forked from rpms/openssh
32 lines
1022 B
Diff
32 lines
1022 B
Diff
|
diff -up openssh-8.2p1/authfile.c.keyperm openssh-8.2p1/authfile.c
|
||
|
|
--- openssh-8.2p1/authfile.c.keyperm 2020-02-14 01:40:54.000000000 +0100
|
||
|
|
+++ openssh-8.2p1/authfile.c 2020-02-17 11:55:12.841729758 +0100
|
||
|
|
@@ -31,6 +31,7 @@
|
||
|
|
|
||
|
|
#include <errno.h>
|
||
|
|
#include <fcntl.h>
|
||
|
|
+#include <grp.h>
|
||
|
|
#include <stdio.h>
|
||
|
|
#include <stdarg.h>
|
||
|
|
#include <stdlib.h>
|
||
|
|
@@ -101,7 +102,19 @@ sshkey_perm_ok(int fd, const char *filen
|
||
|
|
#ifdef HAVE_CYGWIN
|
||
|
|
if (check_ntsec(filename))
|
||
|
|
#endif
|
||
|
|
+
|
||
|
|
if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
|
||
|
|
+ if (st.st_mode & 040) {
|
||
|
|
+ struct group *gr;
|
||
|
|
+
|
||
|
|
+ if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid)) {
|
||
|
|
+ /* The only additional bit is read
|
||
|
|
+ * for ssh_keys group, which is fine */
|
||
|
|
+ if ((st.st_mode & 077) == 040 ) {
|
||
|
|
+ return 0;
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
+ }
|
||
|
|
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
|
||
|
|
error("@ WARNING: UNPROTECTED PRIVATE KEY FILE! @");
|
||
|
|
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
|