summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog4
-rw-r--r--log.c35
-rw-r--r--log.h8
-rw-r--r--monitor.c128
-rw-r--r--monitor.h4
-rw-r--r--monitor_wrap.c28
-rw-r--r--monitor_wrap.h3
-rw-r--r--sshd.c13
8 files changed, 197 insertions, 26 deletions
diff --git a/ChangeLog b/ChangeLog
index 5dae2a859..d41208092 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,10 @@
9 make sure key_parse_public/private_rsa1() no longer consumes its input 9 make sure key_parse_public/private_rsa1() no longer consumes its input
10 buffer. fixes ssh-add for passphrase-protected ssh1-keys; 10 buffer. fixes ssh-add for passphrase-protected ssh1-keys;
11 noted by naddy@; ok djm@ 11 noted by naddy@; ok djm@
12 - djm@cvs.openbsd.org 2011/06/17 21:44:31
13 [log.c log.h monitor.c monitor.h monitor_wrap.c monitor_wrap.h sshd.c]
14 make the pre-auth privsep slave log via a socketpair shared with the
15 monitor rather than /var/empty/dev/log; ok dtucker@ deraadt@ markus@
12 16
1320110603 1720110603
14 - (dtucker) [README version.h contrib/caldera/openssh.spec 18 - (dtucker) [README version.h contrib/caldera/openssh.spec
diff --git a/log.c b/log.c
index 4a8239b93..ad5a10b47 100644
--- a/log.c
+++ b/log.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: log.c,v 1.41 2008/06/10 04:50:25 dtucker Exp $ */ 1/* $OpenBSD: log.c,v 1.42 2011/06/17 21:44:30 djm Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -56,6 +56,8 @@ static LogLevel log_level = SYSLOG_LEVEL_INFO;
56static int log_on_stderr = 1; 56static int log_on_stderr = 1;
57static int log_facility = LOG_AUTH; 57static int log_facility = LOG_AUTH;
58static char *argv0; 58static char *argv0;
59static log_handler_fn *log_handler;
60static void *log_handler_ctx;
59 61
60extern char *__progname; 62extern char *__progname;
61 63
@@ -260,6 +262,9 @@ log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
260 exit(1); 262 exit(1);
261 } 263 }
262 264
265 log_handler = NULL;
266 log_handler_ctx = NULL;
267
263 log_on_stderr = on_stderr; 268 log_on_stderr = on_stderr;
264 if (on_stderr) 269 if (on_stderr)
265 return; 270 return;
@@ -327,6 +332,23 @@ log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
327#define MSGBUFSIZ 1024 332#define MSGBUFSIZ 1024
328 333
329void 334void
335set_log_handler(log_handler_fn *handler, void *ctx)
336{
337 log_handler = handler;
338 log_handler_ctx = ctx;
339}
340
341void
342do_log2(LogLevel level, const char *fmt,...)
