diff options
author | Colin Watson <cjwatson@debian.org> | 2015-11-24 20:45:21 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2015-11-24 20:49:53 +0000 |
commit | 1d6c1c2b9f5e85070c9c12442a140f592ebc0064 (patch) | |
tree | 298b8a4b9b7bd25c92dd9dcd9c6df65791a6a3da | |
parent | c1f965684b54bed51e8cb1e7a2f3d2003d64d341 (diff) | |
parent | 11ff24a98751edfc86ef0eed102f840eaa50d4e1 (diff) |
Drop ConsoleKit session registration patch; it was only ever enabled for Ubuntu, which no longer needs it (LP: #1334916, #1502045).
40 files changed, 39 insertions, 1005 deletions
diff --git a/Makefile.in b/Makefile.in index f52f90389..e161d0e6c 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -111,8 +111,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ | |||
111 | sftp-server.o sftp-common.o \ | 111 | sftp-server.o sftp-common.o \ |
112 | roaming_common.o roaming_serv.o \ | 112 | roaming_common.o roaming_serv.o \ |
113 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ | 113 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ |
114 | sandbox-seccomp-filter.o sandbox-capsicum.o \ | 114 | sandbox-seccomp-filter.o sandbox-capsicum.o |
115 | consolekit.o | ||
116 | 115 | ||
117 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out | 116 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out |
118 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 | 117 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 |
diff --git a/configure.ac b/configure.ac index cd6acaf9f..4d55c46fc 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -4188,30 +4188,6 @@ AC_ARG_WITH([kerberos5], | |||
4188 | AC_SUBST([GSSLIBS]) | 4188 | AC_SUBST([GSSLIBS]) |
4189 | AC_SUBST([K5LIBS]) | 4189 | AC_SUBST([K5LIBS]) |
4190 | 4190 | ||
4191 | # Check whether user wants ConsoleKit support | ||
4192 | CONSOLEKIT_MSG="no" | ||
4193 | LIBCK_CONNECTOR="" | ||
4194 | AC_ARG_WITH(consolekit, | ||
4195 | [ --with-consolekit Enable ConsoleKit support], | ||
4196 | [ if test "x$withval" != "xno" ; then | ||
4197 | AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no]) | ||
4198 | if test "$PKGCONFIG" != "no"; then | ||
4199 | AC_MSG_CHECKING([for ck-connector]) | ||
4200 | if $PKGCONFIG --exists ck-connector; then | ||
4201 | CKCON_CFLAGS=`$PKGCONFIG --cflags ck-connector` | ||
4202 | CKCON_LIBS=`$PKGCONFIG --libs ck-connector` | ||
4203 | CPPFLAGS="$CPPFLAGS $CKCON_CFLAGS" | ||
4204 | SSHDLIBS="$SSHDLIBS $CKCON_LIBS" | ||
4205 | AC_MSG_RESULT([yes]) | ||
4206 | AC_DEFINE(USE_CONSOLEKIT, 1, [Define if you want ConsoleKit support.]) | ||
4207 | CONSOLEKIT_MSG="yes" | ||
4208 | else | ||
4209 | AC_MSG_RESULT([no]) | ||
4210 | fi | ||
4211 | fi | ||
4212 | fi ] | ||
4213 | ) | ||
4214 | |||
4215 | # Looking for programs, paths and files | 4191 | # Looking for programs, paths and files |
4216 | 4192 | ||
4217 | PRIVSEP_PATH=/var/empty | 4193 | PRIVSEP_PATH=/var/empty |
@@ -5013,7 +4989,6 @@ echo " MD5 password support: $MD5_MSG" | |||
5013 | echo " libedit support: $LIBEDIT_MSG" | 4989 | echo " libedit support: $LIBEDIT_MSG" |
5014 | echo " Solaris process contract support: $SPC_MSG" | 4990 | echo " Solaris process contract support: $SPC_MSG" |
5015 | echo " Solaris project support: $SP_MSG" | 4991 | echo " Solaris project support: $SP_MSG" |
5016 | echo " ConsoleKit support: $CONSOLEKIT_MSG" | ||
5017 | echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" | 4992 | echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" |
5018 | echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" | 4993 | echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" |
5019 | echo " BSD Auth support: $BSD_AUTH_MSG" | 4994 | echo " BSD Auth support: $BSD_AUTH_MSG" |
diff --git a/consolekit.c b/consolekit.c deleted file mode 100644 index 0266f06a2..000000000 --- a/consolekit.c +++ /dev/null | |||
@@ -1,241 +0,0 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2008 Colin Watson. All rights reserved. | ||
3 | * | ||
4 | * Permission to use, copy, modify, and distribute this software for any | ||
5 | * purpose with or without fee is hereby granted, provided that the above | ||
6 | * copyright notice and this permission notice appear in all copies. | ||
7 | * | ||
8 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
9 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
10 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
11 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
12 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
13 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
14 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
15 | */ | ||
16 | /* | ||
17 | * Loosely based on pam-ck-connector, which is: | ||
18 | * | ||
19 | * Copyright (c) 2007 David Zeuthen <davidz@redhat.com> | ||
20 | * | ||
21 | * Permission is hereby granted, free of charge, to any person | ||
22 | * obtaining a copy of this software and associated documentation | ||
23 | * files (the "Software"), to deal in the Software without | ||
24 | * restriction, including without limitation the rights to use, | ||
25 | * copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
26 | * copies of the Software, and to permit persons to whom the | ||
27 | * Software is furnished to do so, subject to the following | ||
28 | * conditions: | ||
29 | * | ||
30 | * The above copyright notice and this permission notice shall be | ||
31 | * included in all copies or substantial portions of the Software. | ||
32 | * | ||
33 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, | ||
34 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES | ||
35 | * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND | ||
36 | * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT | ||
37 | * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, | ||
38 | * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | ||
39 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR | ||
40 | * OTHER DEALINGS IN THE SOFTWARE. | ||
41 | */ | ||
42 | |||
43 | #include "includes.h" | ||
44 | |||
45 | #ifdef USE_CONSOLEKIT | ||
46 | |||
47 | #include <ck-connector.h> | ||
48 | |||
49 | #include "openbsd-compat/sys-queue.h" | ||
50 | #include "xmalloc.h" | ||
51 | #include "channels.h" | ||
52 | #include "key.h" | ||
53 | #include "hostfile.h" | ||
54 | #include "auth.h" | ||
55 | #include "log.h" | ||
56 | #include "misc.h" | ||
57 | #include "servconf.h" | ||
58 | #include "canohost.h" | ||
59 | #include "session.h" | ||
60 | #include "consolekit.h" | ||
61 | |||
62 | extern ServerOptions options; | ||
63 | extern u_int utmp_len; | ||
64 | |||
65 | void | ||
66 | set_active(const char *cookie) | ||
67 | { | ||
68 | DBusError err; | ||
69 | DBusConnection *connection; | ||
70 | DBusMessage *message = NULL, *reply = NULL; | ||
71 | char *sid; | ||
72 | DBusMessageIter iter, subiter; | ||
73 | const char *interface, *property; | ||
74 | dbus_bool_t active; | ||
75 | |||
76 | dbus_error_init(&err); | ||
77 | connection = dbus_bus_get_private(DBUS_BUS_SYSTEM, &err); | ||
78 | if (!connection) { | ||
79 | if (dbus_error_is_set(&err)) { | ||
80 | error("unable to open DBus connection: %s", | ||
81 | err.message); | ||
82 | dbus_error_free(&err); | ||
83 | } | ||
84 | goto out; | ||
85 | } | ||
86 | dbus_connection_set_exit_on_disconnect(connection, FALSE); | ||
87 | |||
88 | message = dbus_message_new_method_call("org.freedesktop.ConsoleKit", | ||
89 | "/org/freedesktop/ConsoleKit/Manager", | ||
90 | "org.freedesktop.ConsoleKit.Manager", | ||
91 | "GetSessionForCookie"); | ||
92 | if (!message) | ||
93 | goto out; | ||
94 | if (!dbus_message_append_args(message, DBUS_TYPE_STRING, &cookie, | ||
95 | DBUS_TYPE_INVALID)) { | ||
96 | if (dbus_error_is_set(&err)) { | ||
97 | error("unable to get current session: %s", | ||
98 | err.message); | ||
99 | dbus_error_free(&err); | ||
100 | } | ||
101 | goto out; | ||
102 | } | ||
103 | |||
104 | dbus_error_init(&err); | ||
105 | reply = dbus_connection_send_with_reply_and_block(connection, message, | ||
106 | -1, &err); | ||
107 | if (!reply) { | ||
108 | if (dbus_error_is_set(&err)) { | ||
109 | error("unable to get current session: %s", | ||
110 | err.message); | ||
111 | dbus_error_free(&err); | ||
112 | } | ||
113 | goto out; | ||
114 | } | ||
115 | |||
116 | dbus_error_init(&err); | ||
117 | if (!dbus_message_get_args(reply, &err, | ||
118 | DBUS_TYPE_OBJECT_PATH, &sid, | ||
119 | DBUS_TYPE_INVALID)) { | ||
120 | if (dbus_error_is_set(&err)) { | ||
121 | error("unable to get current session: %s", | ||
122 | err.message); | ||
123 | dbus_error_free(&err); | ||
124 | } | ||
