Since ssh-keysign isn't used by default (you need to set EnableSSHKeysign

to "yes" in /etc/ssh/ssh_config), having a debconf question to ask whether
it should be setuid is overkill, and the question text had got out of date
anyway. Remove this question, ship ssh-keysign setuid in
openssh-client.deb, and set a statoverride if the debconf question was
previously set to false.

1 files changed, 0 insertions, 13 deletions

diff --git a/debian/openssh-client.postinst b/debian/openssh-client.postinst
index 4744a34a1..466801057 100644
--- a/debian/openssh-client.postinst
+++ b/debian/openssh-client.postinst
@@ -73,16 +73,6 @@ set_ssh_permissions() {
                         dpkg-statoverride --remove /usr/lib/ssh-keysign || true
                 fi
         fi
-
-        if [ ! -x /usr/sbin/dpkg-statoverride ] || \
-             ! dpkg-statoverride --list /usr/lib/openssh/ssh-keysign >/dev/null; then
-                db_get ssh/SUID_client
-                if [ "$RET" = "false" ] ; then
-                        chmod 0755 /usr/lib/openssh/ssh-keysign
-                elif [ "$RET" = "true" ] ; then
-                        chmod 4755 /usr/lib/openssh/ssh-keysign
-                fi
-        fi
 }
 
 fix_ssh_group() {
@@ -113,7 +103,4 @@ if [ "$2" = "1:3.5p1-1" ]; then
 fi
 set_ssh_agent_permissions
 
-
-db_stop
-
 exit 0