Drop ConsoleKit session registration patch; it was only ever enabled for Ubuntu, which no longer needs it (LP: #1334916, #1502045).

26 files changed, 33 insertions, 610 deletions

diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 88b4b278f..fa9542064 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -1,4 +1,4 @@
-From 6094c895d27a24a4975ff768c3009fd93bb699dd Mon Sep 17 00:00:00 2001
+From c38beb3f8dcdd55621ad9d8fd3bc204d19a0a741 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:02 +0000
 Subject: Quieten logs when multiple from= restrictions are used
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 5ebe01d59..6bcb877e9 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -1,4 +1,4 @@
-From 27cb399a4cf487695921e502542fdd495ab4c8ff Mon Sep 17 00:00:00 2001
+From 924de4a0afa1e2605c4dbc10dcdb5afc7a5d44ac Mon Sep 17 00:00:00 2001
 From: Tomas Pospisek <tpo_deb@sourcepole.ch>
 Date: Sun, 9 Feb 2014 16:10:07 +0000
 Subject: Install authorized_keys(5) as a symlink to sshd(8)
@@ -13,10 +13,10 @@ Patch-Name: authorized-keys-man-symlink.patch
  1 file changed, 1 insertion(+)
 
 diff --git a/Makefile.in b/Makefile.in
-index c406aec..37cb023 100644
+index 3d2a328..915c740 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -325,6 +325,7 @@ install-files:
+@@ -324,6 +324,7 @@ install-files:
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/backport-do-not-resend-username-to-pam.patch b/debian/patches/backport-do-not-resend-username-to-pam.patch
index 694b4481c..865221b4f 100644
--- a/debian/patches/backport-do-not-resend-username-to-pam.patch
+++ b/debian/patches/backport-do-not-resend-username-to-pam.patch
@@ -1,4 +1,4 @@
-From 8d73726cdce65479aaad386c290c71176dc83e31 Mon Sep 17 00:00:00 2001
+From 4e1468d9745c5e32d99cd85386dfc74e90a5cf14 Mon Sep 17 00:00:00 2001
 From: Damien Miller <djm@mindrot.org>
 Date: Tue, 11 Aug 2015 13:33:24 +1000
 Subject: Don't resend username to PAM; it already has it.
@@ -16,10 +16,10 @@ Patch-Name: backport-do-not-resend-username-to-pam.patch
  2 files changed, 3 deletions(-)
 
 diff --git a/monitor.c b/monitor.c
-index 12ed6fd..870a6b9 100644
+index 3a3d2f0..3fc9253 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -1143,9 +1143,7 @@ extern KbdintDevice sshpam_device;
+@@ -1127,9 +1127,7 @@ extern KbdintDevice sshpam_device;
  int
  mm_answer_pam_init_ctx(int sock, Buffer *m)
  {
@@ -30,7 +30,7 @@ index 12ed6fd..870a6b9 100644
         sshpam_authok = NULL;
         buffer_clear(m);
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 2a0fe9b..e2fcf75 100644
+index 6ae72a0..6799911 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
 @@ -632,7 +632,6 @@ mm_sshpam_init_ctx(Authctxt *authctxt)
diff --git a/debian/patches/backport-fix-pty-permissions.patch b/debian/patches/backport-fix-pty-permissions.patch
index be7c413af..1449014c0 100644
--- a/debian/patches/backport-fix-pty-permissions.patch
+++ b/debian/patches/backport-fix-pty-permissions.patch
@@ -1,4 +1,4 @@
-From 8a07c2ecd69a0692757a08fb757a00ba7a9019bd Mon Sep 17 00:00:00 2001
+From fe597b453a89c6d1dcbbd91cacef80adc3b52fc9 Mon Sep 17 00:00:00 2001
 From: "djm@openbsd.org" <djm@openbsd.org>
 Date: Thu, 30 Jul 2015 23:09:15 +0000
 Subject: Fix pty permissions
diff --git a/debian/patches/backport-kbdint-duplicates.patch b/debian/patches/backport-kbdint-duplicates.patch
index 489d0809f..c73c36ce0 100644
--- a/debian/patches/backport-kbdint-duplicates.patch
+++ b/debian/patches/backport-kbdint-duplicates.patch
@@ -1,4 +1,4 @@
-From a5e8b300054f1f888498ce6b42df784448bdc2a5 Mon Sep 17 00:00:00 2001
+From 0bcdac377a097516ed875bfa000598d6cca86c13 Mon Sep 17 00:00:00 2001
 From: "djm@openbsd.org" <djm@openbsd.org>
 Date: Sat, 18 Jul 2015 07:57:14 +0000
 Subject: only query each keyboard-interactive device once per authentication
diff --git a/debian/patches/backport-pam-use-after-free.patch b/debian/patches/backport-pam-use-after-free.patch
index d534e1867..4baecfe1b 100644
--- a/debian/patches/backport-pam-use-after-free.patch
+++ b/debian/patches/backport-pam-use-after-free.patch
@@ -1,4 +1,4 @@