125 | goto out; | ||
126 | } | ||
127 | dbus_message_unref(reply); | ||
128 | dbus_message_unref(message); | ||
129 | message = reply = NULL; | ||
130 | |||
131 | message = dbus_message_new_method_call("org.freedesktop.ConsoleKit", | ||
132 | sid, "org.freedesktop.DBus.Properties", "Set"); | ||
133 | if (!message) | ||
134 | goto out; | ||
135 | interface = "org.freedesktop.ConsoleKit.Session"; | ||
136 | property = "active"; | ||
137 | if (!dbus_message_append_args(message, | ||
138 | DBUS_TYPE_STRING, &interface, DBUS_TYPE_STRING, &property, | ||
139 | DBUS_TYPE_INVALID)) | ||
140 | goto out; | ||
141 | dbus_message_iter_init_append(message, &iter); | ||
142 | if (!dbus_message_iter_open_container(&iter, DBUS_TYPE_VARIANT, | ||
143 | DBUS_TYPE_BOOLEAN_AS_STRING, &subiter)) | ||
144 | goto out; | ||
145 | active = TRUE; | ||
146 | if (!dbus_message_iter_append_basic(&subiter, DBUS_TYPE_BOOLEAN, | ||
147 | &active)) | ||
148 | goto out; | ||
149 | if (!dbus_message_iter_close_container(&iter, &subiter)) | ||
150 | goto out; | ||
151 | |||
152 | dbus_error_init(&err); | ||
153 | reply = dbus_connection_send_with_reply_and_block(connection, message, | ||
154 | -1, &err); | ||
155 | if (!reply) { | ||
156 | if (dbus_error_is_set(&err)) { | ||
157 | error("unable to make current session active: %s", | ||
158 | err.message); | ||
159 | dbus_error_free(&err); | ||
160 | } | ||
161 | goto out; | ||
162 | } | ||
163 | |||
164 | out: | ||
165 | if (reply) | ||
166 | dbus_message_unref(reply); | ||
167 | if (message) | ||
168 | dbus_message_unref(message); | ||
169 | } | ||
170 | |||
171 | /* | ||
172 | * We pass display separately rather than using s->display because the | ||
173 | * latter is not available in the monitor when using privsep. | ||
174 | */ | ||
175 | |||
176 | char * | ||
177 | consolekit_register(Session *s, const char *display) | ||
178 | { | ||
179 | DBusError err; | ||
180 | const char *tty = s->tty; | ||
181 | const char *remote_host_name; | ||
182 | dbus_bool_t is_local = FALSE; | ||
183 | const char *cookie = NULL; | ||
184 | |||
185 | if (s->ckc) { | ||
186 | debug("already registered with ConsoleKit"); | ||
187 | return xstrdup(ck_connector_get_cookie(s->ckc)); | ||
188 | } | ||
189 | |||
190 | s->ckc = ck_connector_new(); | ||
191 | if (!s->ckc) { | ||
192 | error("ck_connector_new failed"); | ||
193 | return NULL; | ||
194 | } | ||
195 | |||
196 | if (!tty) | ||
197 | tty = ""; | ||
198 | if (!display) | ||
199 | display = ""; | ||
200 | remote_host_name = get_remote_name_or_ip(utmp_len, options.use_dns); | ||
201 | if (!remote_host_name) | ||
202 | remote_host_name = ""; | ||
203 | |||
204 | dbus_error_init(&err); | ||
205 | if (!ck_connector_open_session_with_parameters(s->ckc, &err, | ||
206 | "unix-user", &s->pw->pw_uid, | ||
207 | "display-device", &tty, | ||
208 | "x11-display", &display, | ||
209 | "remote-host-name", &remote_host_name, | ||
210 | "is-local", &is_local, | ||
211 | NULL)) { | ||
212 | if (dbus_error_is_set(&err)) { | ||
213 | debug("%s", err.message); | ||
214 | dbus_error_free(&err); | ||
215 | } else { | ||
216 | debug("insufficient privileges or D-Bus / ConsoleKit " | ||
217 | "not available"); | ||
218 | } | ||
219 | return NULL; | ||
220 | } | ||
221 | |||
222 | debug("registered uid=%d on tty='%s' with ConsoleKit", | ||
223 | s->pw->pw_uid, s->tty); | ||
224 | |||
225 | cookie = ck_connector_get_cookie(s->ckc); | ||
226 | set_active(cookie); | ||
227 | return xstrdup(cookie); | ||
228 | } | ||
229 | |||
230 | void | ||
231 | consolekit_unregister(Session *s) | ||
232 | { | ||
233 | if (s->ckc) { | ||
234 | debug("unregistering ConsoleKit session %s", | ||
235 | ck_connector_get_cookie(s->ckc)); | ||
236 | ck_connector_unref(s->ckc); | ||
237 | s->ckc = NULL; | ||
238 | } | ||
239 | } | ||
240 | |||
241 | #endif /* USE_CONSOLEKIT */ | ||
diff --git a/consolekit.h b/consolekit.h deleted file mode 100644 index 8ce371690..000000000 --- a/consolekit.h +++ /dev/null | |||
@@ -1,24 +0,0 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2008 Colin Watson. All rights reserved. | ||
3 | * | ||
4 | * Permission to use, copy, modify, and distribute this software for any | ||
5 | * purpose with or without fee is hereby granted, provided that the above | ||
6 | * copyright notice and this permission notice appear in all copies. | ||
7 | * | ||
8 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
9 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
10 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
11 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
12 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
13 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
14 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
15 | */ | ||
16 | |||
17 | #ifdef USE_CONSOLEKIT | ||
18 | |||
19 | struct Session; | ||
20 | |||
21 | char * consolekit_register(struct Session *, const char *); | ||
22 | void consolekit_unregister(struct Session *); | ||
23 | |||
24 | #endif /* USE_CONSOLEKIT */ | ||
diff --git a/debian/.git-dpm b/debian/.git-dpm index a61336471..4e4b48bbf 100644 --- a/debian/.git-dpm +++ b/debian/.git-dpm | |||
@@ -1,6 +1,6 @@ | |||
1 | # see git-dpm(1) from git-dpm package | 1 | # see git-dpm(1) from git-dpm package |
2 | 48bcf47b091000fb3111b82385632d1401deb558 | 2 | 11ff24a98751edfc86ef0eed102f840eaa50d4e1 |
3 | 48bcf47b091000fb3111b82385632d1401deb558 | 3 | 11ff24a98751edfc86ef0eed102f840eaa50d4e1 |
4 | 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9 | 4 | 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9 |
5 | 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9 | 5 | 544df7a04ae5b5c1fc30be7c445ad685d7a02dc9 |
6 | openssh_6.9p1.orig.tar.gz | 6 | openssh_6.9p1.orig.tar.gz |
diff --git a/debian/changelog b/debian/changelog index 3038df6ed..5fab96c44 100644 --- a/debian/changelog +++ b/debian/changelog | |||
@@ -5,6 +5,8 @@ openssh (1:6.9p1-3) UNRELEASED; urgency=medium | |||
5 | * Fix dh_install and dh_fixperms overrides to work properly with an | 5 | * Fix dh_install and dh_fixperms overrides to work properly with an |
6 | architecture-independent-only build (closes: #806090). | 6 | architecture-independent-only build (closes: #806090). |
7 | * Do much less work in architecture-independent-only builds. | 7 | * Do much less work in architecture-independent-only builds. |
8 | * Drop ConsoleKit session registration patch; it was only ever enabled for | ||
9 | Ubuntu, which no longer needs it (LP: #1334916, #1502045). | ||
8 | 10 | ||
9 | -- Colin Watson <cjwatson@debian.org> Thu, 17 Sep 2015 13:52:53 +0100 | 11 | -- Colin Watson <cjwatson@debian.org> Thu, 17 Sep 2015 13:52:53 +0100 |
10 | 12 | ||
diff --git a/debian/control b/debian/control index 441cb03e6..a5fabff3a 100644 --- a/debian/control +++ b/debian/control | |||
@@ -2,7 +2,7 @@ Source: openssh | |||
2 | Section: net | 2 | Section: net |
3 | Priority: standard | 3 | Priority: standard |
4 | Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> | 4 | Maintainer: Debian OpenSSH Maintainers <debian-ssh@lists.debian.org> |
5 | Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3), libssl-dev (>= 0.9.8g), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 9~), dh-exec, libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, dpkg-dev (>= 1.16.1~), libck-connector-dev, dh-autoreconf, autotools-dev, dh-systemd (>= 1.4), libaudit-dev [linux-any] | 5 | Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev (>= 1:1.2.3), libssl-dev (>= 0.9.8g), libpam0g-dev | libpam-dev, libgtk2.0-dev, libedit-dev, debhelper (>= 9~), dh-exec, libselinux1-dev [linux-any], libkrb5-dev | heimdal-dev, dpkg-dev (>= 1.16.1~), dh-autoreconf, autotools-dev, dh-systemd (>= 1.4), libaudit-dev [linux-any] |
6 | XS-Testsuite: autopkgtest | 6 | XS-Testsuite: autopkgtest |
7 | Standards-Version: 3.9.6 | 7 | Standards-Version: 3.9.6 |
8 | Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org> | 8 | Uploaders: Colin Watson <cjwatson@debian.org>, Matthew Vernon <matthew@debian.org> |
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch index 88b4b278f..fa9542064 100644 --- a/debian/patches/auth-log-verbosity.patch +++ b/debian/patches/auth-log-verbosity.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 6094c895d27a24a4975ff768c3009fd93bb699dd Mon Sep 17 00:00:00 2001 | 1 | From c38beb3f8dcdd55621ad9d8fd3bc204d19a0a741 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:02 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:02 +0000 |
4 | Subject: Quieten logs when multiple from= restrictions are used | 4 | Subject: Quieten logs when multiple from= restrictions are used |
