diff options
| author | Colin Watson <cjwatson@debian.org> | 2014-02-09 16:09:58 +0000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2019-06-21 16:14:03 +0100 |
| commit | 0fc2ac6707abe076cd6b444f73c478eeda54b25f (patch) | |
| tree | e433ad99222914ffb1e6f666b1bfa3739784e243 /auth-rhosts.c | |
| parent | e9dd9cd95fe8fe2da9b114a1546a90634b3ce4be (diff) | |
Allow harmless group-writability
Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
group-writable, provided that the group in question contains only the file's
owner. Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding
about the contents of gr->gr_mem). Given that per-user groups and umask 002
are the default setup in Debian (for good reasons - this makes operating in
setgid directories with other groups much easier), we need to permit this by
default.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
Last-Update: 2019-06-05
Patch-Name: user-group-modes.patch
Diffstat (limited to 'auth-rhosts.c')
| -rw-r--r-- | auth-rhosts.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/auth-rhosts.c b/auth-rhosts.c index 57296e1f6..546aa0495 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c @@ -261,8 +261,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, return 0; } if (options.strict_modes && - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || - (st.st_mode & 022) != 0)) { + !secure_permissions(&st, pw->pw_uid)) { logit("Rhosts authentication refused for %.100s: " "bad ownership or modes for home directory.", pw->pw_name); auth_debug_add("Rhosts authentication refused for %.100s: " @@ -288,8 +287,7 @@ auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, * allowing access to their account by anyone. */ if (options.strict_modes && - ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || - (st.st_mode & 022) != 0)) { + !secure_permissions(&st, pw->pw_uid)) { logit("Rhosts authentication refused for %.100s: bad modes for %.200s", pw->pw_name, buf); auth_debug_add("Bad file modes for %.200s", buf); |