9 files changed, 32 insertions, 24 deletions

diff --git a/debian/changelog b/debian/changelog
index 15a6958ad..6c59cebed 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openssh (1:7.4p1-10) UNRELEASED; urgency=medium
+
+  * Move privilege separation directory and PID file from /var/run/ to /run/
+    (closes: #760422, #856825).
+
+ -- Colin Watson <cjwatson@debian.org>  Wed, 29 Mar 2017 23:44:13 +0100
+
 openssh (1:7.4p1-9) unstable; urgency=medium
 
   * Fix null pointer dereference in ssh-keygen; this fixes an autopkgtest
diff --git a/debian/openssh-server-udeb.dirs b/debian/openssh-server-udeb.dirs
index 2ce0d81d6..e730fc43d 100644
--- a/debian/openssh-server-udeb.dirs
+++ b/debian/openssh-server-udeb.dirs
@@ -1 +1 @@
-var/run/sshd
+run/sshd
diff --git a/debian/openssh-server.if-up b/debian/openssh-server.if-up
index 915284cc6..525c2153b 100644
--- a/debian/openssh-server.if-up
+++ b/debian/openssh-server.if-up
@@ -25,8 +25,8 @@ if [ ! -e /usr/sbin/sshd ]; then
         exit 0
 fi
 
-if [ ! -f /var/run/sshd.pid ] || \
-   [ "$(ps -p "$(cat /var/run/sshd.pid)" -o comm=)" != sshd ]; then
+if [ ! -f /run/sshd.pid ] || \
+   [ "$(ps -p "$(cat /run/sshd.pid)" -o comm=)" != sshd ]; then
         exit 0
 fi
 
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 90d346674..f0ebe48b8 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -111,7 +111,7 @@ fix_statoverride() {
 
 setup_sshd_user() {
         if ! getent passwd sshd >/dev/null; then
-                adduser --quiet --system --no-create-home --home /var/run/sshd --shell /usr/sbin/nologin sshd
+                adduser --quiet --system --no-create-home --home /run/sshd --shell /usr/sbin/nologin sshd
         fi
 }
 
@@ -125,14 +125,14 @@ if [ "$action" = configure ]; then
             rm -f /etc/ssh/primes
         fi
         if dpkg --compare-versions "$2" lt-nl 1:5.5p1-6; then
-            rm -f /var/run/sshd/.placeholder
+            rm -f /run/sshd/.placeholder
         fi
         if dpkg --compare-versions "$2" lt-nl 1:6.2p2-3 && \
            which initctl >/dev/null && initctl version 2>/dev/null | grep -q upstart && \
            ! status ssh 2>/dev/null | grep -q ' start/'; then
             # We must stop the sysvinit-controlled sshd before we can
             # restart it under Upstart.
-            start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid || true
+            start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid || true
         fi
         if dpkg --compare-versions "$2" lt-nl 1:6.5p1-2 && \
            deb-systemd-helper debian-installed ssh.socket && \
@@ -146,7 +146,7 @@ if [ "$action" = configure ]; then
            [ -d /run/systemd/system ]; then
             # We must stop the sysvinit-controlled sshd before we can
             # restart it under systemd.
-            start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd || true
+            start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd || true
         fi
 fi
 
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst
index 9fb5d350e..f5b75124e 100644
--- a/debian/openssh-server.preinst
+++ b/debian/openssh-server.preinst
@@ -7,9 +7,9 @@ version=$2
 if [ "$action" = upgrade ] || [ "$action" = install ]
 then
   if dpkg --compare-versions "$version" lt 1:5.5p1-6 && \
-     [ -d /var/run/sshd ]; then
-    # make sure /var/run/sshd is not removed on upgrades
-    touch /var/run/sshd/.placeholder
+     [ -d /run/sshd ]; then
+    # make sure /run/sshd is not removed on upgrades
+    touch /run/sshd/.placeholder
   fi
 fi
 
diff --git a/debian/openssh-server.ssh.init b/debian/openssh-server.ssh.init
index bda7a92b8..70a6c38f2 100644
--- a/debian/openssh-server.ssh.init
+++ b/debian/openssh-server.ssh.init
@@ -66,9 +66,9 @@ check_dev_null() {
 
 check_privsep_dir() {
     # Create the PrivSep empty dir if necessary
-    if [ ! -d /var/run/sshd ]; then
-        mkdir /var/run/sshd
-        chmod 0755 /var/run/sshd
+    if [ ! -d /run/sshd ]; then
+        mkdir /run/sshd
+        chmod 0755 /run/sshd
     fi
 }
 