-From 86eebf92deb8023b009cfd3989bc34fb04f6f21c Mon Sep 17 00:00:00 2001
+From fddd7fcb2ccb2cfdd88328d1149c0c31fcf21447 Mon Sep 17 00:00:00 2001
 From: Damien Miller <djm@mindrot.org>
 Date: Tue, 11 Aug 2015 13:34:12 +1000
 Subject: set sshpam_ctxt to NULL after free
@@ -16,10 +16,10 @@ Patch-Name: backport-pam-use-after-free.patch
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/monitor.c b/monitor.c
-index 870a6b9..e8541b4 100644
+index 3fc9253..c063ad1 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -1225,14 +1225,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
+@@ -1209,14 +1209,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
  int
  mm_answer_pam_free_ctx(int sock, Buffer *m)
  {
diff --git a/debian/patches/backport-regress-principals-command-noexec.patch b/debian/patches/backport-regress-principals-command-noexec.patch
index b1622beb9..6b6649638 100644
--- a/debian/patches/backport-regress-principals-command-noexec.patch
+++ b/debian/patches/backport-regress-principals-command-noexec.patch
@@ -1,4 +1,4 @@
-From 48bcf47b091000fb3111b82385632d1401deb558 Mon Sep 17 00:00:00 2001
+From 11ff24a98751edfc86ef0eed102f840eaa50d4e1 Mon Sep 17 00:00:00 2001
 From: Damien Miller <djm@mindrot.org>
 Date: Mon, 10 Aug 2015 11:13:44 +1000
 Subject: let principals-command.sh work for noexec /var/run
diff --git a/debian/patches/consolekit.patch b/debian/patches/consolekit.patch
deleted file mode 100644
index ca29a70fb..000000000
--- a/debian/patches/consolekit.patch
+++ /dev/null
@@ -1,576 +0,0 @@
-From 2219c0ae6be6750432932833b69264a53e0496e4 Mon Sep 17 00:00:00 2001
-From: Colin Watson <cjwatson@ubuntu.com>
-Date: Sun, 9 Feb 2014 16:09:57 +0000
-Subject: Add support for registering ConsoleKit sessions on login
-
-Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1450
-Last-Updated: 2015-08-19
-
-Patch-Name: consolekit.patch
----
- Makefile.in    |   3 +-
- configure.ac   |  25 ++++++
- consolekit.c   | 241 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- consolekit.h   |  24 ++++++
- monitor.c      |  42 ++++++++++
- monitor.h      |   2 +
- monitor_wrap.c |  30 +++++++
- monitor_wrap.h |   4 +
- session.c      |  13 ++++
- session.h      |   6 ++
- 10 files changed, 389 insertions(+), 1 deletion(-)
- create mode 100644 consolekit.c
- create mode 100644 consolekit.h
-
-diff --git a/Makefile.in b/Makefile.in
-index 3d2a328..c406aec 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -111,7 +111,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
-        sftp-server.o sftp-common.o \
-        roaming_common.o roaming_serv.o \
-        sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
--       sandbox-seccomp-filter.o sandbox-capsicum.o
-+       sandbox-seccomp-filter.o sandbox-capsicum.o \
-+       consolekit.o
- 
- MANPAGES       = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
- MANPAGES_IN    = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
-diff --git a/configure.ac b/configure.ac
-index 4d55c46..cd6acaf 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -4188,6 +4188,30 @@ AC_ARG_WITH([kerberos5],
- AC_SUBST([GSSLIBS])
- AC_SUBST([K5LIBS])
- 
-+# Check whether user wants ConsoleKit support
-+CONSOLEKIT_MSG="no"
-+LIBCK_CONNECTOR=""
-+AC_ARG_WITH(consolekit,
-+       [  --with-consolekit       Enable ConsoleKit support],
-+       [ if test "x$withval" != "xno" ; then
-+               AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
-+               if test "$PKGCONFIG" != "no"; then
-+                       AC_MSG_CHECKING([for ck-connector])
-+                       if $PKGCONFIG --exists ck-connector; then
-+                               CKCON_CFLAGS=`$PKGCONFIG --cflags ck-connector`
-+                               CKCON_LIBS=`$PKGCONFIG --libs ck-connector`
-+                               CPPFLAGS="$CPPFLAGS $CKCON_CFLAGS"
-+                               SSHDLIBS="$SSHDLIBS $CKCON_LIBS"
-+                               AC_MSG_RESULT([yes])
-+                               AC_DEFINE(USE_CONSOLEKIT, 1, [Define if you want ConsoleKit support.])
