1 files changed, 183 insertions, 15 deletions

diff --git a/configure b/configure
index 035b6f064..4eeaa4e56 100755
--- a/configure
+++ b/configure
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.ac Revision: 1.489 .
+# From configure.ac Revision: 1.496 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.68 for OpenSSH Portable.
 #
@@ -6927,7 +6927,8 @@ $as_echo "#define SSH_TUN_PREPEND_AF 1" >>confdefs.h
         for ac_header in linux/seccomp.h linux/filter.h linux/audit.h
 do :
   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "#include <linux/types.h>
+"
 if eval test \"x\$"$as_ac_Header"\" = x"yes"; then :
   cat >>confdefs.h <<_ACEOF
 #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
@@ -9137,8 +9138,9 @@ LIBEDIT_MSG="no"
 if test "${with_libedit+set}" = set; then :
   withval=$with_libedit;  if test "x$withval" != "xno" ; then
                 if test "x$withval" = "xyes" ; then
-                        # Extract the first word of "pkg-config", so it can be a program name with args.
-set dummy pkg-config; ac_word=$2
+                        if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}pkg-config", so it can be a program name with args.
+set dummy ${ac_tool_prefix}pkg-config; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
 if ${ac_cv_path_PKGCONFIG+:} false; then :
@@ -9164,7 +9166,6 @@ done
   done
 IFS=$as_save_IFS
 
-  test -z "$ac_cv_path_PKGCONFIG" && ac_cv_path_PKGCONFIG="no"
   ;;
 esac
 fi
@@ -9178,6 +9179,63 @@ $as_echo "no" >&6; }
 fi
 
 
+fi
+if test -z "$ac_cv_path_PKGCONFIG"; then
+  ac_pt_PKGCONFIG=$PKGCONFIG
+  # Extract the first word of "pkg-config", so it can be a program name with args.
+set dummy pkg-config; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_path_ac_pt_PKGCONFIG+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  case $ac_pt_PKGCONFIG in
+  [\\/]* | ?:[\\/]*)
+  ac_cv_path_ac_pt_PKGCONFIG="$ac_pt_PKGCONFIG" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_path_ac_pt_PKGCONFIG="$as_dir/$ac_word$ac_exec_ext"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  ;;
+esac
+fi
+ac_pt_PKGCONFIG=$ac_cv_path_ac_pt_PKGCONFIG
+if test -n "$ac_pt_PKGCONFIG"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_PKGCONFIG" >&5
+$as_echo "$ac_pt_PKGCONFIG" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+  if test "x$ac_pt_PKGCONFIG" = x; then
+    PKGCONFIG="no"
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    PKGCONFIG=$ac_pt_PKGCONFIG
+  fi
+else
+  PKGCONFIG="$ac_cv_path_PKGCONFIG"
+fi
+
                         if test "x$PKGCONFIG" != "xno"; then
                                 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $PKGCONFIG knows about libedit" >&5
 $as_echo_n "checking if $PKGCONFIG knows about libedit... " >&6; }
@@ -9499,6 +9557,7 @@ for ac_func in  \
         seteuid \
         setgroupent \
         setgroups \
+        setlinebuf \
         setlogin \
         setpassent\
         setpcred \
@@ -11784,6 +11843,109 @@ if test "${with_sandbox+set}" = set; then :
 
