL;
> 		s->auth_data = NULL;
> 	}
>+
>+#ifdef PER_SESSION_XAUTHFILE
>+	/*
>+	 * Create per session X authority file in the /tmp directory.
>+	 *
>+	 * If mkdtemp() or open() fails then s->auth_file remains NULL which
>+	 * means that we won't set XAUTHORITY variable in child's environment
>+	 * and xauth(1) will use the default location for the authority file.
>+	 */
>+	temporarily_use_uid(s->pw);
>+	if (mkdtemp(xauthdir) != NULL) {
>+		s->auth_file = xmalloc(MAXPATHLEN);
>+		snprintf(s->auth_file, MAXPATHLEN, "%s/xauthfile",
>+		    xauthdir);
>+		/*
>+		 * we don't want that "creating new authority file" message to
>+                 * be printed by xauth(1) so we must create that file
>+		 * beforehand.
>+		 */
>+		if ((fd = open(s->auth_file, O_CREAT | O_EXCL | O_RDONLY,
>+		    S_IRUSR | S_IWUSR)) == -1) {
>+			error("failed to create the temporary X authority "
>+			    "file %s: %.100s; will use the default one",
>+			    s->auth_file, strerror(errno));
>+			free(s->auth_file);
>+			s->auth_file = NULL;
>+			if (rmdir(xauthdir) == -1) {
>+				error("cannot remove xauth directory "
>+				    "%s: %.100s", xauthdir, strerror(errno));
>+			}
>+		} else {
>+			close(fd);
>+			debug("temporary X authority file %s created",
>+			    s->auth_file);
>+                        debug("session number = %d", s->self);
>+		}
>+	}
>+	else {
>+		error("failed to create a directory for the temporary X "
>+		    "authority file: %.100s; will use the default xauth file",
>+		    strerror(errno));
>+	}
>+	restore_uid();
>+#endif
> 	return success;
> }
> 
>@@ -2403,6 +2466,50 @@
> 	PRIVSEP(session_pty_cleanup2(s));
> }
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+/*
>+ * We use a different temporary X authority file per session so we should
>+ * remove those files when cleanup_exit() is called.
>+ */
>+void
>+session_xauthfile_cleanup(Session *s)
>+{
>+	if (s == NULL || s->auth_file == NULL) {
>+		return;
>+	}
>+
>+	debug("session_xauthfile_cleanup: session %d removing %s", s->self,
>+	    s->auth_file);
>+
>+	if (unlink(s->auth_file) == -1) {
>+		error("session_xauthfile_cleanup: cannot remove xauth file: "
>+		    "%.100s", strerror(errno));
>+		return;
>+	}
>+
>+	/* dirname() will modify s->auth_file but that's ok */
>+	if (rmdir(dirname(s->auth_file)) == -1) {
>+		error("session_xauthfile_cleanup: "
>+		    "cannot remove xauth directory: %.100s", strerror(errno));
>+		return;
>+	}
>+	free(s->auth_file);
>+	s->auth_file = NULL;
>+}
>+
>+/*
>+ * This is called by do_cleanup() when cleanup_exit() is called. 
>+ */
>+void
>+cleanup_all_session_xauthfile()
>+{
>+	int i;
>+	for (i = 0; i < sessions_nalloc; i++) {
>+                session_xauthfile_cleanup(&sessions[i]);
>+	}
>+}
>+#endif /* PER_SESSION_XAUTHFILE */
>+
> static char *
> sig2name(int sig)
> {
>@@ -2542,6 +2649,9 @@
> 	free(s->auth_display);
> 	free(s->auth_data);
> 	free(s->auth_proto);
>+#ifdef PER_SESSION_XAUTHFILE
>+	session_xauthfile_cleanup(s);
>+#endif
> 	free(s->subsys);
> 	if (s->env != NULL) {
> 		for (i = 0; i < s->num_env; i++) {
>@@ -2793,6 +2903,10 @@
> 	/* remove agent socket */
> 	auth_sock_cleanup_proc(authctxt->pw);
> 
>+#ifdef PER_SESSION_XAUTHFILE
>+	cleanup_all_session_xauthfile();
>+#endif
>+
> 	/*
> 	 * Cleanup ptys/utmp only if privsep is disabled,
> 	 * or if running in monitor.
>--- orig/session.h	Fri Apr 22 11:44:45 2016
>+++ new/session.h	Fri Apr 22 11:45:32 2016
>@@ -49,6 +49,9 @@
> 	char	*auth_display;
> 	char	*auth_proto;
> 	char	*auth_data;
>+#ifdef PER_SESSION_XAUTHFILE
>+	char    *auth_file;	/* xauth(1) authority file */
>+#endif
> 	int	single_connection;
> 
> 	/* proto 2 */

Actions: View | Diff

Attachments on bug 2440: 2680 | 2809 | 3047 | 3048