openkylin
/
openssh
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Document consequences of ssh-agent being setgid in ssh-agent(1) 

Bug-Debian: http://bugs.debian.org/711623
Forwarded: no
Last-Update: 2020-02-21

Patch-Name: ssh-agent-setgid.patch

Gbp-Pq: Name ssh-agent-setgid.patch
This commit is contained in:
Colin Watson 2014-02-09 16:10:13 +00:00 committed by Lu zhiping
parent de4759ea28
commit d595449837
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ssh-agent.1
View File

@ -201,6 +201,21 @@ socket and stores its pathname in this variable.
It is accessible only to the current user, It is accessible only to the current user,
but is easily abused by root or another instance of the same user. but is easily abused by root or another instance of the same user.
.El .El
.Pp
In Debian,
.Nm
is installed with the set-group-id bit set, to prevent
.Xr ptrace 2
attacks retrieving private key material.
This has the side-effect of causing the run-time linker to remove certain
environment variables which might have security implications for set-id
programs, including
.Ev LD_PRELOAD ,
.Ev LD_LIBRARY_PATH ,
and
.Ev TMPDIR .
If you need to set any of these environment variables, you will need to do
so in the program executed by ssh-agent.
.Sh FILES .Sh FILES
.Bl -tag -width Ds .Bl -tag -width Ds
.It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid> .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.<ppid>