-+                               CONSOLEKIT_MSG="yes"
-+                       else
-+                               AC_MSG_RESULT([no])
-+                       fi
-+               fi
-+       fi ]
-+)
-+
- # Looking for programs, paths and files
- 
- PRIVSEP_PATH=/var/empty
-@@ -4989,6 +5013,7 @@ echo "              MD5 password support: $MD5_MSG"
- echo "                   libedit support: $LIBEDIT_MSG"
- echo "  Solaris process contract support: $SPC_MSG"
- echo "           Solaris project support: $SP_MSG"
-+echo "                ConsoleKit support: $CONSOLEKIT_MSG"
- echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
- echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
- echo "                  BSD Auth support: $BSD_AUTH_MSG"
-diff --git a/consolekit.c b/consolekit.c
-new file mode 100644
-index 0000000..0266f06
---- /dev/null
-+++ b/consolekit.c
-@@ -0,0 +1,241 @@
-+/*
-+ * Copyright (c) 2008 Colin Watson.  All rights reserved.
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+/*
-+ * Loosely based on pam-ck-connector, which is:
-+ *
-+ * Copyright (c) 2007 David Zeuthen <davidz@redhat.com>
-+ *
-+ * Permission is hereby granted, free of charge, to any person
-+ * obtaining a copy of this software and associated documentation
-+ * files (the "Software"), to deal in the Software without
-+ * restriction, including without limitation the rights to use,
-+ * copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the
-+ * Software is furnished to do so, subject to the following
-+ * conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be
-+ * included in all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
-+ * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
-+ * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-+ * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
-+ * OTHER DEALINGS IN THE SOFTWARE.
-+ */
-+
-+#include "includes.h"
-+
-+#ifdef USE_CONSOLEKIT
-+
-+#include <ck-connector.h>
-+
-+#include "openbsd-compat/sys-queue.h"
-+#include "xmalloc.h"
-+#include "channels.h"
-+#include "key.h"
-+#include "hostfile.h"
-+#include "auth.h"
-+#include "log.h"
-+#include "misc.h"
-+#include "servconf.h"
-+#include "canohost.h"
-+#include "session.h"
-+#include "consolekit.h"
-+
-+extern ServerOptions options;
-+extern u_int utmp_len;
-+
-+void
-+set_active(const char *cookie)
-+{
-+       DBusError err;
-+       DBusConnection *connection;
-+       DBusMessage *message = NULL, *reply = NULL;
-+       char *sid;
-+       DBusMessageIter iter, subiter;
-+       const char *interface, *property;
-+       dbus_bool_t active;
-+
-+       dbus_error_init(&err);
-+       connection = dbus_bus_get_private(DBUS_BUS_SYSTEM, &err);
-+       if (!connection) {
-+               if (dbus_error_is_set(&err)) {
-+                       error("unable to open DBus connection: %s",
-+                           err.message);
-+                       dbus_error_free(&err);
-+               }
-+               goto out;
-+       }
-+       dbus_connection_set_exit_on_disconnect(connection, FALSE);
-+
-+       message = dbus_message_new_method_call("org.freedesktop.ConsoleKit",
-+           "/org/freedesktop/ConsoleKit/Manager",
-+           "org.freedesktop.ConsoleKit.Manager",
-+           "GetSessionForCookie");
-+       if (!message)
-+               goto out;
-+       if (!dbus_message_append_args(message, DBUS_TYPE_STRING, &cookie,
-+           DBUS_TYPE_INVALID)) {
-+               if (dbus_error_is_set(&err)) {
-+                       error("unable to get current session: %s",
-+                           err.message);
-+                       dbus_error_free(&err);
-+               }
-+               goto out;
-+       }
-+
-+       dbus_error_init(&err);
-+       reply = dbus_connection_send_with_reply_and_block(connection, message,
-+           -1, &err);
-+       if (!reply) {
-+               if (dbus_error_is_set(&err)) {
-+                       error("unable to get current session: %s",
-+                           err.message);
-+                       dbus_error_free(&err);
-+               }
-+               goto out;
-+       }
-+
-+       dbus_error_init(&err);
-+       if (!dbus_message_get_args(reply, &err,
-+           DBUS_TYPE_OBJECT_PATH, &sid,
-+           DBUS_TYPE_INVALID)) {