@@ -87,7 +87,7 @@ case "$1" in
         check_for_no_start
         check_dev_null
         log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true
-        if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+        if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
             log_end_msg 0 || true
         else
             log_end_msg 1 || true
@@ -96,7 +96,7 @@ case "$1" in
   stop)
         check_for_upstart 0
         log_daemon_msg "Stopping OpenBSD Secure Shell server" "sshd" || true
-        if start-stop-daemon --stop --quiet --oknodo --pidfile /var/run/sshd.pid; then
+        if start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid; then
             log_end_msg 0 || true
         else
             log_end_msg 1 || true
@@ -108,7 +108,7 @@ case "$1" in
         check_for_no_start
         check_config
         log_daemon_msg "Reloading OpenBSD Secure Shell server's configuration" "sshd" || true
-        if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd; then
+        if start-stop-daemon --stop --signal 1 --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd; then
             log_end_msg 0 || true
         else
             log_end_msg 1 || true
@@ -120,10 +120,10 @@ case "$1" in
         check_privsep_dir
         check_config
         log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true
-        start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /var/run/sshd.pid
+        start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /run/sshd.pid
         check_for_no_start log_end_msg
         check_dev_null log_end_msg
-        if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+        if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
             log_end_msg 0 || true
         else
             log_end_msg 1 || true
@@ -136,13 +136,13 @@ case "$1" in
         check_config
         log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true
         RET=0
-        start-stop-daemon --stop --quiet --retry 30 --pidfile /var/run/sshd.pid || RET="$?"
+        start-stop-daemon --stop --quiet --retry 30 --pidfile /run/sshd.pid || RET="$?"
         case $RET in
             0)
                 # old daemon stopped
                 check_for_no_start log_end_msg
                 check_dev_null log_end_msg
-                if start-stop-daemon --start --quiet --oknodo --pidfile /var/run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
+                if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then
                     log_end_msg 0 || true
                 else
                     log_end_msg 1 || true
@@ -163,7 +163,7 @@ case "$1" in
 
   status)
         check_for_upstart 1
-        status_of_proc -p /var/run/sshd.pid /usr/sbin/sshd sshd && exit 0 || exit $?
+        status_of_proc -p /run/sshd.pid /usr/sbin/sshd sshd && exit 0 || exit $?
         ;;
 
   *)
diff --git a/debian/openssh-server.ssh.upstart b/debian/openssh-server.ssh.upstart
index b34cbff5d..9b0e95450 100644
--- a/debian/openssh-server.ssh.upstart
+++ b/debian/openssh-server.ssh.upstart
@@ -21,7 +21,7 @@ pre-start script
     test -x /usr/sbin/sshd || { stop; exit 0; }
     test -e /etc/ssh/sshd_not_to_be_run && { stop; exit 0; }
 
-    mkdir -p -m0755 /var/run/sshd
+    mkdir -p -m0755 /run/sshd
 end script
 
 # if you used to set SSHD_OPTS in /etc/default/ssh, you can change the
diff --git a/debian/rules b/debian/rules
index 6b3b335b4..c1aa9785c 100755
--- a/debian/rules
+++ b/debian/rules
@@ -68,7 +68,8 @@ confflags += --libexecdir=\$${prefix}/lib/openssh
 confflags += --disable-strip
 confflags += --with-mantype=doc
 confflags += --with-4in6
-confflags += --with-privsep-path=/var/run/sshd
+confflags += --with-privsep-path=/run/sshd
+confflags += --with-pid-dir=/run
 
 # The Hurd needs libcrypt for res_query et al.
 ifeq ($(DEB_HOST_ARCH_OS),hurd)
diff --git a/debian/systemd/sshd.conf b/debian/systemd/sshd.conf
index ab7302189..4fbeba1e8 100644
--- a/debian/systemd/sshd.conf
+++ b/debian/systemd/sshd.conf
@@ -1 +1 @@
-d /var/run/sshd 0755 root root
+d /run/sshd 0755 root root