diff options
author | Colin Watson <cjwatson@debian.org> | 2014-10-07 12:13:50 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2014-10-07 12:13:50 +0100 |
commit | 487bdb3a5ef6075887b830ccb8a0b14f6da78e93 (patch) | |
tree | a2cff6fec1e6c4b4153a170a3e172cfe6bfdec46 /sftp-server.c | |
parent | 796ba4fd011b5d0d9d78d592ba2f30fc9d5ed2e7 (diff) | |
parent | 28453d58058a4d60c3ebe7d7f0c31a510cbf6158 (diff) |
Import openssh_6.7p1.orig.tar.gz
Diffstat (limited to 'sftp-server.c')
-rw-r--r-- | sftp-server.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sftp-server.c b/sftp-server.c index b8eb59c36..0177130cf 100644 --- a/sftp-server.c +++ b/sftp-server.c | |||
@@ -29,6 +29,9 @@ | |||
29 | #ifdef HAVE_SYS_STATVFS_H | 29 | #ifdef HAVE_SYS_STATVFS_H |
30 | #include <sys/statvfs.h> | 30 | #include <sys/statvfs.h> |
31 | #endif | 31 | #endif |
32 | #ifdef HAVE_SYS_PRCTL_H | ||
33 | #include <sys/prctl.h> | ||
34 | #endif | ||
32 | 35 | ||
33 | #include <dirent.h> | 36 | #include <dirent.h> |
34 | #include <errno.h> | 37 | #include <errno.h> |
@@ -1523,6 +1526,17 @@ sftp_server_main(int argc, char **argv, struct passwd *user_pw) | |||
1523 | 1526 | ||
1524 | log_init(__progname, log_level, log_facility, log_stderr); | 1527 | log_init(__progname, log_level, log_facility, log_stderr); |
1525 | 1528 | ||
1529 | #if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE) | ||
1530 | /* | ||
1531 | * On Linux, we should try to avoid making /proc/self/{mem,maps} | ||
1532 | * available to the user so that sftp access doesn't automatically | ||
1533 | * imply arbitrary code execution access that will break | ||
1534 | * restricted configurations. | ||
1535 | */ | ||
1536 | if (prctl(PR_SET_DUMPABLE, 0) != 0) | ||
1537 | fatal("unable to make the process undumpable"); | ||
1538 | #endif /* defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE) */ | ||
1539 | |||
1526 | if ((cp = getenv("SSH_CONNECTION")) != NULL) { | 1540 | if ((cp = getenv("SSH_CONNECTION")) != NULL) { |
1527 | client_addr = xstrdup(cp); | 1541 | client_addr = xstrdup(cp); |
1528 | if ((cp = strchr(client_addr, ' ')) == NULL) { | 1542 | if ((cp = strchr(client_addr, ' ')) == NULL) { |