343{
344 va_list args;
345
346 va_start(args, fmt);
347 do_log(level, fmt, args);
348 va_end(args);
349}
350
351void
330do_log(LogLevel level, const char *fmt, va_list args) 352do_log(LogLevel level, const char *fmt, va_list args)
331{ 353{
332#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) 354#if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
@@ -337,6 +359,7 @@ do_log(LogLevel level, const char *fmt, va_list args)
337 char *txt = NULL; 359 char *txt = NULL;
338 int pri = LOG_INFO; 360 int pri = LOG_INFO;
339 int saved_errno = errno; 361 int saved_errno = errno;
362 log_handler_fn *tmp_handler;
340 363
341 if (level > log_level) 364 if (level > log_level)
342 return; 365 return;
@@ -375,7 +398,7 @@ do_log(LogLevel level, const char *fmt, va_list args)
375 pri = LOG_ERR; 398 pri = LOG_ERR;
376 break; 399 break;
377 } 400 }
378 if (txt != NULL) { 401 if (txt != NULL && log_handler == NULL) {
379 snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt); 402 snprintf(fmtbuf, sizeof(fmtbuf), "%s: %s", txt, fmt);
380 vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args); 403 vsnprintf(msgbuf, sizeof(msgbuf), fmtbuf, args);
381 } else { 404 } else {
@@ -383,7 +406,13 @@ do_log(LogLevel level, const char *fmt, va_list args)
383 } 406 }
384 strnvis(fmtbuf, msgbuf, sizeof(fmtbuf), 407 strnvis(fmtbuf, msgbuf, sizeof(fmtbuf),
385 log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS); 408 log_on_stderr ? LOG_STDERR_VIS : LOG_SYSLOG_VIS);
386 if (log_on_stderr) { 409 if (log_handler != NULL) {
410 /* Avoid recursion */
411 tmp_handler = log_handler;
412 log_handler = NULL;
413 tmp_handler(level, fmtbuf, log_handler_ctx);
414 log_handler = tmp_handler;
415 } else if (log_on_stderr) {
387 snprintf(msgbuf, sizeof msgbuf, "%s\r\n", fmtbuf); 416 snprintf(msgbuf, sizeof msgbuf, "%s\r\n", fmtbuf);
388 write(STDERR_FILENO, msgbuf, strlen(msgbuf)); 417 write(STDERR_FILENO, msgbuf, strlen(msgbuf));
389 } else { 418 } else {
diff --git a/log.h b/log.h
index 650582791..1b8d2142b 100644
--- a/log.h
+++ b/log.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: log.h,v 1.17 2008/06/13 00:12:02 dtucker Exp $ */ 1/* $OpenBSD: log.h,v 1.18 2011/06/17 21:44:30 djm Exp $ */
2 2
3/* 3/*
4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -46,6 +46,8 @@ typedef enum {
46 SYSLOG_LEVEL_NOT_SET = -1 46 SYSLOG_LEVEL_NOT_SET = -1
47} LogLevel; 47} LogLevel;
48 48
49typedef void (log_handler_fn)(LogLevel, const char *, void *);
50
49void log_init(char *, LogLevel, SyslogFacility, int); 51void log_init(char *, LogLevel, SyslogFacility, int);
50 52
51SyslogFacility log_facility_number(char *); 53SyslogFacility log_facility_number(char *);
@@ -64,6 +66,10 @@ void debug(const char *, ...) __attribute__((format(printf, 1, 2)));
64void debug2(const char *, ...) __attribute__((format(printf, 1, 2))); 66void debug2(const char *, ...) __attribute__((format(printf, 1, 2)));
65void debug3(const char *, ...) __attribute__((format(printf, 1, 2))); 67void debug3(const char *, ...) __attribute__((format(printf, 1, 2)));
66 68
69
70void set_log_handler(log_handler_fn *, void *);
71void do_log2(LogLevel, const char *, ...)