-+               if (dbus_error_is_set(&err)) {
-+                       error("unable to get current session: %s",
-+                           err.message);
-+                       dbus_error_free(&err);
-+               }
-+               goto out;
-+       }
-+       dbus_message_unref(reply);
-+       dbus_message_unref(message);
-+       message = reply = NULL;
-+
-+       message = dbus_message_new_method_call("org.freedesktop.ConsoleKit",
-+           sid, "org.freedesktop.DBus.Properties", "Set");
-+       if (!message)
-+               goto out;
-+       interface = "org.freedesktop.ConsoleKit.Session";
-+       property = "active";
-+       if (!dbus_message_append_args(message,
-+           DBUS_TYPE_STRING, &interface, DBUS_TYPE_STRING, &property,
-+           DBUS_TYPE_INVALID))
-+               goto out;
-+       dbus_message_iter_init_append(message, &iter);
-+       if (!dbus_message_iter_open_container(&iter, DBUS_TYPE_VARIANT,
-+           DBUS_TYPE_BOOLEAN_AS_STRING, &subiter))
-+               goto out;
-+       active = TRUE;
-+       if (!dbus_message_iter_append_basic(&subiter, DBUS_TYPE_BOOLEAN,
-+           &active))
-+               goto out;
-+       if (!dbus_message_iter_close_container(&iter, &subiter))
-+               goto out;
-+
-+       dbus_error_init(&err);
-+       reply = dbus_connection_send_with_reply_and_block(connection, message,
-+           -1, &err);
-+       if (!reply) {
-+               if (dbus_error_is_set(&err)) {
-+                       error("unable to make current session active: %s",
-+                           err.message);
-+                       dbus_error_free(&err);
-+               }
-+               goto out;
-+       }
-+
-+out:
-+       if (reply)
-+               dbus_message_unref(reply);
-+       if (message)
-+               dbus_message_unref(message);
-+}
-+
-+/*
-+ * We pass display separately rather than using s->display because the
-+ * latter is not available in the monitor when using privsep.
-+ */
-+
-+char *
-+consolekit_register(Session *s, const char *display)
-+{
-+       DBusError err;
-+       const char *tty = s->tty;
-+       const char *remote_host_name;
-+       dbus_bool_t is_local = FALSE;
-+       const char *cookie = NULL;
-+
-+       if (s->ckc) {
-+               debug("already registered with ConsoleKit");
-+               return xstrdup(ck_connector_get_cookie(s->ckc));
-+       }
-+
-+       s->ckc = ck_connector_new();
-+       if (!s->ckc) {
-+               error("ck_connector_new failed");
-+               return NULL;
-+       }
-+
-+       if (!tty)
-+               tty = "";
-+       if (!display)
-+               display = "";
-+       remote_host_name = get_remote_name_or_ip(utmp_len, options.use_dns);
-+       if (!remote_host_name)
-+               remote_host_name = "";
-+
-+       dbus_error_init(&err);
-+       if (!ck_connector_open_session_with_parameters(s->ckc, &err,
-+           "unix-user", &s->pw->pw_uid,
-+           "display-device", &tty,
-+           "x11-display", &display,
-+           "remote-host-name", &remote_host_name,
-+           "is-local", &is_local,
-+           NULL)) {
-+               if (dbus_error_is_set(&err)) {
-+                       debug("%s", err.message);
-+                       dbus_error_free(&err);
-+               } else {
-+                       debug("insufficient privileges or D-Bus / ConsoleKit "
-+                           "not available");
-+               }
-+               return NULL;
-+       }
-+
-+       debug("registered uid=%d on tty='%s' with ConsoleKit",
-+           s->pw->pw_uid, s->tty);
-+
-+       cookie = ck_connector_get_cookie(s->ckc);
-+       set_active(cookie);
-+       return xstrdup(cookie);
-+}
-+
-+void
-+consolekit_unregister(Session *s)
-+{
-+       if (s->ckc) {
-+               debug("unregistering ConsoleKit session %s",
-+                   ck_connector_get_cookie(s->ckc));
-+               ck_connector_unref(s->ckc);
-+               s->ckc = NULL;
-+       }
-+}
-+
-+#endif /* USE_CONSOLEKIT */
-diff --git a/consolekit.h b/consolekit.h
-new file mode 100644
-index 0000000..8ce3716
---- /dev/null
-+++ b/consolekit.h
-@@ -0,0 +1,24 @@
-+/*
-+ * Copyright (c) 2008 Colin Watson.  All rights reserved.
