diff options
Diffstat (limited to 'debian/patches/ssh-agent-setgid.patch')
-rw-r--r-- | debian/patches/ssh-agent-setgid.patch | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch new file mode 100644 index 000000000..5cabd8ead --- /dev/null +++ b/debian/patches/ssh-agent-setgid.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From ffd0bdfb5e16b792de4f98ca19f94d9e2fb8b281 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Watson <cjwatson@debian.org> | ||
3 | Date: Sun, 9 Feb 2014 16:10:13 +0000 | ||
4 | Subject: Document consequences of ssh-agent being setgid in ssh-agent(1) | ||
5 | |||
6 | Bug-Debian: http://bugs.debian.org/711623 | ||
7 | Forwarded: no | ||
8 | Last-Update: 2013-06-08 | ||
9 | |||
10 | Patch-Name: ssh-agent-setgid.patch | ||
11 | --- | ||
12 | ssh-agent.1 | 15 +++++++++++++++ | ||
13 | 1 file changed, 15 insertions(+) | ||
14 | |||
15 | diff --git a/ssh-agent.1 b/ssh-agent.1 | ||
16 | index d0aa712..2a940d9 100644 | ||
17 | --- a/ssh-agent.1 | ||
18 | +++ b/ssh-agent.1 | ||
19 | @@ -186,6 +186,21 @@ environment variable holds the agent's process ID. | ||
20 | .Pp | ||
21 | The agent exits automatically when the command given on the command | ||
22 | line terminates. | ||
23 | +.Pp | ||
24 | +In Debian, | ||
25 | +.Nm | ||
26 | +is installed with the set-group-id bit set, to prevent | ||
27 | +.Xr ptrace 2 | ||
28 | +attacks retrieving private key material. | ||
29 | +This has the side-effect of causing the run-time linker to remove certain | ||
30 | +environment variables which might have security implications for set-id | ||
31 | +programs, including | ||
32 | +.Ev LD_PRELOAD , | ||
33 | +.Ev LD_LIBRARY_PATH , | ||
34 | +and | ||
35 | +.Ev TMPDIR . | ||
36 | +If you need to set any of these environment variables, you will need to do | ||
37 | +so in the program executed by ssh-agent. | ||
38 | .Sh FILES | ||
39 | .Bl -tag -width Ds | ||
40 | .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt | ||