- (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent

   ok dtucker

diff --git a/ChangeLog b/ChangeLog
index 2e3aaf6b5d4c4f64274d1c037bcdab9a4eadaaab..169426115aa176db717fd5f64837c0a7318bfd68 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20030303
+ - (djm) [configure.ac ssh-agent.c] Use prctl to prevent ptrace on ssh-agent
+   ok dtucker  
+
 20040229
  - (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
 

diff --git a/configure.ac b/configure.ac
index f01b639f435b3128b05ade1645a0cc57e4594184..dadcd018b5bbb976493fc3c1fe922cb18c6f7e87 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -494,10 +494,10 @@ AC_CHECK_HEADERS(bstring.h crypt.h endian.h features.h floatingpoint.h \
        netinet/in_systm.h pam/pam_appl.h paths.h pty.h readpassphrase.h \
        rpc/types.h security/pam_appl.h shadow.h stddef.h stdint.h \
        strings.h sys/strtio.h sys/audit.h sys/bitypes.h sys/bsdtty.h \
-       sys/cdefs.h sys/mman.h sys/pstat.h sys/ptms.h sys/select.h sys/stat.h \
-       sys/stream.h sys/stropts.h sys/sysmacros.h sys/time.h sys/timers.h \
-       sys/un.h time.h tmpdir.h ttyent.h usersec.h \
-       util.h utime.h utmp.h utmpx.h vis.h)
+       sys/cdefs.h sys/mman.h sys/prctl.h sys/pstat.h sys/ptms.h \
+       sys/select.h sys/stat.h sys/stream.h sys/stropts.h \
+       sys/sysmacros.h sys/time.h sys/timers.h sys/un.h time.h tmpdir.h \
+       ttyent.h usersec.h util.h utime.h utmp.h utmpx.h vis.h)
 
 # Checks for libraries.
 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
@@ -797,7 +797,7 @@ AC_CHECK_FUNCS(\
        getpeereid _getpty getrlimit getttyent glob inet_aton \
        inet_ntoa inet_ntop innetgr login_getcapbool md5_crypt memmove \
        mkdtemp mmap ngetaddrinfo nsleep ogetaddrinfo openlog_r openpty \
-       pstat readpassphrase realpath recvmsg rresvport_af sendmsg \
+       pstat prctl readpassphrase realpath recvmsg rresvport_af sendmsg \
        setdtablesize setegid setenv seteuid setgroups setlogin setpcred \
        setproctitle setregid setreuid setrlimit \
        setsid setvbuf sigaction sigvec snprintf socketpair strerror \

diff --git a/ssh-agent.c b/ssh-agent.c
index e5232fc9b70a76343f378209a89674e492ed0b5a..f5fce6b2aa016d7f2dd4d9621d2efce583ee73c8 100644 (file)
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -57,6 +57,10 @@ RCSID("$OpenBSD: ssh-agent.c,v 1.117 2003/12/02 17:01:15 markus Exp $");
 #include "scard.h"
 #endif
 
+#if defined(HAVE_SYS_PRCTL_H)
+#include <sys/prctl.h> /* For prctl() and PR_SET_DUMPABLE */
+#endif
+
 typedef enum {
        AUTH_UNUSED,
        AUTH_SOCKET,
@@ -1023,6 +1027,11 @@ main(int ac, char **av)
        setegid(getgid());
        setgid(getgid());
 
+#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
+       /* Disable ptrace on Linux without sgid bit */
+       prctl(PR_SET_DUMPABLE, 0);
+#endif
+
        SSLeay_add_all_algorithms();
 
        __progname = ssh_get_progname(av[0]);