diff options
| author | mestre@openbsd.org <mestre@openbsd.org> | 2019-07-24 08:57:00 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-07-30 15:06:27 +1000 |
| commit | 7adf6c430d6fc17901e167bc0789d31638f5c2f8 (patch) | |
| tree | e2895200df684948968c4119eddf1b0f7c71e2e3 /verify.c | |
| parent | 0e2fe18acc1da853a9120c2e9af68e8d05e6503e (diff) | |
upstream: When using a combination of a Yubikey+GnuPG+remote
forwarding the gpg-agent (and options ControlMaster+RemoteForward in
ssh_config(5)) then the codepath taken will call mux_client_request_session
-> mm_send_fd -> sendmsg(2). Since sendmsg(2) is not allowed in that codepath
then pledge(2) kills the process.
The solution is to add "sendfd" to pledge(2), which is not too bad considering
a little bit later we reduce pledge(2) to only "stdio proc tty" in that
codepath.
Problem reported and diff provided by Timothy Brown <tbrown at freeshell.org>
OK deraadt@
OpenBSD-Commit-ID: 7ce38b6542bbec00e441595d0a178e970a9472ac
Diffstat (limited to 'verify.c')
0 files changed, 0 insertions, 0 deletions