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch index 5ebe01d59..6bcb877e9 100644 --- a/debian/patches/authorized-keys-man-symlink.patch +++ b/debian/patches/authorized-keys-man-symlink.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 27cb399a4cf487695921e502542fdd495ab4c8ff Mon Sep 17 00:00:00 2001 | 1 | From 924de4a0afa1e2605c4dbc10dcdb5afc7a5d44ac Mon Sep 17 00:00:00 2001 |
2 | From: Tomas Pospisek <tpo_deb@sourcepole.ch> | 2 | From: Tomas Pospisek <tpo_deb@sourcepole.ch> |
3 | Date: Sun, 9 Feb 2014 16:10:07 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:07 +0000 |
4 | Subject: Install authorized_keys(5) as a symlink to sshd(8) | 4 | Subject: Install authorized_keys(5) as a symlink to sshd(8) |
@@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch | |||
13 | 1 file changed, 1 insertion(+) | 13 | 1 file changed, 1 insertion(+) |
14 | 14 | ||
15 | diff --git a/Makefile.in b/Makefile.in | 15 | diff --git a/Makefile.in b/Makefile.in |
16 | index c406aec..37cb023 100644 | 16 | index 3d2a328..915c740 100644 |
17 | --- a/Makefile.in | 17 | --- a/Makefile.in |
18 | +++ b/Makefile.in | 18 | +++ b/Makefile.in |
19 | @@ -325,6 +325,7 @@ install-files: | 19 | @@ -324,6 +324,7 @@ install-files: |
20 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 | 20 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 |
21 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 | 21 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 |
22 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | 22 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 |
diff --git a/debian/patches/backport-do-not-resend-username-to-pam.patch b/debian/patches/backport-do-not-resend-username-to-pam.patch index 694b4481c..865221b4f 100644 --- a/debian/patches/backport-do-not-resend-username-to-pam.patch +++ b/debian/patches/backport-do-not-resend-username-to-pam.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 8d73726cdce65479aaad386c290c71176dc83e31 Mon Sep 17 00:00:00 2001 | 1 | From 4e1468d9745c5e32d99cd85386dfc74e90a5cf14 Mon Sep 17 00:00:00 2001 |
2 | From: Damien Miller <djm@mindrot.org> | 2 | From: Damien Miller <djm@mindrot.org> |
3 | Date: Tue, 11 Aug 2015 13:33:24 +1000 | 3 | Date: Tue, 11 Aug 2015 13:33:24 +1000 |
4 | Subject: Don't resend username to PAM; it already has it. | 4 | Subject: Don't resend username to PAM; it already has it. |
@@ -16,10 +16,10 @@ Patch-Name: backport-do-not-resend-username-to-pam.patch | |||
16 | 2 files changed, 3 deletions(-) | 16 | 2 files changed, 3 deletions(-) |
17 | 17 | ||
18 | diff --git a/monitor.c b/monitor.c | 18 | diff --git a/monitor.c b/monitor.c |
19 | index 12ed6fd..870a6b9 100644 | 19 | index 3a3d2f0..3fc9253 100644 |
20 | --- a/monitor.c | 20 | --- a/monitor.c |
21 | +++ b/monitor.c | 21 | +++ b/monitor.c |
22 | @@ -1143,9 +1143,7 @@ extern KbdintDevice sshpam_device; | 22 | @@ -1127,9 +1127,7 @@ extern KbdintDevice sshpam_device; |
23 | int | 23 | int |
24 | mm_answer_pam_init_ctx(int sock, Buffer *m) | 24 | mm_answer_pam_init_ctx(int sock, Buffer *m) |
25 | { | 25 | { |
@@ -30,7 +30,7 @@ index 12ed6fd..870a6b9 100644 | |||
30 | sshpam_authok = NULL; | 30 | sshpam_authok = NULL; |
31 | buffer_clear(m); | 31 | buffer_clear(m); |
32 | diff --git a/monitor_wrap.c b/monitor_wrap.c | 32 | diff --git a/monitor_wrap.c b/monitor_wrap.c |
33 | index 2a0fe9b..e2fcf75 100644 | 33 | index 6ae72a0..6799911 100644 |
34 | --- a/monitor_wrap.c | 34 | --- a/monitor_wrap.c |
35 | +++ b/monitor_wrap.c | 35 | +++ b/monitor_wrap.c |
36 | @@ -632,7 +632,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt) | 36 | @@ -632,7 +632,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt) |
diff --git a/debian/patches/backport-fix-pty-permissions.patch b/debian/patches/backport-fix-pty-permissions.patch index be7c413af..1449014c0 100644 --- a/debian/patches/backport-fix-pty-permissions.patch +++ b/debian/patches/backport-fix-pty-permissions.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 8a07c2ecd69a0692757a08fb757a00ba7a9019bd Mon Sep 17 00:00:00 2001 | 1 | From fe597b453a89c6d1dcbbd91cacef80adc3b52fc9 Mon Sep 17 00:00:00 2001 |
2 | From: "djm@openbsd.org" <djm@openbsd.org> | 2 | From: "djm@openbsd.org" <djm@openbsd.org> |
3 | Date: Thu, 30 Jul 2015 23:09:15 +0000 | 3 | Date: Thu, 30 Jul 2015 23:09:15 +0000 |
4 | Subject: Fix pty permissions | 4 | Subject: Fix pty permissions |
diff --git a/debian/patches/backport-kbdint-duplicates.patch b/debian/patches/backport-kbdint-duplicates.patch index 489d0809f..c73c36ce0 100644 --- a/debian/patches/backport-kbdint-duplicates.patch +++ b/debian/patches/backport-kbdint-duplicates.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From a5e8b300054f1f888498ce6b42df784448bdc2a5 Mon Sep 17 00:00:00 2001 | 1 | From 0bcdac377a097516ed875bfa000598d6cca86c13 Mon Sep 17 00:00:00 2001 |
2 | From: "djm@openbsd.org" <djm@openbsd.org> | 2 | From: "djm@openbsd.org" <djm@openbsd.org> |
3 | Date: Sat, 18 Jul 2015 07:57:14 +0000 | 3 | Date: Sat, 18 Jul 2015 07:57:14 +0000 |
4 | Subject: only query each keyboard-interactive device once per authentication | 4 | Subject: only query each keyboard-interactive device once per authentication |
diff --git a/debian/patches/backport-pam-use-after-free.patch b/debian/patches/backport-pam-use-after-free.patch index d534e1867..4baecfe1b 100644 --- a/debian/patches/backport-pam-use-after-free.patch +++ b/debian/patches/backport-pam-use-after-free.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 86eebf92deb8023b009cfd3989bc34fb04f6f21c Mon Sep 17 00:00:00 2001 | 1 | From fddd7fcb2ccb2cfdd88328d1149c0c31fcf21447 Mon Sep 17 00:00:00 2001 |
2 | From: Damien Miller <djm@mindrot.org> | 2 | From: Damien Miller <djm@mindrot.org> |
3 | Date: Tue, 11 Aug 2015 13:34:12 +1000 | 3 | Date: Tue, 11 Aug 2015 13:34:12 +1000 |
4 | Subject: set sshpam_ctxt to NULL after free | 4 | Subject: set sshpam_ctxt to NULL after free |
@@ -16,10 +16,10 @@ Patch-Name: backport-pam-use-after-free.patch | |||
16 | 1 file changed, 3 insertions(+), 1 deletion(-) | 16 | 1 file changed, 3 insertions(+), 1 deletion(-) |
17 | 17 | ||
18 | diff --git a/monitor.c b/monitor.c | 18 | diff --git a/monitor.c b/monitor.c |
19 | index 870a6b9..e8541b4 100644 | 19 | index 3fc9253..c063ad1 100644 |
20 | --- a/monitor.c | 20 | --- a/monitor.c |
21 | +++ b/monitor.c | 21 | +++ b/monitor.c |
22 | @@ -1225,14 +1225,16 @@ mm_answer_pam_respond(int sock, Buffer *m) | 22 | @@ -1209,14 +1209,16 @@ mm_answer_pam_respond(int sock, Buffer *m) |
23 | int | 23 | int |
24 | mm_answer_pam_free_ctx(int sock, Buffer *m) | 24 | mm_answer_pam_free_ctx(int sock, Buffer *m) |
25 | { | 25 | { |
diff --git a/debian/patches/backport-regress-principals-command-noexec.patch b/debian/patches/backport-regress-principals-command-noexec.patch index b1622beb9..6b6649638 100644 --- a/debian/patches/backport-regress-principals-command-noexec.patch +++ b/debian/patches/backport-regress-principals-command-noexec.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 48bcf47b091000fb3111b82385632d1401deb558 Mon Sep 17 00:00:00 2001 | 1 | From 11ff24a98751edfc86ef0eed102f840eaa50d4e1 Mon Sep 17 00:00:00 2001 |
2 | From: Damien Miller <djm@mindrot.org> | 2 | From: Damien Miller <djm@mindrot.org> |
3 | Date: Mon, 10 Aug 2015 11:13:44 +1000 | 3 | Date: Mon, 10 Aug 2015 11:13:44 +1000 |
4 | Subject: let principals-command.sh work for noexec /var/run | 4 | Subject: let principals-command.sh work for noexec /var/run |
diff --git a/debian/patches/consolekit.patch b/debian/patches/consolekit.patch deleted file mode 100644 index ca29a70fb..000000000 --- a/debian/patches/consolekit.patch +++ /dev/null | |||
@@ -1,576 +0,0 @@ | |||
1 | From 2219c0ae6be6750432932833b69264a53e0496e4 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@ubuntu.com> | ||
3 | Date: Sun, 9 Feb 2014 16:09:57 +0000 | ||
4 | Subject: Add support for registering ConsoleKit sessions on login | ||
5 | |||
6 | Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1450 | ||
7 | Last-Updated: 2015-08-19 | ||
8 | |||
9 | Patch-Name: consolekit.patch | ||
10 | --- | ||
11 | Makefile.in | 3 +- | ||
12 | configure.ac | 25 ++++++ | ||
13 | consolekit.c | 241 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ | ||
14 | consolekit.h | 24 ++++++ | ||
15 | monitor.c | 42 ++++++++++ | ||
16 | monitor.h | 2 + | ||
17 | monitor_wrap.c | 30 +++++++ | ||
18 | monitor_wrap.h | 4 + | ||
19 | session.c | 13 ++++ | ||
20 | session.h | 6 ++ | ||
21 | 10 files changed, 389 insertions(+), 1 deletion(-) | ||
22 | create mode 100644 consolekit.c | ||
