Page MenuHomeFreeBSD
Files F149282209

D51846.1789814113.diff
No OneTemporary
Actions

Size
2 KB
Referenced Files
None
Subscribers
None

D51846.1789814113.diff
View Options

diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile
--- a/security/openssh-portable/Makefile
+++ b/security/openssh-portable/Makefile
@@ -1,6 +1,6 @@
PORTNAME= openssh
DISTVERSION= 10.0p1
-PORTREVISION= 1
+PORTREVISION= 2
PORTEPOCH= 1
CATEGORIES= security
MASTER_SITES= OPENBSD/OpenSSH/portable
diff --git a/security/openssh-portable/files/patch-uidswap.c b/security/openssh-portable/files/patch-uidswap.c
new file mode 100644
--- /dev/null
+++ b/security/openssh-portable/files/patch-uidswap.c
@@ -0,0 +1,57 @@
+commit 239e8c98636a7578cc67a6f9d54d14c71b095e36
+Author: Kyle Evans <kevans@FreeBSD.org>
+Date: Sat Aug 9 11:01:57 2025 -0500
+
+ ssh: sshd-session: properly save off the privileged gid
+
+ Current and traditional FreeBSD behavior means that getegid() here is
+ the first element in the prior setgroups() call, if any, so we may
+ inadvertently wipe out our rgid with the unprivileged gid. This is
+ rendered somewhat harmless by the fact that we're losing the privileged
+ gid -- we'll still regain it as the egid in restore_uid() later by way
+ of restoring saved_egroups, rather than by intentionally restoring it
+ from getgid().
+
+ This will be promptly reverted if we can get setgroups(2)/getgroups(2)
+ changed in FreeBSD 15.0, but it seemed wise to get this technically
+ correct for previous branches.
+
+ Reviewed by: jlduran
+ Differential Revision: https://reviews.freebsd.org/D51753
+
+diff --git uidswap.c uidswap.c
+index 6ed3024d0180..0143f4994611 100644
+--- uidswap.c
++++ uidswap.c
+@@ -14,6 +14,10 @@
+
+ #include "includes.h"
+
++#ifdef __FreeBSD__
++#include <sys/param.h>
++#include <assert.h>
++#endif
+ #include <errno.h>
+ #include <pwd.h>
+ #include <string.h>
+@@ -121,8 +124,20 @@ temporarily_use_uid(struct passwd *pw)
+ fatal("setgroups: %.100s", strerror(errno));
+ #ifndef SAVED_IDS_WORK_WITH_SETEUID
+ /* Propagate the privileged gid to all of our gids. */
++#if defined(__FreeBSD__) && __FreeBSD_version < 1500061
++ /*
++ * FreeBSD traditionally includes the egid as the first element. If we
++ * use getegid() here then we effectively propagate user_groups[0],
++ * which is probably pw->pw_gid. Fix it to work as intended by using
++ * the egid we already have stashed off.
++ */
++ assert(saved_egroupslen > 0);
++ if (setgid(saved_egroups[0]) == -1)
++ debug("setgid %u: %.100s", (u_int) saved_egroups[0], strerror(errno));
++#else
+ if (setgid(getegid()) == -1)
+ debug("setgid %u: %.100s", (u_int) getegid(), strerror(errno));
++#endif
+ /* Propagate the privileged uid to all of our uids. */
+ if (setuid(geteuid()) == -1)
+ debug("setuid %u: %.100s", (u_int) geteuid(), strerror(errno));

File Metadata

Mime Type
text/plain
Expires
Sat, Sep 19, 10:35 AM (7 h, 32 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29775240
Default Alt Text
D51846.1789814113.diff (2 KB)

Event Timeline