diff options
| author | Colin Watson <cjwatson@debian.org> | 2014-02-09 16:10:13 +0000 |
|---|---|---|
| committer | Colin Watson <cjwatson@debian.org> | 2014-03-20 00:32:29 +0000 |
| commit | d53483ab71ac2a9195c8f171da5a5dcf54ec16ec (patch) | |
| tree | b3b229bb6fb1434c50052766c4dc1d03a232080b | |
| parent | 111de26347496af3f6ed04849fd29bc4bf1c2cea (diff) | |
Document consequences of ssh-agent being setgid in ssh-agent(1)
Bug-Debian: http://bugs.debian.org/711623
Forwarded: no
Last-Update: 2013-06-08
Patch-Name: ssh-agent-setgid.patch
| -rw-r--r-- | ssh-agent.1 | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/ssh-agent.1 b/ssh-agent.1 index 281ecbdcf..38fd540bd 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 | |||
| @@ -183,6 +183,21 @@ environment variable holds the agent's process ID. | |||
| 183 | .Pp | 183 | .Pp |
| 184 | The agent exits automatically when the command given on the command | 184 | The agent exits automatically when the command given on the command |
| 185 | line terminates. | 185 | line terminates. |
| 186 | .Pp | ||
| 187 | In Debian, | ||
| 188 | .Nm | ||
| 189 | is installed with the set-group-id bit set, to prevent | ||
| 190 | .Xr ptrace 2 | ||
| 191 | attacks retrieving private key material. | ||
| 192 | This has the side-effect of causing the run-time linker to remove certain | ||
| 193 | environment variables which might have security implications for set-id | ||
| 194 | programs, including | ||
| 195 | .Ev LD_PRELOAD , | ||
| 196 | .Ev LD_LIBRARY_PATH , | ||
| 197 | and | ||
| 198 | .Ev TMPDIR . | ||
| 199 | If you need to set any of these environment variables, you will need to do | ||
| 200 | so in the program executed by ssh-agent. | ||
| 186 | .Sh FILES | 201 | .Sh FILES |
| 187 | .Bl -tag -width Ds | 202 | .Bl -tag -width Ds |
| 188 | .It Pa ~/.ssh/identity | 203 | .It Pa ~/.ssh/identity |