23 | create mode 100644 consolekit.h | ||
24 | |||
25 | diff --git a/Makefile.in b/Makefile.in | ||
26 | index 3d2a328..c406aec 100644 | ||
27 | --- a/Makefile.in | ||
28 | +++ b/Makefile.in | ||
29 | @@ -111,7 +111,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ | ||
30 | sftp-server.o sftp-common.o \ | ||
31 | roaming_common.o roaming_serv.o \ | ||
32 | sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ | ||
33 | - sandbox-seccomp-filter.o sandbox-capsicum.o | ||
34 | + sandbox-seccomp-filter.o sandbox-capsicum.o \ | ||
35 | + consolekit.o | ||
36 | |||
37 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out | ||
38 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 | ||
39 | diff --git a/configure.ac b/configure.ac | ||
40 | index 4d55c46..cd6acaf 100644 | ||
41 | --- a/configure.ac | ||
42 | +++ b/configure.ac | ||
43 | @@ -4188,6 +4188,30 @@ AC_ARG_WITH([kerberos5], | ||
44 | AC_SUBST([GSSLIBS]) | ||
45 | AC_SUBST([K5LIBS]) | ||
46 | |||
47 | +# Check whether user wants ConsoleKit support | ||
48 | +CONSOLEKIT_MSG="no" | ||
49 | +LIBCK_CONNECTOR="" | ||
50 | +AC_ARG_WITH(consolekit, | ||
51 | + [ --with-consolekit Enable ConsoleKit support], | ||
52 | + [ if test "x$withval" != "xno" ; then | ||
53 | + AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no]) | ||
54 | + if test "$PKGCONFIG" != "no"; then | ||
55 | + AC_MSG_CHECKING([for ck-connector]) | ||
56 | + if $PKGCONFIG --exists ck-connector; then | ||
57 | + CKCON_CFLAGS=`$PKGCONFIG --cflags ck-connector` | ||
58 | + CKCON_LIBS=`$PKGCONFIG --libs ck-connector` | ||
59 | + CPPFLAGS="$CPPFLAGS $CKCON_CFLAGS" | ||
60 | + SSHDLIBS="$SSHDLIBS $CKCON_LIBS" | ||
61 | + AC_MSG_RESULT([yes]) | ||
62 | + AC_DEFINE(USE_CONSOLEKIT, 1, [Define if you want ConsoleKit support.]) | ||
63 | + CONSOLEKIT_MSG="yes" | ||
64 | + else | ||
65 | + AC_MSG_RESULT([no]) | ||
66 | + fi | ||
67 | + fi | ||
68 | + fi ] | ||
69 | +) | ||
70 | + | ||
71 | # Looking for programs, paths and files | ||
72 | |||
73 | PRIVSEP_PATH=/var/empty | ||
74 | @@ -4989,6 +5013,7 @@ echo " MD5 password support: $MD5_MSG" | ||
75 | echo " libedit support: $LIBEDIT_MSG" | ||
76 | echo " Solaris process contract support: $SPC_MSG" | ||
77 | echo " Solaris project support: $SP_MSG" | ||
78 | +echo " ConsoleKit support: $CONSOLEKIT_MSG" | ||
79 | echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" | ||
80 | echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" | ||
81 | echo " BSD Auth support: $BSD_AUTH_MSG" | ||
82 | diff --git a/consolekit.c b/consolekit.c | ||
83 | new file mode 100644 | ||
84 | index 0000000..0266f06 | ||
85 | --- /dev/null | ||
86 | +++ b/consolekit.c | ||
87 | @@ -0,0 +1,241 @@ | ||
88 | +/* | ||
89 | + * Copyright (c) 2008 Colin Watson. All rights reserved. | ||
90 | + * | ||
91 | + * Permission to use, copy, modify, and distribute this software for any | ||
92 | + * purpose with or without fee is hereby granted, provided that the above | ||
93 | + * copyright notice and this permission notice appear in all copies. | ||
94 | + * | ||
95 | + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
96 | + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
97 | + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
98 | + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
99 | + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
100 | + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
101 | + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
102 | + */ | ||
103 | +/* | ||
104 | + * Loosely based on pam-ck-connector, which is: | ||
105 | + * | ||
106 | + * Copyright (c) 2007 David Zeuthen <davidz@redhat.com> | ||
107 | + * | ||
108 | + * Permission is hereby granted, free of charge, to any person | ||
109 | + * obtaining a copy of this software and associated documentation | ||
110 | + * files (the "Software"), to deal in the Software without | ||
111 | + * restriction, including without limitation the rights to use, | ||
112 | + * copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
113 | + * copies of the Software, and to permit persons to whom the | ||
114 | + * Software is furnished to do so, subject to the following | ||
115 | + * conditions: | ||
116 | + * | ||
117 | + * The above copyright notice and this permission notice shall be | ||
118 | + * included in all copies or substantial portions of the Software. | ||
119 | + * | ||
120 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, | ||
121 | + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES | ||
122 | + * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND | ||
123 | + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT | ||
124 | + * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, | ||
125 | + * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | ||
126 | + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR | ||
127 | + * OTHER DEALINGS IN THE SOFTWARE. | ||
128 | + */ | ||
129 | + | ||
130 | +#include "includes.h" | ||
131 | + | ||
132 | +#ifdef USE_CONSOLEKIT | ||
133 | + | ||
134 | +#include <ck-connector.h> | ||
135 | + | ||
136 | +#include "openbsd-compat/sys-queue.h" | ||
137 | +#include "xmalloc.h" | ||
138 | +#include "channels.h" | ||
139 | +#include "key.h" | ||
140 | +#include "hostfile.h" | ||
141 | +#include "auth.h" | ||
142 | +#include "log.h" | ||
143 | +#include "misc.h" | ||
144 | +#include "servconf.h" | ||
145 | +#include "canohost.h" | ||
146 | +#include "session.h" | ||
147 | +#include "consolekit.h" | ||
148 | + | ||
149 | +extern ServerOptions options; | ||
150 | +extern u_int utmp_len; | ||
151 | + | ||
152 | +void | ||
153 | +set_active(const char *cookie) | ||
154 | +{ | ||
155 | + DBusError err; | ||
156 | + DBusConnection *connection; | ||
157 | + DBusMessage *message = NULL, *reply = NULL; | ||
158 | + char *sid; | ||
159 | + DBusMessageIter iter, subiter; | ||
160 | + const char *interface, *property; | ||
161 | + dbus_bool_t active; | ||
162 | + | ||
163 | + dbus_error_init(&err); | ||
164 | + connection = dbus_bus_get_private(DBUS_BUS_SYSTEM, &err); | ||
165 | + if (!connection) { | ||
166 | + if (dbus_error_is_set(&err)) { | ||
167 | + error("unable to open DBus connection: %s", | ||
168 | + err.message); | ||
169 | + dbus_error_free(&err); | ||
170 | + } | ||
171 | + goto out; | ||
172 | + } | ||
173 | + dbus_connection_set_exit_on_disconnect(connection, FALSE); | ||
174 | + | ||
175 | + message = dbus_message_new_method_call("org.freedesktop.ConsoleKit", | ||
176 | + "/org/freedesktop/ConsoleKit/Manager", | ||
177 | + "org.freedesktop.ConsoleKit.Manager", | ||
178 | + "GetSessionForCookie"); | ||
179 | + if (!message) | ||
180 | + goto out; | ||
181 | + if (!dbus_message_append_args(message, DBUS_TYPE_STRING, &cookie, | ||
182 | + DBUS_TYPE_INVALID)) { | ||
183 | + if (dbus_error_is_set(&err)) { | ||
184 | + error("unable to get current session: %s", | ||
185 | + err.message); | ||
186 | + dbus_error_free(&err); | ||
187 | + } | ||
188 | + goto out; | ||
189 | + } | ||
190 | + | ||
191 | + dbus_error_init(&err); | ||
192 | + reply = dbus_connection_send_with_reply_and_block(connection, message, | ||
193 | + -1, &err); | ||
194 | + if (!reply) { | ||
195 | + if (dbus_error_is_set(&err)) { | ||
196 | + error("unable to get current session: %s", | ||
197 | + err.message); | ||
198 | + dbus_error_free(&err); | ||
199 | + } | ||
200 | + goto out; | ||
201 | + } | ||
202 | + | ||
203 | + dbus_error_init(&err); | ||
204 | + if (!dbus_message_get_args(reply, &err, | ||
205 | + DBUS_TYPE_OBJECT_PATH, &sid, | ||
206 | + DBUS_TYPE_INVALID)) { | ||
207 | + if (dbus_error_is_set(&err)) { | ||
208 | + error("unable to get current session: %s", | ||
209 | + err.message); | ||
210 | + dbus_error_free(&err); | ||
211 | + } | ||
212 | + goto out; | ||
213 | + } | ||
214 | + dbus_message_unref(reply); | ||
215 | + dbus_message_unref(message); | ||
216 | + message = reply = NULL; | ||
217 | + | ||
218 | + message = dbus_message_new_method_call("org.freedesktop.ConsoleKit", | ||
219 | + sid, "org.freedesktop.DBus.Properties", "Set"); | ||
220 | + if (!message) | ||
221 | + goto out; | ||
222 | + interface = "org.freedesktop.ConsoleKit.Session"; | ||
223 | + property = "active"; | ||
224 | + if (!dbus_message_append_args(message, | ||
225 | + DBUS_TYPE_STRING, &interface, DBUS_TYPE_STRING, &property, | ||
226 | + DBUS_TYPE_INVALID)) | ||
227 | + goto out; | ||
228 | + dbus_message_iter_init_append(message, &iter); | ||
229 | + if (!dbus_message_iter_open_container(&iter, DBUS_TYPE_VARIANT, | ||
230 | + DBUS_TYPE_BOOLEAN_AS_STRING, &subiter)) | ||