-+ *
-+ * Permission to use, copy, modify, and distribute this software for any
-+ * purpose with or without fee is hereby granted, provided that the above
-+ * copyright notice and this permission notice appear in all copies.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-+ */
-+
-+#ifdef USE_CONSOLEKIT
-+
-+struct Session;
-+
-+char *  consolekit_register(struct Session *, const char *);
-+void    consolekit_unregister(struct Session *);
-+
-+#endif /* USE_CONSOLEKIT */
-diff --git a/monitor.c b/monitor.c
-index 3a3d2f0..12ed6fd 100644
---- a/monitor.c
-+++ b/monitor.c
-@@ -104,6 +104,9 @@
- #include "authfd.h"
- #include "match.h"
- #include "ssherr.h"
-+#ifdef USE_CONSOLEKIT
-+#include "consolekit.h"
-+#endif
- 
- #ifdef GSSAPI
- static Gssctxt *gsscontext = NULL;
-@@ -169,6 +172,10 @@ int mm_answer_audit_command(int, Buffer *);
- 
- static int monitor_read_log(struct monitor *);
- 
-+#ifdef USE_CONSOLEKIT
-+int mm_answer_consolekit_register(int, Buffer *);
-+#endif
-+
- static Authctxt *authctxt;
- 
- #ifdef WITH_SSH1
-@@ -261,6 +268,9 @@ struct mon_table mon_dispatch_postauth20[] = {
-     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
-     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
- #endif
-+#ifdef USE_CONSOLEKIT
-+    {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register},
-+#endif
-     {0, 0, NULL}
- };
- 
-@@ -306,6 +316,9 @@ struct mon_table mon_dispatch_postauth15[] = {
-     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
-     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
- #endif
-+#ifdef USE_CONSOLEKIT
-+    {MONITOR_REQ_CONSOLEKIT_REGISTER, 0, mm_answer_consolekit_register},
-+#endif
- #endif /* WITH_SSH1 */
-     {0, 0, NULL}
- };
-@@ -488,6 +501,9 @@ monitor_child_postauth(struct monitor *pmonitor)
-                monitor_permit(mon_dispatch, MONITOR_REQ_PTY, 1);
-                monitor_permit(mon_dispatch, MONITOR_REQ_PTYCLEANUP, 1);
-        }
-+#ifdef USE_CONSOLEKIT
-+       monitor_permit(mon_dispatch, MONITOR_REQ_CONSOLEKIT_REGISTER, 1);
-+#endif
- 
-        for (;;)
-                monitor_read(pmonitor, mon_dispatch, NULL);
-@@ -2191,3 +2207,29 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) {
- 
- #endif /* GSSAPI */
- 
-+#ifdef USE_CONSOLEKIT
-+int
-+mm_answer_consolekit_register(int sock, Buffer *m)
-+{
-+       Session *s;
-+       char *tty, *display;
-+       char *cookie = NULL;
-+
-+       debug3("%s entering", __func__);
-+
-+       tty = buffer_get_string(m, NULL);
-+       display = buffer_get_string(m, NULL);
-+       s = session_by_tty(tty);
-+       if (s != NULL)
-+               cookie = consolekit_register(s, display);
-+       buffer_clear(m);
-+       buffer_put_cstring(m, cookie != NULL ? cookie : "");
-+       mm_request_send(sock, MONITOR_ANS_CONSOLEKIT_REGISTER, m);
-+
-+       free(cookie);
-+       free(display);
-+       free(tty);
-+
-+       return (0);
-+}
-+#endif /* USE_CONSOLEKIT */
-diff --git a/monitor.h b/monitor.h
-index 2d82b8b..fd8d92c 100644
---- a/monitor.h
-+++ b/monitor.h
-@@ -70,6 +70,8 @@ enum monitor_reqtype {
- 
-        MONITOR_REQ_AUTHROLE = 154,
- 
-+       MONITOR_REQ_CONSOLEKIT_REGISTER = 156, MONITOR_ANS_CONSOLEKIT_REGISTER = 157,
-+
- };
- 
- struct mm_master;
-diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 6ae72a0..2a0fe9b 100644
---- a/monitor_wrap.c
-+++ b/monitor_wrap.c
-@@ -1151,3 +1151,33 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
- 
- #endif /* GSSAPI */
- 
-+#ifdef USE_CONSOLEKIT
-+char *
-+mm_consolekit_register(Session *s, const char *display)
-+{
-+       Buffer m;
-+       char *cookie;
-+