72 __attribute__((format(printf, 2, 3)));
67void do_log(LogLevel, const char *, va_list); 73void do_log(LogLevel, const char *, va_list);
68void cleanup_exit(int) __attribute__((noreturn)); 74void cleanup_exit(int) __attribute__((noreturn));
69#endif 75#endif
diff --git a/monitor.c b/monitor.c
index 2c9254182..bb8003c67 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: monitor.c,v 1.113 2011/05/23 03:30:07 djm Exp $ */ 1/* $OpenBSD: monitor.c,v 1.114 2011/06/17 21:44:30 djm Exp $ */
2/* 2/*
3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
4 * Copyright 2002 Markus Friedl <markus@openbsd.org> 4 * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -44,6 +44,13 @@
44#include <stdlib.h> 44#include <stdlib.h>
45#include <string.h> 45#include <string.h>
46#include <unistd.h> 46#include <unistd.h>
47#ifdef HAVE_POLL_H
48#include <poll.h>
49#else
50# ifdef HAVE_SYS_POLL_H
51# include <sys/poll.h>
52# endif
53#endif
47 54
48#ifdef SKEY 55#ifdef SKEY
49#include <skey.h> 56#include <skey.h>
@@ -52,6 +59,7 @@
52#include <openssl/dh.h> 59#include <openssl/dh.h>
53 60
54#include "openbsd-compat/sys-queue.h" 61#include "openbsd-compat/sys-queue.h"
62#include "atomicio.h"
55#include "xmalloc.h" 63#include "xmalloc.h"
56#include "ssh.h" 64#include "ssh.h"
57#include "key.h" 65#include "key.h"
@@ -179,6 +187,8 @@ int mm_answer_audit_event(int, Buffer *);
179int mm_answer_audit_command(int, Buffer *); 187int mm_answer_audit_command(int, Buffer *);
180#endif 188#endif
181 189
190static int monitor_read_log(struct monitor *);
191
182static Authctxt *authctxt; 192static Authctxt *authctxt;
183static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */ 193static BIGNUM *ssh1_challenge = NULL; /* used for ssh1 rsa auth */
184 194
@@ -346,6 +356,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
346 356
347 debug3("preauth child monitor started"); 357 debug3("preauth child monitor started");
348 358
359 close(pmonitor->m_recvfd);
360 close(pmonitor->m_log_sendfd);
361 pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
362
349 authctxt = _authctxt; 363 authctxt = _authctxt;
350 memset(authctxt, 0, sizeof(*authctxt)); 364 memset(authctxt, 0, sizeof(*authctxt));
351 365
@@ -405,6 +419,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
405#endif 419#endif
406 } 420 }
407 421
422 /* Drain any buffered messages from the child */
423 while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
424 ;
425
408 if (!authctxt->valid) 426 if (!authctxt->valid)
409 fatal("%s: authenticated invalid user", __func__); 427 fatal("%s: authenticated invalid user", __func__);
410 if (strcmp(auth_method, "unknown") == 0) 428 if (strcmp(auth_method, "unknown") == 0)
@@ -414,6 +432,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
414 __func__, authctxt->user); 432 __func__, authctxt->user);
415 433
416 mm_get_keystate(pmonitor); 434 mm_get_keystate(pmonitor);
435
436 close(pmonitor->m_sendfd);
437 close(pmonitor->m_log_recvfd);
438 pmonitor->m_sendfd = pmonitor->m_log_recvfd = -1;
417} 439}
418 440
419static void 441static void
@@ -431,6 +453,9 @@ monitor_child_handler(int sig)
431void 453void
432monitor_child_postauth(struct monitor *pmonitor) 454monitor_child_postauth(struct monitor *pmonitor)
433{ 455{
456 close(pmonitor->m_recvfd);
457 pmonitor->m_recvfd = -1;
458
