summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog3
-rw-r--r--Makefile.in9
-rw-r--r--regress/Makefile2
-rw-r--r--regress/agent-ptrace.sh7
-rw-r--r--regress/setuid-allowed.c56
5 files changed, 75 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 3434d6d27..c56f59785 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,9 @@
120131208 120131208
2 - (djm) [openbsd-compat/bsd-setres_id.c] Missing header; from Corinna 2 - (djm) [openbsd-compat/bsd-setres_id.c] Missing header; from Corinna
3 Vinschen 3 Vinschen
4 - (djm) [Makefile.in regress/Makefile regress/agent-ptrace.sh]
5 [regress/setuid-allowed.c] Check that ssh-agent is not on a no-setuid
6 filesystem before running agent-ptrace.sh; ok dtucker
4 7
520131207 820131207
6 - (djm) OpenBSD CVS Sync 9 - (djm) OpenBSD CVS Sync
diff --git a/Makefile.in b/Makefile.in
index f45c88098..e789b476a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
1# $Id: Makefile.in,v 1.347 2013/12/07 10:43:47 djm Exp $ 1# $Id: Makefile.in,v 1.348 2013/12/08 04:53:28 djm Exp $
2 2
3# uncomment if you run a non bourne compatable shell. Ie. csh 3# uncomment if you run a non bourne compatable shell. Ie. csh
4#SHELL = @SH@ 4#SHELL = @SH@
@@ -401,6 +401,13 @@ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
401 $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \ 401 $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
402 $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) 402 $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
403 403
404regress/setuid-allowed$(EXEEXT): $(srcdir)/regress/setuid-allowed.c
405 [ -d `pwd`/regress ] || mkdir -p `pwd`/regress
406 [ -f `pwd`/regress/Makefile ] || \
407 ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
408 $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
409 $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
410
404tests interop-tests: $(TARGETS) regress/modpipe$(EXEEXT) 411tests interop-tests: $(TARGETS) regress/modpipe$(EXEEXT)
405 BUILDDIR=`pwd`; \ 412 BUILDDIR=`pwd`; \
406 TEST_SHELL="@TEST_SHELL@"; \ 413 TEST_SHELL="@TEST_SHELL@"; \
diff --git a/regress/Makefile b/regress/Makefile
index 098f2014b..ba8504837 100644
--- a/regress/Makefile
+++ b/regress/Makefile
@@ -88,7 +88,7 @@ CLEANFILES= t2.out t3.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \
88 sshd_proxy.* authorized_keys_${USER}.* modpipe revoked-* krl-* \ 88 sshd_proxy.* authorized_keys_${USER}.* modpipe revoked-* krl-* \
89 ssh.log failed-ssh.log sshd.log failed-sshd.log \ 89 ssh.log failed-ssh.log sshd.log failed-sshd.log \
90 regress.log failed-regress.log ssh-log-wrapper.sh \ 90 regress.log failed-regress.log ssh-log-wrapper.sh \
91 sftp-server.sh sftp-server.log sftp.log 91 sftp-server.sh sftp-server.log sftp.log setuid-allowed
92 92
93SUDO_CLEAN+= /var/run/testdata_${USER} /var/run/keycommand_${USER} 93SUDO_CLEAN+= /var/run/testdata_${USER} /var/run/keycommand_${USER}
94 94
diff --git a/regress/agent-ptrace.sh b/regress/agent-ptrace.sh
index 9f29464c5..6824b8141 100644
--- a/regress/agent-ptrace.sh
+++ b/regress/agent-ptrace.sh
@@ -19,6 +19,13 @@ else
19 exit 0 19 exit 0
20fi 20fi
21 21
22if $OBJ/setuid-allowed ${SSHAGENT} ; then
23 : ok
24else
25 echo "skipped (${SSHAGENT} is mounted on a no-setuid filesystem)"
26 exit 0
27fi
28
22if test -z "$SUDO" ; then 29if test -z "$SUDO" ; then
23 echo "skipped (SUDO not set)" 30 echo "skipped (SUDO not set)"
24 exit 0 31 exit 0
diff --git a/regress/setuid-allowed.c b/regress/setuid-allowed.c
new file mode 100644
index 000000000..37b7dc8ad
--- /dev/null
+++ b/regress/setuid-allowed.c
@@ -0,0 +1,56 @@
1/*
2 * Copyright (c) 2013 Damien Miller <djm@mindrot.org>
3 *
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
7 *
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15 */
16
17/* $OpenBSD$ */
18
19#include "includes.h"
20
21#include <sys/types.h>
22#ifdef HAVE_SYS_STATVFS_H
23# include <sys/statvfs.h>
24#endif
25#include <stdio.h>
26#include <errno.h>
27
28void
29usage(void)
30{
31 fprintf(stderr, "check-setuid [path]\n");
32 exit(1);
33}
34
35int
36main(int argc, char **argv)
37{
38 const char *path = ".";
39 struct statvfs sb;
40
41 if (argc > 2)
42 usage();
43 else if (argc == 2)
44 path = argv[1];
45
46 if (statvfs(path, &sb) != 0) {
47 /* Don't return an error if the host doesn't support statvfs */
48 if (errno == ENOSYS)
49 return 0;
50 fprintf(stderr, "statvfs for \"%s\" failed: %s\n",
51 path, strerror(errno));
52 }
53 return (sb.f_flag & ST_NOSUID) ? 1 : 0;
54}
55
56