231 | + goto out; | ||
232 | + active = TRUE; | ||
233 | + if (!dbus_message_iter_append_basic(&subiter, DBUS_TYPE_BOOLEAN, | ||
234 | + &active)) | ||
235 | + goto out; | ||
236 | + if (!dbus_message_iter_close_container(&iter, &subiter)) | ||
237 | + goto out; | ||
238 | + | ||
239 | + dbus_error_init(&err); | ||
240 | + reply = dbus_connection_send_with_reply_and_block(connection, message, | ||
241 | + -1, &err); | ||
242 | + if (!reply) { | ||
243 | + if (dbus_error_is_set(&err)) { | ||
244 | + error("unable to make current session active: %s", | ||
245 | + err.message); | ||
246 | + dbus_error_free(&err); | ||
247 | + } | ||
248 | + goto out; | ||
249 | + } | ||
250 | + | ||
251 | +out: | ||
252 | + if (reply) | ||
253 | + dbus_message_unref(reply); | ||
254 | + if (message) | ||
255 | + dbus_message_unref(message); | ||
256 | +} | ||
257 | + | ||
258 | +/* | ||
259 | + * We pass display separately rather than using s->display because the | ||
260 | + * latter is not available in the monitor when using privsep. | ||
261 | + */ | ||
262 | + | ||
263 | +char * | ||
264 | +consolekit_register(Session *s, const char *display) | ||
265 | +{ | ||
266 | + DBusError err; | ||
267 | + const char *tty = s->tty; | ||
268 | + const char *remote_host_name; | ||
269 | + dbus_bool_t is_local = FALSE; | ||
270 | + const char *cookie = NULL; | ||
271 | + | ||
272 | + if (s->ckc) { | ||
273 | + debug("already registered with ConsoleKit"); | ||
274 | + return xstrdup(ck_connector_get_cookie(s->ckc)); | ||
275 | + } | ||
276 | + | ||
277 | + s->ckc = ck_connector_new(); | ||
278 | + if (!s->ckc) { | ||
279 | + error("ck_connector_new failed"); | ||
280 | + return NULL; | ||
281 | + } | ||
282 | + | ||
283 | + if (!tty) | ||
284 | + tty = ""; | ||
285 | + if (!display) | ||
286 | + display = ""; | ||
287 | + remote_host_name = get_remote_name_or_ip(utmp_len, options.use_dns); | ||
288 | + if (!remote_host_name) | ||
289 | + remote_host_name = ""; | ||
290 | + | ||
291 | + dbus_error_init(&err); | ||
292 | + if (!ck_connector_open_session_with_parameters(s->ckc, &err, | ||
293 | + "unix-user", &s->pw->pw_uid, | ||
294 | + "display-device", &tty, | ||
295 | + "x11-display", &display, | ||
296 | + "remote-host-name", &remote_host_name, | ||
297 | + "is-local", &is_local, | ||
298 | + NULL)) { | ||
299 | + if (dbus_error_is_set(&err)) { | ||
300 | + debug("%s", err.message); | ||
301 | + dbus_error_free(&err); | ||
302 | + } else { | ||
303 | + debug("insufficient privileges or D-Bus / ConsoleKit " | ||
304 | + "not available"); | ||
305 | + } | ||
306 | + return NULL; | ||
307 | + } | ||
308 | + | ||
309 | + debug("registered uid=%d on tty='%s' with ConsoleKit", | ||
310 | + s->pw->pw_uid, s->tty); | ||
311 | + | ||
312 | + cookie = ck_connector_get_cookie(s->ckc); | ||
313 | + set_active(cookie); | ||
314 | + return xstrdup(cookie); | ||
315 | +} | ||
316 | + | ||
317 | +void | ||
318 | +consolekit_unregister(Session *s) | ||
319 | +{ | ||
320 | + if (s->ckc) { | ||
321 | + debug("unregistering ConsoleKit session %s", | ||
322 | + ck_connector_get_cookie(s->ckc)); | ||
323 | + ck_connector_unref(s->ckc); | ||
324 | + s->ckc = NULL; | ||
325 | + } | ||
326 | +} | ||
327 | + | ||
328 | +#endif /* USE_CONSOLEKIT */ | ||
329 | diff --git a/consolekit.h b/consolekit.h | ||
330 | new file mode 100644 | ||
331 | index 0000000..8ce3716 | ||
332 | --- /dev/null | ||
333 | +++ b/consolekit.h | ||
334 | @@ -0,0 +1,24 @@ | ||
335 | +/* | ||
336 | + * Copyright (c) 2008 Colin Watson. All rights reserved. | ||
337 | + * | ||
338 | + * Permission to use, copy, modify, and distribute this software for any | ||
339 | + * purpose with or without fee is hereby granted, provided that the above | ||
340 | + * copyright notice and this permission notice appear in all copies. | ||
341 | + * | ||
342 | + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
343 | + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
344 | + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
345 | + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
346 | + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
347 | + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
348 | + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
349 | + */ | ||
350 | + | ||
351 | +#ifdef USE_CONSOLEKIT | ||
352 | + | ||
353 | +struct Session; | ||
354 | + | ||
355 | +char * consolekit_register(struct Session *, const char *); | ||
356 | +void consolekit_unregister(struct Session *); | ||
357 | + | ||
358 | +#endif /* USE_CONSOLEKIT */ | ||
359 | diff --git a/monitor.c b/monitor.c | ||
360 | index 3a3d2f0..12ed6fd 100644 | ||
361 | --- a/monitor.c | ||
362 | +++ b/monitor.c | ||
363 | @@ -104,6 +104,9 @@ | ||
364 | #include "authfd.h" | ||
365 | #include "match.h" | ||
366 | #include "ssherr.h" | ||
367 | +#ifdef USE_CONSOLEKIT | ||
368 | +#include "consolekit.h" | ||
369 | +#endif | ||
370 | |||
371 | #ifdef GSSAPI | ||
372 | static Gssctxt *gsscontext = NULL; | ||
373 | @@ -169,6 +172,10 @@ int mm_answer_audit_command(int, Buffer *); | ||
374 | |||
375 | static int monitor_read_log(struct monitor *); | ||
376 | |||
377 | +#ifdef USE_CONSOLEKIT | ||
378 | +int mm_answer_consolekit_register(int, Buffer *); | ||
379 | +#endif | ||
380 | + | ||
381 | static Authctxt *authctxt; | ||
382 | |||
383 | #ifdef WITH_SSH1 | ||
384 | @@ -261,6 +268,9 @@ struct mon_table mon_dispatch_postauth20[] = { | ||
385 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, | ||
386 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, | ||
387 | #endif | ||
388 | +#ifdef USE_CONSOLEKIT | ||
389 | + {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register}, | ||
390 | +#endif | ||
391 | {0, 0, NULL} | ||
392 | }; | ||
393 | |||
394 | @@ -306,6 +316,9 @@ struct mon_table mon_dispatch_postauth15[] = { | ||
395 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, | ||
396 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command}, | ||
397 | #endif | ||
398 | +#ifdef USE_CONSOLEKIT | ||
399 | + {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register}, | ||
400 | +#endif | ||
401 | #endif /* WITH_SSH1 */ | ||
402 | {0, 0, NULL} | ||
403 | }; | ||
404 | @@ -488,6 +501,9 @@ monitor_child_postauth(struct monitor *pmonitor) | ||
405 | monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); | ||
406 | monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1); | ||
407 | } | ||
408 | +#ifdef USE_CONSOLEKIT | ||
409 | + monitor_permit(mon_dispatch, MONITOR_REQ_CONSOLEKIT_REGISTER, 1); | ||
410 | +#endif | ||
411 | |||
412 | for (;;) | ||
413 | monitor_read(pmonitor, mon_dispatch, NULL); | ||
414 | @@ -2191,3 +2207,29 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) { | ||
415 | |||
416 | #endif /* GSSAPI */ | ||
417 | |||
418 | +#ifdef USE_CONSOLEKIT | ||
419 | +int | ||
420 | +mm_answer_consolekit_register(int sock, Buffer *m) | ||
421 | +{ | ||
422 | + Session *s; | ||
423 | + char *tty, *display; | ||
424 | + char *cookie = NULL; | ||
425 | + | ||
426 | + debug3("%s entering", __func__); | ||
427 | + | ||
428 | + tty = buffer_get_string(m, NULL); | ||
429 | + display = buffer_get_string(m, NULL); | ||
430 | + s = session_by_tty(tty); | ||
431 | + if (s != NULL) | ||
432 | + cookie = consolekit_register(s, display); | ||
433 | + buffer_clear(m); | ||
434 | + buffer_put_cstring(m, cookie != NULL ? cookie : ""); | ||
435 | + mm_request_send(sock, MONITOR_ANS_CONSOLEKIT_REGISTER, m); | ||
436 | + | ||
437 | + free(cookie); | ||
438 | + free(display); | ||
439 | + free(tty); | ||
440 | + | ||
441 | + return (0); | ||
442 | +} | ||
443 | +#endif /* USE_CONSOLEKIT */ | ||
444 | diff --git a/monitor.h b/monitor.h | ||
445 | index 2d82b8b..fd8d92c 100644 | ||
446 | --- a/monitor.h | ||
447 | +++ b/monitor.h | ||
448 | @@ -70,6 +70,8 @@ enum monitor_reqtype { | ||
449 | |||
450 | MONITOR_REQ_AUTHROLE = 154, | ||
451 | |||
452 | + MONITOR_REQ_CONSOLEKIT_REGISTER = 156, MONITOR_ANS_CONSOLEKIT_REGISTER = 157, | ||
453 | + | ||
454 | }; | ||
455 | |||
456 | struct mm_master; | ||
457 | diff --git a/monitor_wrap.c b/monitor_wrap.c | ||
458 | index 6ae72a0..2a0fe9b 100644 | ||
459 | --- a/monitor_wrap.c | ||
460 | +++ b/monitor_wrap.c | ||
461 | @@ -1151,3 +1151,33 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store) | ||
462 | |||
463 | #endif /* GSSAPI */ | ||
464 | |||
465 | +#ifdef USE_CONSOLEKIT | ||
466 | +char * | ||
467 | +mm_consolekit_register(Session *s, const char *display) | ||
468 | +{ | ||
469 | + Buffer m; | ||
470 | + char *cookie; | ||
471 | + | ||
