[bug#55034] [PATCH 0/1] Let openssh trust /gnu/store

[Ludovic Courtès]

Hi,

Alexey Abramov <levenson@mmer.org> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Hi,
>>
>> Alexey Abramov <levenson@mmer.org> skribis:
>>
>>> This patch allows users to use /gnu/store objects for AuthorizedKeysCommand
>>> and similar options. According to the sshd_config(5):
>>>
>>>> The program must be owned by root, not writable by group or others, and
>>>> specified by an absolute path.
>>
>> That’s the case with programs in /gnu/store.  Why isn’t it working?
>
> The reason is that safe_path in openssh takes a full path of the file
> and checks every directory one by one. The constrain fails on /gnu/store
> directory due to write permissions for group.

Oh I see, makes sense.

[...]

>> Also note that the strcmp above is incorrect: it would accept
>> /gnu/storesomethinglese.  You probably need to add a trailing slash to
>> be sure.
>
> Let me correct myself. In the previous email I wrote that the safe_path
> goes from top to bottom, but actually it walking upwards. This is an
> actual loop

[...]

> As you can see, buffer is holding the result of dirname already, hence
> I used "/gnu/store".

Sounds good then!

Thanks for explaining,
Ludo’.