summaryrefslogtreecommitdiff
path: root/debian/patches/ssh-agent-setgid.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/ssh-agent-setgid.patch')
-rw-r--r--debian/patches/ssh-agent-setgid.patch40
1 files changed, 40 insertions, 0 deletions
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
new file mode 100644
index 000000000..f61725049
--- /dev/null
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -0,0 +1,40 @@
1From 76b2e45116ded18137a30406cf5f22b11b9feeab Mon Sep 17 00:00:00 2001
2From: Colin Watson <cjwatson@debian.org>
3Date: Sun, 9 Feb 2014 16:10:13 +0000
4Subject: Document consequences of ssh-agent being setgid in ssh-agent(1)
5
6Bug-Debian: http://bugs.debian.org/711623
7Forwarded: no
8Last-Update: 2013-06-08
9
10Patch-Name: ssh-agent-setgid.patch
11---
12 ssh-agent.1 | 15 +++++++++++++++
13 1 file changed, 15 insertions(+)
14
15diff --git a/ssh-agent.1 b/ssh-agent.1
16index 83b2b41c..7230704a 100644
17--- a/ssh-agent.1
18+++ b/ssh-agent.1
19@@ -206,6 +206,21 @@ environment variable holds the agent's process ID.
20 .Pp
21 The agent exits automatically when the command given on the command
22 line terminates.
23+.Pp
24+In Debian,
25+.Nm
26+is installed with the set-group-id bit set, to prevent
27+.Xr ptrace 2
28+attacks retrieving private key material.
29+This has the side-effect of causing the run-time linker to remove certain
30+environment variables which might have security implications for set-id
31+programs, including
32+.Ev LD_PRELOAD ,
33+.Ev LD_LIBRARY_PATH ,
34+and
35+.Ev TMPDIR .
36+If you need to set any of these environment variables, you will need to do
37+so in the program executed by ssh-agent.
38 .Sh FILES
39 .Bl -tag -width Ds
40 .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>