472 | + debug3("%s entering", __func__); | ||
473 | + | ||
474 | + if (s->ttyfd == -1) | ||
475 | + return NULL; | ||
476 | + buffer_init(&m); | ||
477 | + buffer_put_cstring(&m, s->tty); | ||
478 | + buffer_put_cstring(&m, display != NULL ? display : ""); | ||
479 | + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_CONSOLEKIT_REGISTER, &m); | ||
480 | + buffer_clear(&m); | ||
481 | + | ||
482 | + mm_request_receive_expect(pmonitor->m_recvfd, | ||
483 | + MONITOR_ANS_CONSOLEKIT_REGISTER, &m); | ||
484 | + cookie = buffer_get_string(&m, NULL); | ||
485 | + buffer_free(&m); | ||
486 | + | ||
487 | + /* treat empty cookie as missing cookie */ | ||
488 | + if (strlen(cookie) == 0) { | ||
489 | + free(cookie); | ||
490 | + cookie = NULL; | ||
491 | + } | ||
492 | + return (cookie); | ||
493 | +} | ||
494 | +#endif /* USE_CONSOLEKIT */ | ||
495 | diff --git a/monitor_wrap.h b/monitor_wrap.h | ||
496 | index 57e740f..6829392 100644 | ||
497 | --- a/monitor_wrap.h | ||
498 | +++ b/monitor_wrap.h | ||
499 | @@ -108,4 +108,8 @@ int mm_skey_respond(void *, u_int, char **); | ||
500 | /* zlib allocation hooks */ | ||
501 | void mm_init_compression(struct mm_master *); | ||
502 | |||
503 | +#ifdef USE_CONSOLEKIT | ||
504 | +char *mm_consolekit_register(struct Session *, const char *); | ||
505 | +#endif /* USE_CONSOLEKIT */ | ||
506 | + | ||
507 | #endif /* _MM_WRAP_H_ */ | ||
508 | diff --git a/session.c b/session.c | ||
509 | index afac4a5..c6bd728 100644 | ||
510 | --- a/session.c | ||
511 | +++ b/session.c | ||
512 | @@ -94,6 +94,7 @@ | ||
513 | #include "kex.h" | ||
514 | #include "monitor_wrap.h" | ||
515 | #include "sftp.h" | ||
516 | +#include "consolekit.h" | ||
517 | |||
518 | #if defined(KRB5) && defined(USE_AFS) | ||
519 | #include <kafs.h> | ||
520 | @@ -1144,6 +1145,9 @@ do_setup_env(Session *s, const char *shell) | ||
521 | #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN) | ||
522 | char *path = NULL; | ||
523 | #endif | ||
524 | +#ifdef USE_CONSOLEKIT | ||
525 | + const char *ckcookie = NULL; | ||
526 | +#endif /* USE_CONSOLEKIT */ | ||
527 | |||
528 | /* Initialize the environment. */ | ||
529 | envsize = 100; | ||
530 | @@ -1288,6 +1292,11 @@ do_setup_env(Session *s, const char *shell) | ||
531 | child_set_env(&env, &envsize, "KRB5CCNAME", | ||
532 | s->authctxt->krb5_ccname); | ||
533 | #endif | ||
534 | +#ifdef USE_CONSOLEKIT | ||
535 | + ckcookie = PRIVSEP(consolekit_register(s, s->display)); | ||
536 | + if (ckcookie) | ||
537 | + child_set_env(&env, &envsize, "XDG_SESSION_COOKIE", ckcookie); | ||
538 | +#endif /* USE_CONSOLEKIT */ | ||
539 | #ifdef USE_PAM | ||
540 | /* | ||
541 | * Pull in any environment variables that may have | ||
542 | @@ -2351,6 +2360,10 @@ session_pty_cleanup2(Session *s) | ||
543 | |||
544 | debug("session_pty_cleanup: session %d release %s", s->self, s->tty); | ||
545 | |||
546 | +#ifdef USE_CONSOLEKIT | ||
547 | + consolekit_unregister(s); | ||
548 | +#endif /* USE_CONSOLEKIT */ | ||
549 | + | ||
550 | /* Record that the user has logged out. */ | ||
551 | if (s->pid != 0) | ||
552 | record_logout(s->pid, s->tty, s->pw->pw_name); | ||
553 | diff --git a/session.h b/session.h | ||
554 | index ef6593c..a6b6983 100644 | ||
555 | --- a/session.h | ||
556 | +++ b/session.h | ||
557 | @@ -26,6 +26,8 @@ | ||
558 | #ifndef SESSION_H | ||
559 | #define SESSION_H | ||
560 | |||
561 | +struct _CkConnector; | ||
562 | + | ||
563 | #define TTYSZ 64 | ||
564 | typedef struct Session Session; | ||
565 | struct Session { | ||
566 | @@ -61,6 +63,10 @@ struct Session { | ||
567 | char *name; | ||
568 | char *val; | ||
569 | } *env; | ||
570 | + | ||
571 | +#ifdef USE_CONSOLEKIT | ||
572 | + struct _CkConnector *ckc; | ||
573 | +#endif /* USE_CONSOLEKIT */ | ||
574 | }; | ||
575 | |||
576 | void do_authenticated(Authctxt *); | ||
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch index 36d84652d..cbbe6b790 100644 --- a/debian/patches/debian-banner.patch +++ b/debian/patches/debian-banner.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 79b8c11f2b7a8258dee45e8f10ee58d0f4e48340 Mon Sep 17 00:00:00 2001 | 1 | From 692e965f7be2a33a6fecc392a2cb8023977f9c31 Mon Sep 17 00:00:00 2001 |
2 | From: Kees Cook <kees@debian.org> | 2 | From: Kees Cook <kees@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:06 +0000 |
4 | Subject: Add DebianBanner server configuration option | 4 | Subject: Add DebianBanner server configuration option |
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch index 5c0edd160..dd33c00a6 100644 --- a/debian/patches/debian-config.patch +++ b/debian/patches/debian-config.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From be3c323d998ebf49c589bfd887dbb8aa6c68634c Mon Sep 17 00:00:00 2001 | 1 | From 0cce5c4c1de33c4172ce8ebc0f93e717995779f8 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:18 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:18 +0000 |
4 | Subject: Various Debian-specific configuration changes | 4 | Subject: Various Debian-specific configuration changes |
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch index 031bc67e0..60a12c72f 100644 --- a/debian/patches/dnssec-sshfp.patch +++ b/debian/patches/dnssec-sshfp.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 0b7d8f80872624024fad8132ffc3b0d0c1ba7224 Mon Sep 17 00:00:00 2001 | 1 | From 840c980f0a68a101c3aa1e884724ceff37e8e147 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:01 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:01 +0000 |
4 | Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf | 4 | Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf |
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch index 77a9989e6..259560a0d 100644 --- a/debian/patches/doc-hash-tab-completion.patch +++ b/debian/patches/doc-hash-tab-completion.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 3f06b9397f342cb59dd5d1d045d0f663aca848f6 Mon Sep 17 00:00:00 2001 | 1 | From e2a36dcb275a675203f22467863cce90829a64b7 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:11 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:11 +0000 |
4 | Subject: Document that HashKnownHosts may break tab-completion | 4 | Subject: Document that HashKnownHosts may break tab-completion |
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch index 6eff1ce58..96c76a651 100644 --- a/debian/patches/doc-upstart.patch +++ b/debian/patches/doc-upstart.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 0ea95f75af043685c707b6626a1e7e50947c72a5 Mon Sep 17 00:00:00 2001 | 1 | From c239fee2fa5aae0a6e3086330562241bd9330bca Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@ubuntu.com> | 2 | From: Colin Watson <cjwatson@ubuntu.com> |
3 | Date: Sun, 9 Feb 2014 16:10:12 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:12 +0000 |
4 | Subject: Refer to ssh's Upstart job as well as its init script | 4 | Subject: Refer to ssh's Upstart job as well as its init script |
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch index 2c924b7a9..609706831 100644 --- a/debian/patches/gnome-ssh-askpass2-icon.patch +++ b/debian/patches/gnome-ssh-askpass2-icon.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 44b9b2e319659c452bad24f3bfcd5a1f7df951c9 Mon Sep 17 00:00:00 2001 | 1 | From 9a1c2558e40d504443830442c42f5a6e46f31ed0 Mon Sep 17 00:00:00 2001 |
2 | From: Vincent Untz <vuntz@ubuntu.com> | 2 | From: Vincent Untz <vuntz@ubuntu.com> |
3 | Date: Sun, 9 Feb 2014 16:10:16 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:16 +0000 |
4 | Subject: Give the ssh-askpass-gnome window a default icon | 4 | Subject: Give the ssh-askpass-gnome window a default icon |
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch index dcdf3d753..3f14a6470 100644 --- a/debian/patches/lintian-symlink-pickiness.patch +++ b/debian/patches/lintian-symlink-pickiness.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 927f8421a046c30addfb0befb20a6c63fb9dc861 Mon Sep 17 00:00:00 2001 | 1 | From 506df046bb56e8d10d95d8cb3912f1462b7c4695 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:08 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:08 +0000 |
4 | Subject: Fix picky lintian errors about slogin symlinks | 4 | Subject: Fix picky lintian errors about slogin symlinks |
@@ -15,10 +15,10 @@ Patch-Name: lintian-symlink-pickiness.patch | |||
15 | 1 file changed, 2 insertions(+), 2 deletions(-) | 15 | 1 file changed, 2 insertions(+), 2 deletions(-) |
16 | 16 | ||
17 | diff --git a/Makefile.in b/Makefile.in | 17 | diff --git a/Makefile.in b/Makefile.in |
18 | index 37cb023..f52f903 100644 | 18 | index 915c740..e161d0e 100644 |
19 | --- a/Makefile.in | 19 | --- a/Makefile.in |
