File openssh-7.2p2-sftp_homechroot.patch of Package openssh.29886
From 560af814056ac2e66cb54826b6edd88af17f983e Mon Sep 17 00:00:00 2001
From: Old openssh patches <pcerny@suse.com>
Date: Wed, 26 Oct 2022 09:53:04 +0200
Subject: [PATCH] openssh-7.2p2-sftp_homechroot
# HG changeset patch
# Parent 61f84e53558b040bb7f91d5eed9e8566fae866c2
run sftp sessions inside a chroot
---
session.c | 76 ++++++++++++++++++++++++++++++++++++++++++++--
sftp-chrootenv.h | 30 ++++++++++++++++++
sftp-common.c | 5 +--
sftp-server-main.c | 3 ++
sftp.c | 2 ++
sshd_config.0 | 8 +++++
sshd_config.5 | 11 +++++++
7 files changed, 131 insertions(+), 4 deletions(-)
create mode 100644 sftp-chrootenv.h
diff --git a/session.c b/session.c
index b64a8786..89bbf859 100644
--- a/session.c
+++ b/session.c
@@ -128,6 +128,8 @@ void do_child(Session *, const char *);
void do_motd(void);
int check_quietlogin(Session *, const char *);
+int chroot_no_tree = 0;
+
static void do_authenticated1(Authctxt *);
static void do_authenticated2(Authctxt *);
@@ -843,6 +845,11 @@ do_exec(Session *s, const char *command)
snprintf(session_type, sizeof(session_type), "command");
}
+ if ((s->is_subsystem != SUBSYSTEM_INT_SFTP) && chroot_no_tree) {
+ logit("You aren't welcomed, go away!");
+ exit (1);
+ }
+
if (s->ttyfd != -1) {
tty = s->tty;
if (strncmp(tty, "/dev/", 5) == 0)
@@ -1496,6 +1503,63 @@ do_nologin(struct passwd *pw)
exit(254);
}
+/*
+ * Test if filesystem is mounted nosuid and nodev
+ */
+
+static void
+test_nosuid (char * path, dev_t fs)
+{
+ FILE *f;
+ struct stat st;
+ char buf[4096], *s, *on, *mountpoint, *opt;
+ int nodev, nosuid;
+
+ if (!(f = popen ("/bin/mount", "r")))
+ fatal ("%s: popen(\"/bin/mount\", \"r\"): %s",
+ __func__, strerror (errno));
+ for (;;) {
+ s = fgets (buf, sizeof (buf), f);
+ if (ferror (f))
+ fatal ("%s: read from popen: %s", __func__,
+ strerror (errno));
+ if (!s) {
+ pclose (f);
+ fatal ("cannot find filesystem with the chroot directory");
+ }
+ (void) strtok (buf, " ");
+ on = strtok (NULL, " ");
+ if (strcmp (on, "on")) {
+ pclose (f);
+ fatal ("bad format of mount output");
+ }
+ mountpoint = strtok (NULL, " ");
+ if (memcmp (path, mountpoint, strlen (mountpoint)))
+ continue;
+ if (stat(mountpoint, &st) != 0) {
+ pclose (f);
+ fatal("%s: stat(\"%s\"): %s", __func__,
+ mountpoint, strerror(errno));
+ }
+ if (fs != st.st_dev)
+ continue;
+ nodev = nosuid = 0;
+ for (opt = strtok (NULL, "("); opt; opt = strtok (NULL, " ,)")) {
+ if (!strcmp (opt, "nodev"))
+ nodev = 1;
+ else if (!strcmp (opt, "nosuid"))
+ nosuid = 1;
+ else if (!strcmp (opt, "noexec"))
+ nosuid = 1;
+ if (nodev && nosuid) {
+ pclose (f);
+ return;
+ }
+ }
+ fatal ("chroot into directory without nodev and either noexec or nosuid");
+ }
+}
+
/*
* Chroot into a directory after checking it for safety: all path components
* must be root-owned directories with strict permissions.
@@ -1506,6 +1570,7 @@ safely_chroot(const char *path, uid_t uid)
const char *cp;
char component[PATH_MAX];
struct stat st;
+ int last;
if (*path != '/')
fatal("chroot path does not begin at root");
@@ -1517,7 +1582,7 @@ safely_chroot(const char *path, uid_t uid)
* root-owned directory with strict permissions.
