From 7699f33633d5ba2e68d35ac51173ad6bb2c3a521 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Mon, 25 Feb 2019 16:52:57 +0000 Subject: Tighten up start-stop-daemon invocations Pass "--exec /usr/sbin/sshd" to start-stop-daemon on stop as well as start and pass "--chuid 0:0" on start, to avoid problems with non-root groups leaking into the ownership of /run/sshd.pid. Closes: #922365 --- debian/changelog | 3 +++ debian/openssh-server.ssh.init | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) mode change 100644 => 100755 debian/openssh-server.ssh.init diff --git a/debian/changelog b/debian/changelog index 04b0914ac..c7b93aaf5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,6 +4,9 @@ openssh (1:7.9p1-7) UNRELEASED; urgency=medium libpam-systemd (closes: #923199). (I've retained libpam-systemd as an alternative for a while to avoid backporting accidents, although it can be removed later.) + * Pass "--exec /usr/sbin/sshd" to start-stop-daemon on stop as well as + start and pass "--chuid 0:0" on start, to avoid problems with non-root + groups leaking into the ownership of /run/sshd.pid (closes: #922365). -- Colin Watson Mon, 25 Feb 2019 16:26:28 +0000 diff --git a/debian/openssh-server.ssh.init b/debian/openssh-server.ssh.init old mode 100644 new mode 100755 index f25000883..620af70e0 --- a/debian/openssh-server.ssh.init +++ b/debian/openssh-server.ssh.init @@ -80,7 +80,7 @@ case "$1" in check_for_no_start check_dev_null log_daemon_msg "Starting OpenBSD Secure Shell server" "sshd" || true - if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then + if start-stop-daemon --start --quiet --oknodo --chuid 0:0 --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then log_end_msg 0 || true else log_end_msg 1 || true @@ -88,7 +88,7 @@ case "$1" in ;; stop) log_daemon_msg "Stopping OpenBSD Secure Shell server" "sshd" || true - if start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid; then + if start-stop-daemon --stop --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd; then log_end_msg 0 || true else log_end_msg 1 || true @@ -110,10 +110,10 @@ case "$1" in check_privsep_dir check_config log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true - start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /run/sshd.pid + start-stop-daemon --stop --quiet --oknodo --retry 30 --pidfile /run/sshd.pid --exec /usr/sbin/sshd check_for_no_start log_end_msg check_dev_null log_end_msg - if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then + if start-stop-daemon --start --quiet --oknodo --chuid 0:0 --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then log_end_msg 0 || true else log_end_msg 1 || true @@ -125,13 +125,13 @@ case "$1" in check_config log_daemon_msg "Restarting OpenBSD Secure Shell server" "sshd" || true RET=0 - start-stop-daemon --stop --quiet --retry 30 --pidfile /run/sshd.pid || RET="$?" + start-stop-daemon --stop --quiet --retry 30 --pidfile /run/sshd.pid --exec /usr/sbin/sshd || RET="$?" case $RET in 0) # old daemon stopped check_for_no_start log_end_msg check_dev_null log_end_msg - if start-stop-daemon --start --quiet --oknodo --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then + if start-stop-daemon --start --quiet --oknodo --chuid 0:0 --pidfile /run/sshd.pid --exec /usr/sbin/sshd -- $SSHD_OPTS; then log_end_msg 0 || true else log_end_msg 1 || true -- cgit v1.2.3