-+       debug3("%s entering", __func__);
-+
-+       if (s->ttyfd == -1)
-+               return NULL;
-+       buffer_init(&m);
-+       buffer_put_cstring(&m, s->tty);
-+       buffer_put_cstring(&m, display != NULL ? display : "");
-+       mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_CONSOLEKIT_REGISTER, &m);
-+       buffer_clear(&m);
-+
-+       mm_request_receive_expect(pmonitor->m_recvfd,
-+           MONITOR_ANS_CONSOLEKIT_REGISTER, &m);
-+       cookie = buffer_get_string(&m, NULL);
-+       buffer_free(&m);
-+
-+       /* treat empty cookie as missing cookie */
-+       if (strlen(cookie) == 0) {
-+               free(cookie);
-+               cookie = NULL;
-+       }
-+       return (cookie);
-+}
-+#endif /* USE_CONSOLEKIT */
-diff --git a/monitor_wrap.h b/monitor_wrap.h
-index 57e740f..6829392 100644
---- a/monitor_wrap.h
-+++ b/monitor_wrap.h
-@@ -108,4 +108,8 @@ int mm_skey_respond(void *, u_int, char **);
- /* zlib allocation hooks */
- void mm_init_compression(struct mm_master *);
- 
-+#ifdef USE_CONSOLEKIT
-+char *mm_consolekit_register(struct Session *, const char *);
-+#endif /* USE_CONSOLEKIT */
-+
- #endif /* _MM_WRAP_H_ */
-diff --git a/session.c b/session.c
-index afac4a5..c6bd728 100644
---- a/session.c
-+++ b/session.c
-@@ -94,6 +94,7 @@
- #include "kex.h"
- #include "monitor_wrap.h"
- #include "sftp.h"
-+#include "consolekit.h"
- 
- #if defined(KRB5) && defined(USE_AFS)
- #include <kafs.h>
-@@ -1144,6 +1145,9 @@ do_setup_env(Session *s, const char *shell)
- #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
-        char *path = NULL;
- #endif
-+#ifdef USE_CONSOLEKIT
-+       const char *ckcookie = NULL;
-+#endif /* USE_CONSOLEKIT */
- 
-        /* Initialize the environment. */
-        envsize = 100;
-@@ -1288,6 +1292,11 @@ do_setup_env(Session *s, const char *shell)
-                child_set_env(&env, &envsize, "KRB5CCNAME",
-                    s->authctxt->krb5_ccname);
- #endif
-+#ifdef USE_CONSOLEKIT
-+       ckcookie = PRIVSEP(consolekit_register(s, s->display));
-+       if (ckcookie)
-+               child_set_env(&env, &envsize, "XDG_SESSION_COOKIE", ckcookie);
-+#endif /* USE_CONSOLEKIT */
- #ifdef USE_PAM
-        /*
-         * Pull in any environment variables that may have
-@@ -2351,6 +2360,10 @@ session_pty_cleanup2(Session *s)
- 
-        debug("session_pty_cleanup: session %d release %s", s->self, s->tty);
- 
-+#ifdef USE_CONSOLEKIT
-+       consolekit_unregister(s);
-+#endif /* USE_CONSOLEKIT */
-+
-        /* Record that the user has logged out. */
-        if (s->pid != 0)
-                record_logout(s->pid, s->tty, s->pw->pw_name);
-diff --git a/session.h b/session.h
-index ef6593c..a6b6983 100644
---- a/session.h
-+++ b/session.h
-@@ -26,6 +26,8 @@
- #ifndef SESSION_H
- #define SESSION_H
- 
-+struct _CkConnector;
-+
- #define TTYSZ 64
- typedef struct Session Session;
- struct Session {
-@@ -61,6 +63,10 @@ struct Session {
-                char    *name;
-                char    *val;
-        } *env;
-+
-+#ifdef USE_CONSOLEKIT
-+       struct _CkConnector *ckc;
-+#endif /* USE_CONSOLEKIT */
- };
- 
- void    do_authenticated(Authctxt *);
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 36d84652d..cbbe6b790 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -1,4 +1,4 @@
-From 79b8c11f2b7a8258dee45e8f10ee58d0f4e48340 Mon Sep 17 00:00:00 2001
+From 692e965f7be2a33a6fecc392a2cb8023977f9c31 Mon Sep 17 00:00:00 2001
 From: Kees Cook <kees@debian.org>
 Date: Sun, 9 Feb 2014 16:10:06 +0000
 Subject: Add DebianBanner server configuration option
