[MacPorts] #47798: openssh sandboxing broken on 10.10
#47798: openssh sandboxing broken on 10.10 ---------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Keywords: | Port: openssh ---------------------+-------------------------------- Macports openssh sshd with UsePrivilegeSeparation sandbox (the default) fails on 10.10 with "chroot("/opt/local/var/empty"): Operation not permitted [preauth]" System log says: sandboxd[587] ([36016]): sshd(36016) deny file-read- metadata /opt I verified that "UsePrivilegeSeparation yes" works, and also that re- building with --with-privsep-path=/var/empty also works. (We could probably also alter the sandbox file that we ship, but I'm not sure it's necessary for us to have our own /var/empty sitting in $prefix). -- Ticket URL: <https://trac.macports.org/ticket/47798> MacPorts <https://www.macports.org/> Ports system for OS X
#47798: openssh sandboxing broken on 10.10 ----------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Resolution: | Keywords: Port: openssh | ----------------------+-------------------------------- Comment (by dluke@…): If there are no objections, I'll commit this (if there's a good reason to use our own ${prefix}/var/empty instead, let me know - preferably with a tested patch to the sandbox file ;-) ). -- Ticket URL: <https://trac.macports.org/ticket/47798#comment:1> MacPorts <https://www.macports.org/> Ports system for OS X
#47798: openssh sandboxing broken on 10.10 ----------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Resolution: | Keywords: Port: openssh | ----------------------+-------------------------------- Comment (by cal@…): As the guy that originally fixed the sandboxing a while ago, this looks good to me. -- Ticket URL: <https://trac.macports.org/ticket/47798#comment:2> MacPorts <https://www.macports.org/> Ports system for OS X
#47798: openssh sandboxing broken on 10.10 ----------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: new Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Resolution: | Keywords: Port: openssh | ----------------------+-------------------------------- Comment (by dluke@…): thanks for the review - committed in r136548 -- Ticket URL: <https://trac.macports.org/ticket/47798#comment:3> MacPorts <https://www.macports.org/> Ports system for OS X
#47798: openssh sandboxing broken on 10.10 ----------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Resolution: fixed | Keywords: Port: openssh | ----------------------+-------------------------------- Changes (by dluke@…): * status: new => closed * resolution: => fixed -- Ticket URL: <https://trac.macports.org/ticket/47798#comment:4> MacPorts <https://www.macports.org/> Ports system for OS X
#47798: openssh sandboxing broken on 10.10 ----------------------+-------------------------------- Reporter: dluke@… | Owner: macports-tickets@… Type: defect | Status: closed Priority: Normal | Milestone: Component: ports | Version: 2.3.3 Resolution: fixed | Keywords: Port: openssh | ----------------------+-------------------------------- Comment (by ionic@…): Hmm, no idea. Maybe it's not a bad idea to have this stuff separated completely, but then again the difference should be nil. The directory is empty and presumably only used for chrooting. As long as you do not change the run dir, go ahead. -- Ticket URL: <https://trac.macports.org/ticket/47798#comment:5> MacPorts <https://www.macports.org/> Ports system for OS X
participants (1)
-
MacPorts