]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
sshd: address capsicum issues
authorEd Maste <emaste@FreeBSD.org>
Sat, 6 Oct 2018 21:32:55 +0000 (21:32 +0000)
committerEd Maste <emaste@FreeBSD.org>
Sat, 6 Oct 2018 21:32:55 +0000 (21:32 +0000)
commitfc3c19a9fceeea48a9259ac3833a125804342c0e
tree229e14ee478b70177cfe09ab5973054a8bf9d7f2
parent7e524b0746bc9cabd0db124b97d94456017e93b8
sshd: address capsicum issues

* Add a wrapper to proxy login_getpwclass(3) as it is not allowed in
  capability mode.
* Cache timezone data via caph_cache_tzdata() as we cannot access the
  timezone file.
* Reverse resolve hostname before entering capability mode.

PR: 231172
Submitted by: naito.yuichiro@gmail.com
Reviewed by: cem, des
Approved by: re (rgrimes)
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D17128
crypto/openssh/auth2.c
crypto/openssh/monitor.c
crypto/openssh/monitor.h
crypto/openssh/monitor_wrap.c
crypto/openssh/monitor_wrap.h
crypto/openssh/sandbox-capsicum.c
crypto/openssh/sshbuf-getput-basic.c
crypto/openssh/sshbuf.h
crypto/openssh/sshd.c