Re: ssh-agent broken with pam_ssh for xdm (+ fix for ssh-agent.c)

[Damien Miller]

Dag-Erling Smorgrav wrote:

Markus Friedl  writes:

>but shouldn't it do something like
>        seteuid(getuid());
>        setuid(getuid());
>executing ssh-agent?


It should.  It currently uses popen(3), which doesn't.  It needs
popen(3)-like functionality because it reads ssh-agent's output in
order to set $SSH_AGENT_PID and $SSH_AUTH_SOCK.  Rewriting it to use
pipe(2) + fork(2) + execve(2) so it can frob the UID after forking but
before exec'ing is possible and desirable but not trivial.  I'll see
what I can do later this week.

There is code in sftp.c::connect_to_server() which does something close to this (pipe+fork+exec w/ args), adding uid frobbage should be easy. Though it doesn't do all the signal handling of popen()...

-d


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-current" in the body of the message