9fans - fans of the OS Plan 9 from Bell Labs
 help / color / mirror / Atom feed
From: "Steven Stallion" <sstallion@gmail.com>
To: 9fans@9fans.net
Subject: [9fans] Re: Fun with sshsession
Date: Thu, 8 Dec 2022 18:06:21 -0600	[thread overview]
Message-ID: <65783ea3fbfc44547885aa314e993718@gunge.quuxotic.net> (raw)

[-- Attachment #1: Type: text/plain, Size: 842 bytes --]

> I found another interesting wrinkle.  It appears this issue seems to
> only affect diskless CPU servers.  I'm able to SSH successfully to my
> auth and file servers.

Mystery solved!  It turns out this was the same issue Cinap fixed in
auth/as last year.  sshsession was inheriting the host owner factotum
after capuse, which was leading to breakage on hosts other than the
file server.

I've attached (and submitted to 9legacy) a patch to address the issue
in the Labs implementation.  To wit, I was able to duplicate this
issue on every implementation of SSH v2 that's available.

Cheers,
Steve

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/Ta343100f1654631e-M32b0c9ee1d3d680c6ba88ca5
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: ssh2-factotum.diff --]
[-- Type: text/plain, Size: 1167 bytes --]

This patch corrects non-host owner filesystem permissions in
sshsession.  Prior to these changes, SSH sessions would inherit the
host owner factotum, which lead to incorrect permissions on hosts
other than the file server.

These changes are similar to those submitted by Cinap Lenrek to
address a related issue in auth/as:

https://git.9front.org/plan9front/plan9front/55a0abdd439964793a5ebceb23776d162a0436d2/patch

--- /n/sources/plan9/sys/src/cmd/ssh2/sshsession.c	Sun May  6 14:55:41 2012
+++ /sys/src/cmd/ssh2/sshsession.c	Thu Dec  8 17:14:10 2022
@@ -89,6 +89,27 @@
 }
 
 /*
+ * mount factotum after auth
+ */
+static void
+mountfactotum(int ctlfd)
+{
+	int fd;
+
+	fd = open("/srv/factotum", ORDWR);
+	if (fd < 0) {
+		syslog(0, "ssh", "can't open /srv/factotum: %r");
+		hangup(ctlfd);
+		exits("open");
+	}
+	if (mount(fd, -1, "/mnt", MREPL, "") < 0) {
+		syslog(0, "ssh", "can't mount /srv/factotum in /mnt: %r");
+		hangup(ctlfd);
+		exits("can't mount");
+	}
+}
+
+/*
  * mount tunnel if there isn't one visible.
  */
 static void
@@ -135,6 +156,7 @@
 		return 0;
 
 	auth(buf, n, ctlfd);
+	mountfactotum(ctlfd);
 
 	p = strchr(buf, '@');
 	if (p == nil)

             reply	other threads:[~2022-12-09  0:06 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-09  0:06 Steven Stallion [this message]
2022-12-19 22:27 ` Brian L. Stuart
2023-01-03 19:07   ` Steven Stallion
  -- strict thread matches above, loose matches on Subject: below --
2022-12-07 17:36 Steven Stallion
2022-12-07 18:39 ` michaelian ennis
2022-12-07 18:41   ` Steven Stallion

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=65783ea3fbfc44547885aa314e993718@gunge.quuxotic.net \
    --to=sstallion@gmail.com \
    --cc=9fans@9fans.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).