Initialize git-dpm

1 files changed, 111 insertions, 95 deletions

diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index ac00edac6..9382d5086 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,70 +1,61 @@
-Description: Allow harmless group-writability
- Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
- group-writable, provided that the group in question contains only the
- file's owner.  Rejected upstream for IMO incorrect reasons (e.g. a
- misunderstanding about the contents of gr->gr_mem).  Given that
- per-user groups and umask 002 are the default setup in Debian (for good
- reasons - this makes operating in setgid directories with other groups
- much easier), we need to permit this by default.
-Author: Colin Watson <cjwatson@debian.org>
+From 7016a7e8a6b854833132db253fd5e392984bd4ea Mon Sep 17 00:00:00 2001
+From: Colin Watson <cjwatson@debian.org>
+Date: Sun, 9 Feb 2014 16:09:58 +0000
+Subject: Allow harmless group-writability
+
+Allow secure files (~/.ssh/config, ~/.ssh/authorized_keys, etc.) to be
+group-writable, provided that the group in question contains only the file's
+owner.  Rejected upstream for IMO incorrect reasons (e.g. a misunderstanding
+about the contents of gr->gr_mem).  Given that per-user groups and umask 002
+are the default setup in Debian (for good reasons - this makes operating in
+setgid directories with other groups much easier), we need to permit this by
+default.
+
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1060
 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314347
 Last-Update: 2013-09-14
 
-Index: b/readconf.c
-===================================================================
---- a/readconf.c
-+++ b/readconf.c
-@@ -30,6 +30,8 @@
- #include <stdio.h>
- #include <string.h>
- #include <unistd.h>
-+#include <pwd.h>
-+#include <grp.h>
- #ifdef HAVE_UTIL_H
- #include <util.h>
- #endif
-@@ -1160,8 +1162,7 @@
- 
-                if (fstat(fileno(f), &sb) == -1)
-                        fatal("fstat %s: %s", filename, strerror(errno));
--               if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
--                   (sb.st_mode & 022) != 0))
-+               if (!secure_permissions(&sb, getuid()))
-                        fatal("Bad owner or permissions on %s", filename);
+Patch-Name: user-group-modes.patch
+---
+ auth-rhosts.c |  6 ++----
+ auth.c        |  9 +++-----
+ misc.c        | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ misc.h        |  2 ++
+ platform.c    | 16 --------------
+ readconf.c    |  5 +++--
+ ssh.1         |  2 ++
+ ssh_config.5  |  2 ++
+ 8 files changed, 82 insertions(+), 29 deletions(-)
+
+diff --git a/auth-rhosts.c b/auth-rhosts.c
+index 06ae7f0..f202787 100644
+--- a/auth-rhosts.c
++++ b/auth-rhosts.c
+@@ -256,8 +256,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
+                return 0;
         }
- 
-Index: b/ssh.1
-===================================================================
---- a/ssh.1
-+++ b/ssh.1
-@@ -1338,6 +1338,8 @@
- .Xr ssh_config 5 .
- Because of the potential for abuse, this file must have strict permissions:
- read/write for the user, and not writable by others.
-+It may be group-writable provided that the group in question contains only
-+the user.
- .Pp
- .It Pa ~/.ssh/environment
- Contains additional definitions for environment variables; see
-Index: b/ssh_config.5
-===================================================================
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -1382,6 +1382,8 @@
- This file is used by the SSH client.
- Because of the potential for abuse, this file must have strict permissions:
- read/write for the user, and not accessible by others.
-+It may be group-writable provided that the group in question contains only
-+the user.
- .It Pa /etc/ssh/ssh_config
- Systemwide configuration file.
- This file provides defaults for those
-Index: b/auth.c
-===================================================================
+        if (options.strict_modes &&
+-           ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+-           (st.st_mode & 022) != 0)) {
++           !secure_permissions(&st, pw->pw_uid)) {
+                logit("Rhosts authentication refused for %.100s: "
+                    "bad ownership or modes for home directory.", pw->pw_name);
+                auth_debug_add("Rhosts authentication refused for %.100s: "
+@@ -283,8 +282,7 @@ auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostnam
+                 * allowing access to their account by anyone.
+                 */
+                if (options.strict_modes &&
+-                   ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
+-                   (st.st_mode & 022) != 0)) {
++                   !secure_permissions(&st, pw->pw_uid)) {
+                        logit("Rhosts authentication refused for %.100s: bad modes for %.200s",
+                            pw->pw_name, buf);
+                        auth_debug_add("Bad file modes for %.200s", buf);
+diff --git a/auth.c b/auth.c
+index 6662e9a..7f6c6c8 100644
 --- a/auth.c
 +++ b/auth.c
-@@ -408,8 +408,7 @@
+@@ -408,8 +408,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
                 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
                 if (options.strict_modes &&
                     (stat(user_hostfile, &st) == 0) &&
@@ -74,7 +65,7 @@ Index: b/auth.c
                         logit("Authentication refused for %.100s: "
                             "bad owner or modes for %.200s",
                             pw->pw_name, user_hostfile);
-@@ -471,8 +470,7 @@
+@@ -471,8 +470,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 snprintf(err, errlen, "%s is not a regular file", buf);
                 return -1;
         }
@@ -84,7 +75,7 @@ Index: b/auth.c
                 snprintf(err, errlen, "bad ownership or modes for file %s",
                     buf);
                 return -1;
-@@ -487,8 +485,7 @@
+@@ -487,8 +485,7 @@ auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
                 strlcpy(buf, cp, sizeof(buf));
  