434 monitor_set_child_handler(pmonitor->m_pid); 459 monitor_set_child_handler(pmonitor->m_pid);
435 signal(SIGHUP, &monitor_child_handler); 460 signal(SIGHUP, &monitor_child_handler);
436 signal(SIGTERM, &monitor_child_handler); 461 signal(SIGTERM, &monitor_child_handler);
@@ -454,6 +479,9 @@ monitor_child_postauth(struct monitor *pmonitor)
454 479
455 for (;;) 480 for (;;)
456 monitor_read(pmonitor, mon_dispatch, NULL); 481 monitor_read(pmonitor, mon_dispatch, NULL);
482
483 close(pmonitor->m_sendfd);
484 pmonitor->m_sendfd = -1;
457} 485}
458 486
459void 487void
@@ -465,6 +493,52 @@ monitor_sync(struct monitor *pmonitor)
465 } 493 }
466} 494}
467 495
496static int
497monitor_read_log(struct monitor *pmonitor)
498{
499 Buffer logmsg;
500 u_int len, level;
501 char *msg;
502
503 buffer_init(&logmsg);
504
505 /* Read length */
506 buffer_append_space(&logmsg, 4);
507 if (atomicio(read, pmonitor->m_log_recvfd,
508 buffer_ptr(&logmsg), buffer_len(&logmsg)) != buffer_len(&logmsg)) {
509 if (errno == EPIPE) {
510 debug("%s: child log fd closed", __func__);
511 close(pmonitor->m_log_recvfd);
512 pmonitor->m_log_recvfd = -1;
513 return -1;
514 }
515 fatal("%s: log fd read: %s", __func__, strerror(errno));
516 }
517 len = buffer_get_int(&logmsg);
518 if (len <= 4 || len > 8192)
519 fatal("%s: invalid log message length %u", __func__, len);
520
521 /* Read severity, message */
522 buffer_clear(&logmsg);
523 buffer_append_space(&logmsg, len);
524 if (atomicio(read, pmonitor->m_log_recvfd,
525 buffer_ptr(&logmsg), buffer_len(&logmsg)) != buffer_len(&logmsg))
526 fatal("%s: log fd read: %s", __func__, strerror(errno));
527
528 /* Log it */
529 level = buffer_get_int(&logmsg);
530 msg = buffer_get_string(&logmsg, NULL);
531 if (log_level_name(level) == NULL)
532 fatal("%s: invalid log level %u (corrupted message?)",
533 __func__, level);
534 do_log2(level, "%s [preauth]", msg);
535
536 buffer_free(&logmsg);
537 xfree(msg);
538
539 return 0;
540}
541
468int 542int
469monitor_read(struct monitor *pmonitor, struct mon_table *ent, 543monitor_read(struct monitor *pmonitor, struct mon_table *ent,
470 struct mon_table **pent) 544 struct mon_table **pent)
@@ -472,6 +546,27 @@ monitor_read(struct monitor *pmonitor, struct mon_table *ent,
472 Buffer m; 546 Buffer m;
473 int ret; 547 int ret;
474 u_char type; 548 u_char type;
549 struct pollfd pfd[2];
550
551 for (;;) {
552 bzero(&pfd, sizeof(pfd));
553 pfd[0].fd = pmonitor->m_sendfd;
554 pfd[0].events = POLLIN;
555 pfd[1].fd = pmonitor->m_log_recvfd;
556 pfd[1].events = pfd[1].fd == -1 ? 0 : POLLIN;
557 if (poll(pfd, pfd[1].fd == -1 ? 1 : 2, -1) == -1)
558 fatal("%s: poll: %s", __func__, strerror(errno));
559 if (pfd[1].revents) {
560 /*
561 * Drain all log messages before processing next
562 * monitor request.
563 */
564 monitor_read_log(pmonitor);
565 continue;
566 }
567 if (pfd[0].revents)
568 break; /* Continues below */
569 }
475 570
476 buffer_init(&m); 571 buffer_init(&m);
477 572
@@ -1851,12 +1946,26 @@ mm_init_compression(struct mm_master *mm)
1851} while (0) 1946} while (0)
1852 1947
1853static void 1948static void
1854monitor_socketpair(int *pair) 1949monitor_openfds(struct monitor *mon, int do_logfds)
1855{ 1950{
1951 int pair[2];
1952
1856 if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1) 1953 if (socketpair(AF_UNIX, SOCK_STREAM, 0, pair) == -1)