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 5c0edd160..dd33c00a6 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -1,4 +1,4 @@
-From be3c323d998ebf49c589bfd887dbb8aa6c68634c Mon Sep 17 00:00:00 2001
+From 0cce5c4c1de33c4172ce8ebc0f93e717995779f8 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:18 +0000
 Subject: Various Debian-specific configuration changes
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index 031bc67e0..60a12c72f 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -1,4 +1,4 @@
-From 0b7d8f80872624024fad8132ffc3b0d0c1ba7224 Mon Sep 17 00:00:00 2001
+From 840c980f0a68a101c3aa1e884724ceff37e8e147 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:01 +0000
 Subject: Force use of DNSSEC even if "options edns0" isn't in resolv.conf
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 77a9989e6..259560a0d 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -1,4 +1,4 @@
-From 3f06b9397f342cb59dd5d1d045d0f663aca848f6 Mon Sep 17 00:00:00 2001
+From e2a36dcb275a675203f22467863cce90829a64b7 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:11 +0000
 Subject: Document that HashKnownHosts may break tab-completion
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index 6eff1ce58..96c76a651 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -1,4 +1,4 @@
-From 0ea95f75af043685c707b6626a1e7e50947c72a5 Mon Sep 17 00:00:00 2001
+From c239fee2fa5aae0a6e3086330562241bd9330bca Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:12 +0000
 Subject: Refer to ssh's Upstart job as well as its init script
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index 2c924b7a9..609706831 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -1,4 +1,4 @@
-From 44b9b2e319659c452bad24f3bfcd5a1f7df951c9 Mon Sep 17 00:00:00 2001
+From 9a1c2558e40d504443830442c42f5a6e46f31ed0 Mon Sep 17 00:00:00 2001
 From: Vincent Untz <vuntz@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:16 +0000
 Subject: Give the ssh-askpass-gnome window a default icon
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index dcdf3d753..3f14a6470 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -1,4 +1,4 @@
-From 927f8421a046c30addfb0befb20a6c63fb9dc861 Mon Sep 17 00:00:00 2001
+From 506df046bb56e8d10d95d8cb3912f1462b7c4695 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:08 +0000
 Subject: Fix picky lintian errors about slogin symlinks
@@ -15,10 +15,10 @@ Patch-Name: lintian-symlink-pickiness.patch
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/Makefile.in b/Makefile.in
-index 37cb023..f52f903 100644
+index 915c740..e161d0e 100644
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -331,9 +331,9 @@ install-files:
+@@ -330,9 +330,9 @@ install-files:
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         -rm -f $(DESTDIR)$(bindir)/slogin
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index 8a7a22fd7..d3da72de0 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -1,4 +1,4 @@
-From 544fd142bcda578b49e0c264ce21a2f1eff39b3d Mon Sep 17 00:00:00 2001
+From 7fed650902de773980b1de83cec3c4cf6bb282da Mon Sep 17 00:00:00 2001
 From: Scott Moser <smoser@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:10:03 +0000
 Subject: Mention ssh-keygen in ssh fingerprint changed warning
diff --git a/debian/patches/no-openssl-version-status.patch b/debian/patches/no-openssl-version-status.patch
index a80f129e1..fd2686f65 100644
--- a/debian/patches/no-openssl-version-status.patch
+++ b/debian/patches/no-openssl-version-status.patch
@@ -1,4 +1,4 @@
-From a134809ff96caefb81c08678c0694996adf1fa9e Mon Sep 17 00:00:00 2001
+From 64a33173d97a03b4d53380206d166716df25591a Mon Sep 17 00:00:00 2001