                 if (stat(buf, &st) < 0 ||
@@ -94,8 +85,8 @@ Index: b/auth.c
                         snprintf(err, errlen,
                             "bad ownership or modes for directory %s", buf);
                         return -1;
-Index: b/misc.c
-===================================================================
+diff --git a/misc.c b/misc.c
+index c3c8099..eb57bfc 100644
 --- a/misc.c
 +++ b/misc.c
 @@ -48,8 +48,9 @@
@@ -117,7 +108,7 @@ Index: b/misc.c
  
  /* remove newline at end of string */
  char *
-@@ -642,6 +644,71 @@
+@@ -642,6 +644,71 @@ read_keyfile_line(FILE *f, const char *filename, char *buf, size_t bufsz,
         return -1;
  }
  
@@ -189,46 +180,22 @@ Index: b/misc.c
  int
  tun_open(int tun, int mode)
  {
-Index: b/misc.h
-===================================================================
+diff --git a/misc.h b/misc.h
+index fceb306..51ba182 100644
 --- a/misc.h
 +++ b/misc.h
-@@ -104,4 +104,6 @@
+@@ -104,4 +104,6 @@ char        *read_passphrase(const char *, int);
  int     ask_permission(const char *, ...) __attribute__((format(printf, 1, 2)));
  int     read_keyfile_line(FILE *, const char *, char *, size_t, u_long *);
  
 +int     secure_permissions(struct stat *st, uid_t uid);
 +
  #endif /* _MISC_H */
-Index: b/auth-rhosts.c
-===================================================================
---- a/auth-rhosts.c
-+++ b/auth-rhosts.c
-@@ -256,8 +256,7 @@
-                return 0;
-        }
-        if (options.strict_modes &&
--           ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
--           (st.st_mode & 022) != 0)) {
-+           !secure_permissions(&st, pw->pw_uid)) {
-                logit("Rhosts authentication refused for %.100s: "
-                    "bad ownership or modes for home directory.", pw->pw_name);
-                auth_debug_add("Rhosts authentication refused for %.100s: "
-@@ -283,8 +282,7 @@
-                 * allowing access to their account by anyone.
-                 */
-                if (options.strict_modes &&
--                   ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
--                   (st.st_mode & 022) != 0)) {
-+                   !secure_permissions(&st, pw->pw_uid)) {
-                        logit("Rhosts authentication refused for %.100s: bad modes for %.200s",
-                            pw->pw_name, buf);
-                        auth_debug_add("Bad file modes for %.200s", buf);
-Index: b/platform.c
-===================================================================
+diff --git a/platform.c b/platform.c
+index a962f15..0b3bee1 100644
 --- a/platform.c
 +++ b/platform.c
-@@ -194,19 +194,3 @@
+@@ -194,19 +194,3 @@ platform_krb5_get_principal_name(const char *pw_name)
         return NULL;
  #endif
  }
@@ -248,3 +215,52 @@ Index: b/platform.c
 -#endif
 -       return 0;
 -}
+diff --git a/readconf.c b/readconf.c
+index 2dcbf31..389de7d 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -30,6 +30,8 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <unistd.h>
++#include <pwd.h>
++#include <grp.h>
+ #ifdef HAVE_UTIL_H
+ #include <util.h>
+ #endif
+@@ -1160,8 +1162,7 @@ read_config_file(const char *filename, const char *host, Options *options,
+ 
+                if (fstat(fileno(f), &sb) == -1)
+                        fatal("fstat %s: %s", filename, strerror(errno));
+-               if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
+-                   (sb.st_mode & 022) != 0))
++               if (!secure_permissions(&sb, getuid()))
+                        fatal("Bad owner or permissions on %s", filename);
+        }
+ 
+diff --git a/ssh.1 b/ssh.1
+index 66a7007..0b38ae1 100644
+--- a/ssh.1
++++ b/ssh.1
+@@ -1338,6 +1338,8 @@ The file format and configuration options are described in
+ .Xr ssh_config 5 .
+ Because of the potential for abuse, this file must have strict permissions:
+ read/write for the user, and not writable by others.
++It may be group-writable provided that the group in question contains only
++the user.
+ .Pp
+ .It Pa ~/.ssh/environment
+ Contains additional definitions for environment variables; see
+diff --git a/ssh_config.5 b/ssh_config.5
+index 135d833..1497cfc 100644
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -1382,6 +1382,8 @@ The format of this file is described above.
+ This file is used by the SSH client.
+ Because of the potential for abuse, this file must have strict permissions:
+ read/write for the user, and not accessible by others.
++It may be group-writable provided that the group in question contains only
++the user.
+ .It Pa /etc/ssh/ssh_config
+ Systemwide configuration file.
+ This file provides defaults for those