*/
for (cp = path; cp != NULL;) {
- if ((cp = strchr(cp, '/')) == NULL)
+ if (last = ((cp = strchr(cp, '/')) == NULL))
strlcpy(component, path, sizeof(component));
else {
cp++;
@@ -1530,7 +1595,7 @@ safely_chroot(const char *path, uid_t uid)
if (stat(component, &st) != 0)
fatal("%s: stat(\"%s\"): %s", __func__,
component, strerror(errno));
- if (st.st_uid != 0 || (st.st_mode & 022) != 0)
+ if ((st.st_uid != 0 || (st.st_mode & 022) != 0) && !(last && st.st_uid == uid))
fatal("bad ownership or modes for chroot "
"directory %s\"%s\"",
cp == NULL ? "" : "component ", component);
@@ -1539,6 +1604,13 @@ safely_chroot(const char *path, uid_t uid)
cp == NULL ? "" : "component ", component);
}
+ setenv ("TZ", "/etc/localtime", 0);
+ tzset();
+
+ if (st.st_uid) {
+ test_nosuid(path, st.st_dev);
+ ++chroot_no_tree;
+ }
if (chdir(path) == -1)
fatal("Unable to chdir to chroot path \"%s\": "
diff --git a/sftp-chrootenv.h b/sftp-chrootenv.h
new file mode 100644
index 00000000..a317aaba
--- /dev/null
+++ b/sftp-chrootenv.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2009 Jan F Chadima. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CHROOTENV_H
+#define CHROOTENV_H
+
+extern int chroot_no_tree;
+
+#endif
+
diff --git a/sftp-common.c b/sftp-common.c
index 9dc1f983..9b07443c 100644
--- a/sftp-common.c
+++ b/sftp-common.c
@@ -48,6 +48,7 @@
#include "sftp.h"
#include "sftp-common.h"
+#include "sftp-chrootenv.h"
/* Clear contents of attributes structure */
void
@@ -221,13 +222,13 @@ ls_file(const char *name, const struct stat *st, int remote, int si_units)
time_t now;
strmode(st->st_mode, mode);
- if (!remote) {
+ if (!remote && !chroot_no_tree) {
user = user_from_uid(st->st_uid, 0);
} else {
snprintf(ubuf, sizeof ubuf, "%u", (u_int)st->st_uid);
user = ubuf;
}
- if (!remote) {
+ if (!remote && !chroot_no_tree) {
group = group_from_gid(st->st_gid, 0);
} else {
snprintf(gbuf, sizeof gbuf, "%u", (u_int)st->st_gid);
diff --git a/sftp-server-main.c b/sftp-server-main.c
index c6ccd623..0fd33f20 100644
--- a/sftp-server-main.c
+++ b/sftp-server-main.c
@@ -22,12 +22,15 @@
#include <stdarg.h>
#include <stdio.h>
#include <unistd.h>
+//#include <time.h>
#include "log.h"
#include "sftp.h"
#include "misc.h"
#include "xmalloc.h"
+int chroot_no_tree = 0;
+
void
cleanup_exit(int i)
{
diff --git a/sftp.c b/sftp.c
index 2077219f..09d06671 100644
--- a/sftp.c
+++ b/sftp.c
@@ -117,6 +117,8 @@ int remote_glob(struct sftp_conn *, const char *, int,
extern char *__progname;
+int chroot_no_tree = 0;
+
/* Separators for interactive commands */
#define WHITESPACE " \t\r\n"
diff --git a/sshd_config.0 b/sshd_config.0
index 66de1fdd..e7c97e8b 100644
--- a/sshd_config.0
+++ b/sshd_config.0
@@ -256,6 +256,14 @@ DESCRIPTION
(especially those outside the jail). Misconfiguration can lead
to unsafe environments which sshd(8) cannot detect.
+ In the special case when only sftp is used, not ssh nor scp, it
+ is possible to use ChrootDirectory %h or ChrootDirectory
+ /some/path/%u. The file system containing this directory must be
+ mounted with options nodev and either nosuid or noexec. The owner
+ of the directory should be the user. The ownership of the other
+ components of the path must fulfill the usual conditions. No adi-
+ tional files are required to be present in the directory.
+
The default is M-bM-^@M-^\noneM-bM-^@M-^], indicating not to chroot(2).
Ciphers
diff --git a/sshd_config.5 b/sshd_config.5
index 70a7f3cd..595af9b5 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -429,6 +429,17 @@ Misconfiguration can lead to unsafe environments which
.Xr sshd 8
cannot detect.
.Pp
+In the special case when only sftp is used, not ssh nor scp,
+it is possible to use
+.Cm ChrootDirectory
+%h or
+.Cm ChrootDirectory
+/some/path/%u. The file system containing this directory must be
+mounted with options nodev and either nosuid or noexec. The owner of the
+directory should be the user. The ownership of the other components of the path
+must fulfill the usual conditions. No aditional files are required to be present
+in the directory.
+.Pp
The default is
.Dq none ,
indicating not to
--
2.38.0