1857 fatal("%s: socketpair", __func__); 1954 fatal("%s: socketpair: %s", __func__, strerror(errno));
1858 FD_CLOSEONEXEC(pair[0]); 1955 FD_CLOSEONEXEC(pair[0]);
1859 FD_CLOSEONEXEC(pair[1]); 1956 FD_CLOSEONEXEC(pair[1]);
1957 mon->m_recvfd = pair[0];
1958 mon->m_sendfd = pair[1];
1959
1960 if (do_logfds) {
1961 if (pipe(pair) == -1)
1962 fatal("%s: pipe: %s", __func__, strerror(errno));
1963 FD_CLOSEONEXEC(pair[0]);
1964 FD_CLOSEONEXEC(pair[1]);
1965 mon->m_log_recvfd = pair[0];
1966 mon->m_log_sendfd = pair[1];
1967 } else
1968 mon->m_log_recvfd = mon->m_log_sendfd = -1;
1860} 1969}
1861 1970
1862#define MM_MEMSIZE 65536 1971#define MM_MEMSIZE 65536
@@ -1865,14 +1974,10 @@ struct monitor *
1865monitor_init(void) 1974monitor_init(void)
1866{ 1975{
1867 struct monitor *mon; 1976 struct monitor *mon;
1868 int pair[2];
1869 1977
1870 mon = xcalloc(1, sizeof(*mon)); 1978 mon = xcalloc(1, sizeof(*mon));
1871 1979
1872 monitor_socketpair(pair); 1980 monitor_openfds(mon, 1);
1873
1874 mon->m_recvfd = pair[0];
1875 mon->m_sendfd = pair[1];
1876 1981
1877 /* Used to share zlib space across processes */ 1982 /* Used to share zlib space across processes */
1878 if (options.compression) { 1983 if (options.compression) {
@@ -1889,12 +1994,7 @@ monitor_init(void)
1889void 1994void
1890monitor_reinit(struct monitor *mon) 1995monitor_reinit(struct monitor *mon)
1891{ 1996{
1892 int pair[2]; 1997 monitor_openfds(mon, 0);
1893
1894 monitor_socketpair(pair);
1895
1896 mon->m_recvfd = pair[0];
1897 mon->m_sendfd = pair[1];
1898} 1998}
1899 1999
1900#ifdef GSSAPI 2000#ifdef GSSAPI
diff --git a/monitor.h b/monitor.h
index a8a2c0c19..5e7d552fb 100644
--- a/monitor.h
+++ b/monitor.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: monitor.h,v 1.15 2008/11/04 08:22:13 djm Exp $ */ 1/* $OpenBSD: monitor.h,v 1.16 2011/06/17 21:44:31 djm Exp $ */
2 2
3/* 3/*
4 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 4 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -72,6 +72,8 @@ struct mm_master;
72struct monitor { 72struct monitor {
73 int m_recvfd; 73 int m_recvfd;
74 int m_sendfd; 74 int m_sendfd;
75 int m_log_recvfd;
76 int m_log_sendfd;
75 struct mm_master *m_zback; 77 struct mm_master *m_zback;
76 struct mm_master *m_zlib; 78 struct mm_master *m_zlib;
77 struct Kex **m_pkex; 79 struct Kex **m_pkex;
diff --git a/monitor_wrap.c b/monitor_wrap.c
index 7a90b3ba3..1f60658e9 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: monitor_wrap.c,v 1.72 2011/05/23 03:30:07 djm Exp $ */ 1/* $OpenBSD: monitor_wrap.c,v 1.73 2011/06/17 21:44:31 djm Exp $ */
2/* 2/*
3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
4 * Copyright 2002 Markus Friedl <markus@openbsd.org> 4 * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -88,6 +88,32 @@ extern struct monitor *pmonitor;
88extern Buffer loginmsg; 88extern Buffer loginmsg;
89extern ServerOptions options; 89extern ServerOptions options;
90 90
91void
92mm_log_handler(LogLevel level, const char *msg, void *ctx)
93{
94 Buffer log_msg;
95 struct monitor *mon = (struct monitor *)ctx;
96
97 if (mon->m_log_sendfd == -1)
98 fatal("%s: no log channel", __func__);
99
100 buffer_init(&log_msg);
101 /*
102 * Placeholder for packet length. Will be filled in with the actual
103 * packet length once the packet has been constucted. This saves
104 * fragile math.