20 | +++ b/Makefile.in | 20 | +++ b/Makefile.in |
21 | @@ -331,9 +331,9 @@ install-files: | 21 | @@ -330,9 +330,9 @@ install-files: |
22 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | 22 | $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 |
23 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 | 23 | $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 |
24 | -rm -f $(DESTDIR)$(bindir)/slogin | 24 | -rm -f $(DESTDIR)$(bindir)/slogin |
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch index 8a7a22fd7..d3da72de0 100644 --- a/debian/patches/mention-ssh-keygen-on-keychange.patch +++ b/debian/patches/mention-ssh-keygen-on-keychange.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 544fd142bcda578b49e0c264ce21a2f1eff39b3d Mon Sep 17 00:00:00 2001 | 1 | From 7fed650902de773980b1de83cec3c4cf6bb282da Mon Sep 17 00:00:00 2001 |
2 | From: Scott Moser <smoser@ubuntu.com> | 2 | From: Scott Moser <smoser@ubuntu.com> |
3 | Date: Sun, 9 Feb 2014 16:10:03 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:03 +0000 |
4 | Subject: Mention ssh-keygen in ssh fingerprint changed warning | 4 | Subject: Mention ssh-keygen in ssh fingerprint changed warning |
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch index a80f129e1..fd2686f65 100644 --- a/debian/patches/no-openssl-version-status.patch +++ b/debian/patches/no-openssl-version-status.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From a134809ff96caefb81c08678c0694996adf1fa9e Mon Sep 17 00:00:00 2001 | 1 | From 64a33173d97a03b4d53380206d166716df25591a Mon Sep 17 00:00:00 2001 |
2 | From: Kurt Roeckx <kurt@roeckx.be> | 2 | From: Kurt Roeckx <kurt@roeckx.be> |
3 | Date: Sun, 9 Feb 2014 16:10:14 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:14 +0000 |
4 | Subject: Don't check the status field of the OpenSSL version | 4 | Subject: Don't check the status field of the OpenSSL version |
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch index 571643bda..8c681b9b0 100644 --- a/debian/patches/openbsd-docs.patch +++ b/debian/patches/openbsd-docs.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 80eba814e1ac7fe21a79a610998dbecb91237cee Mon Sep 17 00:00:00 2001 | 1 | From 96ecf95406b8599528e60ccfc5b32b543f74ddc4 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:09 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:09 +0000 |
4 | Subject: Adjust various OpenBSD-specific references in manual pages | 4 | Subject: Adjust various OpenBSD-specific references in manual pages |
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch index dd262241c..ddec0ec63 100644 --- a/debian/patches/package-versioning.patch +++ b/debian/patches/package-versioning.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 6de10ec1ff53c5b52621244b66cae91df3901fa2 Mon Sep 17 00:00:00 2001 | 1 | From 2c39fe957130704a00871229c53116db4a25e0c3 Mon Sep 17 00:00:00 2001 |
2 | From: Matthew Vernon <matthew@debian.org> | 2 | From: Matthew Vernon <matthew@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:05 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:05 +0000 |
4 | Subject: Include the Debian version in our identification | 4 | Subject: Include the Debian version in our identification |
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch index 24e3b4517..04ba23411 100644 --- a/debian/patches/scp-quoting.patch +++ b/debian/patches/scp-quoting.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 286127a1eb1be61084bc7907f8862470a140739b Mon Sep 17 00:00:00 2001 | 1 | From 3ed0b40149ad6ae1bae649d64e69614b8520cd84 Mon Sep 17 00:00:00 2001 |
2 | From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com> | 2 | From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com> |
3 | Date: Sun, 9 Feb 2014 16:09:59 +0000 | 3 | Date: Sun, 9 Feb 2014 16:09:59 +0000 |
4 | Subject: Adjust scp quoting in verbose mode | 4 | Subject: Adjust scp quoting in verbose mode |
diff --git a/debian/patches/series b/debian/patches/series index 15c939708..b6538a45a 100644 --- a/debian/patches/series +++ b/debian/patches/series | |||
@@ -7,7 +7,6 @@ keepalive-extensions.patch | |||
7 | syslog-level-silent.patch | 7 | syslog-level-silent.patch |
8 | quieter-signals.patch | 8 | quieter-signals.patch |
9 | helpful-wait-terminate.patch | 9 | helpful-wait-terminate.patch |
10 | consolekit.patch | ||
11 | user-group-modes.patch | 10 | user-group-modes.patch |
12 | scp-quoting.patch | 11 | scp-quoting.patch |
13 | shell-path.patch | 12 | shell-path.patch |
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch index 12d23f2e6..2c8c17bca 100644 --- a/debian/patches/shell-path.patch +++ b/debian/patches/shell-path.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From d36b4a740c176eb7b63d0eb3eca2faf485d4ef99 Mon Sep 17 00:00:00 2001 | 1 | From 120a9e949da169bd8672f58a66160730c2763db6 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:00 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:00 +0000 |
4 | Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand | 4 | Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand |
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch index d79970cb8..f568ebf3d 100644 --- a/debian/patches/sigstop.patch +++ b/debian/patches/sigstop.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From e331e402ea0ab5d2333cc91f1724425d961ca293 Mon Sep 17 00:00:00 2001 | 1 | From 18a9869659a7e7f3bde44fa2d26599844baece2c Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:17 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:17 +0000 |
4 | Subject: Support synchronisation with service supervisor using SIGSTOP | 4 | Subject: Support synchronisation with service supervisor using SIGSTOP |
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch index d9fcb7727..4c5d39dc1 100644 --- a/debian/patches/ssh-agent-setgid.patch +++ b/debian/patches/ssh-agent-setgid.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 13cdd61591b754d225df765ac8a3982d7de894b7 Mon Sep 17 00:00:00 2001 | 1 | From 751acd3741de0e2ae2dbd32cc5970981cb6382da Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:13 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:13 +0000 |
4 | Subject: Document consequences of ssh-agent being setgid in ssh-agent(1) | 4 | Subject: Document consequences of ssh-agent being setgid in ssh-agent(1) |
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch index 46a89a787..174d321df 100644 --- a/debian/patches/ssh-argv0.patch +++ b/debian/patches/ssh-argv0.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 791a058fc28e6ca7b75c80e4f20f4d7e567aa557 Mon Sep 17 00:00:00 2001 | 1 | From eb8700714181bd9e84a110edfd5978a932622aa0 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:10:10 +0000 | 3 | Date: Sun, 9 Feb 2014 16:10:10 +0000 |
4 | Subject: ssh(1): Refer to ssh-argv0(1) | 4 | Subject: ssh(1): Refer to ssh-argv0(1) |
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch index cd6155d6a..b43b0c9bb 100644 --- a/debian/patches/user-group-modes.patch +++ b/debian/patches/user-group-modes.patch | |||
@@ -1,4 +1,4 @@ | |||
1 | From 8c6ce36545711e987fcab76a11f2110fdf9a7c8a Mon Sep 17 00:00:00 2001 | 1 | From 113450cad7a19b997e51945f012539836bba6f17 Mon Sep 17 00:00:00 2001 |
2 | From: Colin Watson <cjwatson@debian.org> | 2 | From: Colin Watson <cjwatson@debian.org> |
3 | Date: Sun, 9 Feb 2014 16:09:58 +0000 | 3 | Date: Sun, 9 Feb 2014 16:09:58 +0000 |
4 | Subject: Allow harmless group-writability | 4 | Subject: Allow harmless group-writability |
diff --git a/debian/rules b/debian/rules index 148eed209..993a70539 100755 --- a/debian/rules +++ b/debian/rules | |||
@@ -93,9 +93,6 @@ ifeq ($(DEB_HOST_ARCH_OS),linux) | |||
93 | confflags += --with-selinux | 93 | confflags += --with-selinux |
94 | confflags += --with-audit=linux | 94 | confflags += --with-audit=linux |
95 | endif | 95 | endif |
96 | ifeq ($(DISTRIBUTOR),Ubuntu) | ||
97 | confflags += --with-consolekit | ||
98 | endif | ||
99 | 96 | ||
100 | # The deb build wants xauth; the udeb build doesn't. | 97 | # The deb build wants xauth; the udeb build doesn't. |
101 | confflags += --with-xauth=/usr/bin/xauth | 98 | confflags += --with-xauth=/usr/bin/xauth |
@@ -104,9 +104,6 @@ | |||
104 | #include "authfd.h" | 104 | #include "authfd.h" |
105 | #include "match.h" | 105 | #include "match.h" |
106 | #include "ssherr.h" | 106 | #include "ssherr.h" |
107 | #ifdef USE_CONSOLEKIT | ||
108 | #include "consolekit.h" | ||
109 | #endif | ||
110 | 107 | ||
111 | #ifdef GSSAPI | 108 | #ifdef GSSAPI |
112 | static Gssctxt *gsscontext = NULL; | 109 | static Gssctxt *gsscontext = NULL; |