 fi
 
+
+# Some platforms (seems to be the ones that have a kernel poll(2)-type
+# function with which they implement select(2)) use an extra file descriptor
+# when calling select(2), which means we can't use the rlimit sandbox.
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if select works with descriptor rlimit" >&5
+$as_echo_n "checking if select works with descriptor rlimit... " >&6; }
+if test "$cross_compiling" = yes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
+$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+#include <sys/resource.h>
+#ifdef HAVE_SYS_SELECT_H
+# include <sys/select.h>
+#endif
+#include <errno.h>
+#include <fcntl.h>
+#include <stdlib.h>
+
+int
+main ()
+{
+
+        struct rlimit rl_zero;
+        int fd, r;
+        fd_set fds;
+
+        fd = open("/dev/null", O_RDONLY);
+        FD_ZERO(&fds);
+        FD_SET(fd, &fds);
+        rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+        setrlimit(RLIMIT_FSIZE, &rl_zero);
+        setrlimit(RLIMIT_NOFILE, &rl_zero);
+        r = select(fd+1, &fds, NULL, NULL, NULL);
+        exit (r == -1 ? 1 : 0);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+         select_works_with_rlimit=yes
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+         select_works_with_rlimit=no
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if setrlimit RLIMIT_FSIZE works" >&5
+$as_echo_n "checking if setrlimit RLIMIT_FSIZE works... " >&6; }
+if test "$cross_compiling" = yes; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cross compiling: assuming yes" >&5
+$as_echo "$as_me: WARNING: cross compiling: assuming yes" >&2;}
+
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <sys/types.h>
+#include <sys/resource.h>
+#include <stdlib.h>
+
+int
+main ()
+{
+
+                struct rlimit rl_zero;
+
+                rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+                exit(setrlimit(RLIMIT_FSIZE, &rl_zero) != 0);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+$as_echo "#define SANDBOX_SKIP_RLIMIT_FSIZE 1" >>confdefs.h
+
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+
 if test "x$sandbox_arg" = "xsystrace" || \
    ( test -z "$sandbox_arg" && test "x$have_systr_policy_kill" = "x1" ) ; then
         test "x$have_systr_policy_kill" != "x1" && \
@@ -11804,7 +11966,7 @@ $as_echo "#define SANDBOX_DARWIN 1" >>confdefs.h
 
 elif test "x$sandbox_arg" = "xseccomp_filter" || \
      ( test -z "$sandbox_arg" && \
-       test "x$have_seccomp_filter" == "x1" && \
+       test "x$have_seccomp_filter" = "x1" && \
        test "x$ac_cv_header_linux_audit_h" = "xyes" && \
        test "x$have_seccomp_audit_arch" = "x1" && \
        test "x$have_linux_no_new_privs" = "x1" && \
@@ -11822,9 +11984,12 @@ elif test "x$sandbox_arg" = "xseccomp_filter" || \
 $as_echo "#define SANDBOX_SECCOMP_FILTER 1" >>confdefs.h
 
 elif test "x$sandbox_arg" = "xrlimit" || \
-     ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" ) ; then
+     ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
+       test "x$select_works_with_rlimit" == "xyes" ) ; then
         test "x$ac_cv_func_setrlimit" != "xyes" && \
                 as_fn_error $? "rlimit sandbox requires setrlimit function" "$LINENO" 5
+        test "x$select_works_with_rlimit" != "xyes" && \
+                as_fn_error $? "rlimit sandbox requires select to work with rlimit" "$LINENO" 5
         SANDBOX_STYLE="rlimit"
 
 $as_echo "#define SANDBOX_RLIMIT 1" >>confdefs.h
@@ -14118,7 +14283,7 @@ $as_echo_n "checking if struct statvfs.f_fsid is integral type... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
 
-#include <sys/types.h>
+#include <sys/param.h>
 #include <sys/stat.h>
 #ifdef HAVE_SYS_TIME_H
 # include <sys/time.h>
@@ -16077,13 +16242,16 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
 fi
 
 # make sure $bindir is in USER_PATH so scp will work
-                t_bindir=`eval echo ${bindir}`
-                case $t_bindir in
-                        NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
-                esac
-                case $t_bindir in
-                        NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
-                esac
+                t_bindir="${bindir}"
+                while echo "${t_bindir}" | egrep '\$\{|NONE/' >/dev/null 2>&1; do
+                        t_bindir=`eval echo ${t_bindir}`
+                        case $t_bindir in
+                                NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
+                        esac
+                        case $t_bindir in
+                                NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
+                        esac
+                done
                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
                 if test $? -ne 0  ; then
                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1