 From: Kurt Roeckx <kurt@roeckx.be>
 Date: Sun, 9 Feb 2014 16:10:14 +0000
 Subject: Don't check the status field of the OpenSSL version
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 571643bda..8c681b9b0 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -1,4 +1,4 @@
-From 80eba814e1ac7fe21a79a610998dbecb91237cee Mon Sep 17 00:00:00 2001
+From 96ecf95406b8599528e60ccfc5b32b543f74ddc4 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:09 +0000
 Subject: Adjust various OpenBSD-specific references in manual pages
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index dd262241c..ddec0ec63 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -1,4 +1,4 @@
-From 6de10ec1ff53c5b52621244b66cae91df3901fa2 Mon Sep 17 00:00:00 2001
+From 2c39fe957130704a00871229c53116db4a25e0c3 Mon Sep 17 00:00:00 2001
 From: Matthew Vernon <matthew@debian.org>
 Date: Sun, 9 Feb 2014 16:10:05 +0000
 Subject: Include the Debian version in our identification
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index 24e3b4517..04ba23411 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -1,4 +1,4 @@
-From 286127a1eb1be61084bc7907f8862470a140739b Mon Sep 17 00:00:00 2001
+From 3ed0b40149ad6ae1bae649d64e69614b8520cd84 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Nicolas=20Valc=C3=A1rcel?= <nvalcarcel@ubuntu.com>
 Date: Sun, 9 Feb 2014 16:09:59 +0000
 Subject: Adjust scp quoting in verbose mode
diff --git a/debian/patches/series b/debian/patches/series
index 15c939708..b6538a45a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,7 +7,6 @@ keepalive-extensions.patch
 syslog-level-silent.patch
 quieter-signals.patch
 helpful-wait-terminate.patch
-consolekit.patch
 user-group-modes.patch
 scp-quoting.patch
 shell-path.patch
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 12d23f2e6..2c8c17bca 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -1,4 +1,4 @@
-From d36b4a740c176eb7b63d0eb3eca2faf485d4ef99 Mon Sep 17 00:00:00 2001
+From 120a9e949da169bd8672f58a66160730c2763db6 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:00 +0000
 Subject: Look for $SHELL on the path for ProxyCommand/LocalCommand
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index d79970cb8..f568ebf3d 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -1,4 +1,4 @@
-From e331e402ea0ab5d2333cc91f1724425d961ca293 Mon Sep 17 00:00:00 2001
+From 18a9869659a7e7f3bde44fa2d26599844baece2c Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:17 +0000
 Subject: Support synchronisation with service supervisor using SIGSTOP
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index d9fcb7727..4c5d39dc1 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -1,4 +1,4 @@
-From 13cdd61591b754d225df765ac8a3982d7de894b7 Mon Sep 17 00:00:00 2001
+From 751acd3741de0e2ae2dbd32cc5970981cb6382da Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:13 +0000
 Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index 46a89a787..174d321df 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -1,4 +1,4 @@
-From 791a058fc28e6ca7b75c80e4f20f4d7e567aa557 Mon Sep 17 00:00:00 2001
+From eb8700714181bd9e84a110edfd5978a932622aa0 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:10:10 +0000
 Subject: ssh(1): Refer to ssh-argv0(1)
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index cd6155d6a..b43b0c9bb 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -1,4 +1,4 @@
-From 8c6ce36545711e987fcab76a11f2110fdf9a7c8a Mon Sep 17 00:00:00 2001
+From 113450cad7a19b997e51945f012539836bba6f17 Mon Sep 17 00:00:00 2001
 From: Colin Watson <cjwatson@debian.org>
 Date: Sun, 9 Feb 2014 16:09:58 +0000
 Subject: Allow harmless group-writability