@@ -172,10 +169,6 @@ int mm_answer_audit_command(int, Buffer *); | |||
172 | 169 | ||
173 | static int monitor_read_log(struct monitor *); | 170 | static int monitor_read_log(struct monitor *); |
174 | 171 | ||
175 | #ifdef USE_CONSOLEKIT | ||
176 | int mm_answer_consolekit_register(int, Buffer *); | ||
177 | #endif | ||
178 | |||
179 | static Authctxt *authctxt; | 172 | static Authctxt *authctxt; |
180 | 173 | ||
181 | #ifdef WITH_SSH1 | 174 | #ifdef WITH_SSH1 |
@@ -268,9 +261,6 @@ struct mon_table mon_dispatch_postauth20[] = { | |||
268 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, | 261 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, |
269 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, | 262 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, |
270 | #endif | 263 | #endif |
271 | #ifdef USE_CONSOLEKIT | ||
272 | {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register}, | ||
273 | #endif | ||
274 | {0, 0, NULL} | 264 | {0, 0, NULL} |
275 | }; | 265 | }; |
276 | 266 | ||
@@ -316,9 +306,6 @@ struct mon_table mon_dispatch_postauth15[] = { | |||
316 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, | 306 | {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, |
317 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command}, | 307 | {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command}, |
318 | #endif | 308 | #endif |
319 | #ifdef USE_CONSOLEKIT | ||
320 | {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register}, | ||
321 | #endif | ||
322 | #endif /* WITH_SSH1 */ | 309 | #endif /* WITH_SSH1 */ |
323 | {0, 0, NULL} | 310 | {0, 0, NULL} |
324 | }; | 311 | }; |
@@ -501,9 +488,6 @@ monitor_child_postauth(struct monitor *pmonitor) | |||
501 | monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); | 488 | monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1); |
502 | monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1); | 489 | monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1); |
503 | } | 490 | } |
504 | #ifdef USE_CONSOLEKIT | ||
505 | monitor_permit(mon_dispatch, MONITOR_REQ_CONSOLEKIT_REGISTER, 1); | ||
506 | #endif | ||
507 | 491 | ||
508 | for (;;) | 492 | for (;;) |
509 | monitor_read(pmonitor, mon_dispatch, NULL); | 493 | monitor_read(pmonitor, mon_dispatch, NULL); |
@@ -2207,29 +2191,3 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) { | |||
2207 | 2191 | ||
2208 | #endif /* GSSAPI */ | 2192 | #endif /* GSSAPI */ |
2209 | 2193 | ||
2210 | #ifdef USE_CONSOLEKIT | ||
2211 | int | ||
2212 | mm_answer_consolekit_register(int sock, Buffer *m) | ||
2213 | { | ||
2214 | Session *s; | ||
2215 | char *tty, *display; | ||
2216 | char *cookie = NULL; | ||
2217 | |||
2218 | debug3("%s entering", __func__); | ||
2219 | |||
2220 | tty = buffer_get_string(m, NULL); | ||
2221 | display = buffer_get_string(m, NULL); | ||
2222 | s = session_by_tty(tty); | ||
2223 | if (s != NULL) | ||
2224 | cookie = consolekit_register(s, display); | ||
2225 | buffer_clear(m); | ||
2226 | buffer_put_cstring(m, cookie != NULL ? cookie : ""); | ||
2227 | mm_request_send(sock, MONITOR_ANS_CONSOLEKIT_REGISTER, m); | ||
2228 | |||
2229 | free(cookie); | ||
2230 | free(display); | ||
2231 | free(tty); | ||
2232 | |||
2233 | return (0); | ||
2234 | } | ||
2235 | #endif /* USE_CONSOLEKIT */ | ||
@@ -70,8 +70,6 @@ enum monitor_reqtype { | |||
70 | 70 | ||
71 | MONITOR_REQ_AUTHROLE = 154, | 71 | MONITOR_REQ_AUTHROLE = 154, |
72 | 72 | ||
73 | MONITOR_REQ_CONSOLEKIT_REGISTER = 156, MONITOR_ANS_CONSOLEKIT_REGISTER = 157, | ||
74 | |||
75 | }; | 73 | }; |
76 | 74 | ||
77 | struct mm_master; | 75 | struct mm_master; |
diff --git a/monitor_wrap.c b/monitor_wrap.c index e2fcf75ff..679991178 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c | |||
@@ -1150,33 +1150,3 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store) | |||
1150 | 1150 | ||
1151 | #endif /* GSSAPI */ | 1151 | #endif /* GSSAPI */ |
1152 | 1152 | ||
1153 | #ifdef USE_CONSOLEKIT | ||
1154 | char * | ||
1155 | mm_consolekit_register(Session *s, const char *display) | ||
1156 | { | ||
1157 | Buffer m; | ||
1158 | char *cookie; | ||
1159 | |||
1160 | debug3("%s entering", __func__); | ||
1161 | |||
1162 | if (s->ttyfd == -1) | ||
1163 | return NULL; | ||
1164 | buffer_init(&m); | ||
1165 | buffer_put_cstring(&m, s->tty); | ||
1166 | buffer_put_cstring(&m, display != NULL ? display : ""); | ||
1167 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_CONSOLEKIT_REGISTER, &m); | ||
1168 | buffer_clear(&m); | ||
1169 | |||
1170 | mm_request_receive_expect(pmonitor->m_recvfd, | ||
1171 | MONITOR_ANS_CONSOLEKIT_REGISTER, &m); | ||
1172 | cookie = buffer_get_string(&m, NULL); | ||
1173 | buffer_free(&m); | ||
1174 | |||
1175 | /* treat empty cookie as missing cookie */ | ||
1176 | if (strlen(cookie) == 0) { | ||
1177 | free(cookie); | ||
1178 | cookie = NULL; | ||
1179 | } | ||
1180 | return (cookie); | ||
1181 | } | ||
1182 | #endif /* USE_CONSOLEKIT */ | ||
diff --git a/monitor_wrap.h b/monitor_wrap.h index 682939215..57e740f89 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h | |||
@@ -108,8 +108,4 @@ int mm_skey_respond(void *, u_int, char **); | |||
108 | /* zlib allocation hooks */ | 108 | /* zlib allocation hooks */ |
109 | void mm_init_compression(struct mm_master *); | 109 | void mm_init_compression(struct mm_master *); |
110 | 110 | ||
111 | #ifdef USE_CONSOLEKIT | ||
112 | char *mm_consolekit_register(struct Session *, const char *); | ||
113 | #endif /* USE_CONSOLEKIT */ | ||
114 | |||
115 | #endif /* _MM_WRAP_H_ */ | 111 | #endif /* _MM_WRAP_H_ */ |
@@ -94,7 +94,6 @@ | |||
94 | #include "kex.h" | 94 | #include "kex.h" |
95 | #include "monitor_wrap.h" | 95 | #include "monitor_wrap.h" |
96 | #include "sftp.h" | 96 | #include "sftp.h" |
97 | #include "consolekit.h" | ||
98 | 97 | ||
99 | #if defined(KRB5) && defined(USE_AFS) | 98 | #if defined(KRB5) && defined(USE_AFS) |
100 | #include <kafs.h> | 99 | #include <kafs.h> |
@@ -1145,9 +1144,6 @@ do_setup_env(Session *s, const char *shell) | |||
1145 | #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN) | 1144 | #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN) |
1146 | char *path = NULL; | 1145 | char *path = NULL; |
1147 | #endif | 1146 | #endif |
1148 | #ifdef USE_CONSOLEKIT | ||
1149 | const char *ckcookie = NULL; | ||
1150 | #endif /* USE_CONSOLEKIT */ | ||
1151 | 1147 | ||
1152 | /* Initialize the environment. */ | 1148 | /* Initialize the environment. */ |
1153 | envsize = 100; | 1149 | envsize = 100; |
@@ -1292,11 +1288,6 @@ do_setup_env(Session *s, const char *shell) | |||
1292 | child_set_env(&env, &envsize, "KRB5CCNAME", | 1288 | child_set_env(&env, &envsize, "KRB5CCNAME", |
1293 | s->authctxt->krb5_ccname); | 1289 | s->authctxt->krb5_ccname); |
1294 | #endif | 1290 | #endif |
1295 | #ifdef USE_CONSOLEKIT | ||
1296 | ckcookie = PRIVSEP(consolekit_register(s, s->display)); | ||
1297 | if (ckcookie) | ||
1298 | child_set_env(&env, &envsize, "XDG_SESSION_COOKIE", ckcookie); | ||
1299 | #endif /* USE_CONSOLEKIT */ | ||
1300 | #ifdef USE_PAM | 1291 | #ifdef USE_PAM |
1301 | /* | 1292 | /* |
1302 | * Pull in any environment variables that may have | 1293 | * Pull in any environment variables that may have |
@@ -2360,10 +2351,6 @@ session_pty_cleanup2(Session *s) | |||
2360 | 2351 | ||
2361 | debug("session_pty_cleanup: session %d release %s", s->self, s->tty); | 2352 | debug("session_pty_cleanup: session %d release %s", s->self, s->tty); |
2362 | 2353 | ||
2363 | #ifdef USE_CONSOLEKIT | ||
2364 | consolekit_unregister(s); | ||
2365 | #endif /* USE_CONSOLEKIT */ | ||
2366 | |||
2367 | /* Record that the user has logged out. */ | 2354 | /* Record that the user has logged out. */ |
2368 | if (s->pid != 0) | 2355 | if (s->pid != 0) |
2369 | record_logout(s->pid, s->tty, s->pw->pw_name); | 2356 | record_logout(s->pid, s->tty, s->pw->pw_name); |
@@ -26,8 +26,6 @@ | |||
26 | #ifndef SESSION_H | 26 | #ifndef SESSION_H |
27 | #define SESSION_H | 27 | #define SESSION_H |
28 | 28 | ||
29 | struct _CkConnector; | ||
30 | |||
31 | #define TTYSZ 64 | 29 | #define TTYSZ 64 |
32 | typedef struct Session Session; | 30 | typedef struct Session Session; |
33 | struct Session { | 31 | struct Session { |
@@ -63,10 +61,6 @@ struct Session { | |||
63 | char *name; | 61 | char *name; |
64 | char *val; | 62 | char *val; |
65 | } *env; | 63 | } *env; |
66 | |||
67 | #ifdef USE_CONSOLEKIT | ||
68 | struct _CkConnector *ckc; | ||
69 | #endif /* USE_CONSOLEKIT */ | ||
70 | }; | 64 | }; |
71 | 65 | ||
72 | void do_authenticated(Authctxt *); | 66 | void do_authenticated(Authctxt *); |