105 */
106 buffer_put_int(&log_msg, 0);
107
108 buffer_put_int(&log_msg, level);
109 buffer_put_cstring(&log_msg, msg);
110 put_u32(buffer_ptr(&log_msg), buffer_len(&log_msg) - 4);
111 if (atomicio(vwrite, mon->m_log_sendfd, buffer_ptr(&log_msg),
112 buffer_len(&log_msg)) != buffer_len(&log_msg))
113 fatal("%s: write: %s", __func__, strerror(errno));
114 buffer_free(&log_msg);
115}
116
91int 117int
92mm_is_monitor(void) 118mm_is_monitor(void)
93{ 119{
diff --git a/monitor_wrap.h b/monitor_wrap.h
index de2d16f66..0c7f2e384 100644
--- a/monitor_wrap.h
+++ b/monitor_wrap.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: monitor_wrap.h,v 1.22 2009/03/05 07:18:19 djm Exp $ */ 1/* $OpenBSD: monitor_wrap.h,v 1.23 2011/06/17 21:44:31 djm Exp $ */
2 2
3/* 3/*
4 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 4 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -37,6 +37,7 @@ struct monitor;
37struct mm_master; 37struct mm_master;
38struct Authctxt; 38struct Authctxt;
39 39
40void mm_log_handler(LogLevel, const char *, void *);
40int mm_is_monitor(void); 41int mm_is_monitor(void);
41DH *mm_choose_dh(int, int, int); 42DH *mm_choose_dh(int, int, int);
42int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); 43int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
diff --git a/sshd.c b/sshd.c
index 50d0dede4..6e15522b3 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: sshd.c,v 1.382 2011/04/12 05:32:49 djm Exp $ */ 1/* $OpenBSD: sshd.c,v 1.383 2011/06/17 21:44:31 djm Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -636,10 +636,8 @@ privsep_preauth(Authctxt *authctxt)
636 } else if (pid != 0) { 636 } else if (pid != 0) {
637 debug2("Network child is on pid %ld", (long)pid); 637 debug2("Network child is on pid %ld", (long)pid);
638 638
639 close(pmonitor->m_recvfd);
640 pmonitor->m_pid = pid; 639 pmonitor->m_pid = pid;
641 monitor_child_preauth(authctxt, pmonitor); 640 monitor_child_preauth(authctxt, pmonitor);
642 close(pmonitor->m_sendfd);
643 641
644 /* Sync memory */ 642 /* Sync memory */
645 monitor_sync(pmonitor); 643 monitor_sync(pmonitor);
@@ -651,8 +649,11 @@ privsep_preauth(Authctxt *authctxt)
651 return (1); 649 return (1);
652 } else { 650 } else {
653 /* child */ 651 /* child */
654
655 close(pmonitor->m_sendfd); 652 close(pmonitor->m_sendfd);
653 close(pmonitor->m_log_recvfd);
654
655 /* Arrange for logging to be sent to the monitor */
656 set_log_handler(mm_log_handler, pmonitor);
656 657
657 /* Demote the child */ 658 /* Demote the child */
658 if (getuid() == 0 || geteuid() == 0) 659 if (getuid() == 0 || geteuid() == 0)
@@ -685,7 +686,6 @@ privsep_postauth(Authctxt *authctxt)
685 fatal("fork of unprivileged child failed"); 686 fatal("fork of unprivileged child failed");
686 else if (pmonitor->m_pid != 0) { 687 else if (pmonitor->m_pid != 0) {
687 verbose("User child is on pid %ld", (long)pmonitor->m_pid); 688 verbose("User child is on pid %ld", (long)pmonitor->m_pid);
688 close(pmonitor->m_recvfd);
689 buffer_clear(&loginmsg); 689 buffer_clear(&loginmsg);
690 monitor_child_postauth(pmonitor); 690 monitor_child_postauth(pmonitor);
691 691
@@ -693,7 +693,10 @@ privsep_postauth(Authctxt *authctxt)
693 exit(0); 693 exit(0);
694 } 694 }
695 695
696 /* child */
697
696 close(pmonitor->m_sendfd); 698 close(pmonitor->m_sendfd);
699 pmonitor->m_sendfd = -1;
697 700
698 /* Demote the private keys to public keys. */ 701 /* Demote the private keys to public keys. */
699 demote_sensitive_data(); 702 demote_sensitive_data();