Accepting request 221224 from home:namtrac:bugfix

- Add openssh-6.2p1-forcepermissions.patch to implement a force
  permissions mode (fate#312774). The patch is based on
  http://marc.info/?l=openssh-unix-dev&m=128896838930893

OBS-URL: https://build.opensuse.org/request/show/221224
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=59

openssh-6.4p1-forcepermissions.patch

@@ -0,0 +1,81 @@
+Index: openssh-6.4p1/sftp-server.8
+===================================================================
+--- openssh-6.4p1.orig/sftp-server.8
++++ openssh-6.4p1/sftp-server.8
+@@ -35,6 +35,7 @@
+ .Op Fl f Ar log_facility
+ .Op Fl l Ar log_level
+ .Op Fl u Ar umask
++.Op Fl m Ar force_file_permissions
+ .Sh DESCRIPTION
+ .Nm
+ is a program that speaks the server side of SFTP protocol
+@@ -104,6 +105,10 @@ Sets an explicit
+ .Xr umask 2
+ to be applied to newly-created files and directories, instead of the
+ user's default mask.
++.It Fl m Ar force_file_permissions
++Sets explicit file permissions to be applied to newly-created files instead
++of the default or client requested mode.  Numeric values include:
++777, 755, 750, 666, 644, 640, etc.  Option -u is ineffective if -m is set.
+ .El
+ .Pp
+ For logging to work,
+Index: openssh-6.4p1/sftp-server.c
+===================================================================
+--- openssh-6.4p1.orig/sftp-server.c
++++ openssh-6.4p1/sftp-server.c
+@@ -73,6 +73,10 @@ u_int version;
+ /* Disable writes */
+ int readonly;
+ 
++/* Force file permissions */
++int permforce = 0;
++long permforcemode;
++
+ /* portable attributes, etc. */
+ 
+ typedef struct Stat Stat;
+@@ -557,6 +561,10 @@ process_open(void)
+ 	a = get_attrib();
+ 	flags = flags_from_portable(pflags);
+ 	mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
++    if (permforce == 1) {
++        mode = permforcemode;
++        (void)umask(0); /* so umask does not interfere */
++    }
+ 	logit("open \"%s\" flags %s mode 0%o",
+ 	    name, string_from_portable(pflags), mode);
+ 	if (readonly &&
+@@ -1391,7 +1399,7 @@ sftp_server_usage(void)
+ 
+ 	fprintf(stderr,
+ 	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
+-	    "[-l log_level]\n\t[-u umask]\n",
++	    "[-l log_level]\n\t[-u umask]\n[-m force_file_permissions]\n",
+ 	    __progname);
+ 	exit(1);
+ }
+@@ -1414,7 +1422,7 @@ sftp_server_main(int argc, char **argv,
+ 
+ 	pw = pwcopy(user_pw);
+ 
+-	while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:cehR")) != -1) {
++	while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:m:cehR")) != -1) {
+ 		switch (ch) {
+ 		case 'R':
+ 			readonly = 1;
+@@ -1453,6 +1461,13 @@ sftp_server_main(int argc, char **argv,
+ 				fatal("Invalid umask \"%s\"", optarg);
+ 			(void)umask((mode_t)mask);
+ 			break;
++        case 'm':
++            permforce = 1;
++            permforcemode = strtol(optarg, &cp, 8);
++            if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
++                cp == optarg || (permforcemode == 0 && errno != 0))
++                fatal("Invalid umask \"%s\"", optarg);
++            break;
+ 		case 'h':
+ 		default:
+ 			sftp_server_usage();

openssh.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Feb  5 08:38:11 UTC 2014 - idonmez@suse.com
+
+- Add openssh-6.2p1-forcepermissions.patch to implement a force
+  permissions mode (fate#312774). The patch is based on
+  http://marc.info/?l=openssh-unix-dev&m=128896838930893
+
 -------------------------------------------------------------------
 Fri Jan 24 15:13:09 UTC 2014 - pcerny@suse.com
 

openssh.spec

@@ -137,7 +137,7 @@ Patch30:        openssh-6.4p1-disable-openssl-abi-check.patch
 Patch31:        openssh-6.4p1-no_fork-no_pid_file.patch
 Patch32:        openssh-6.4p1-host_ident.patch
 Patch33:        openssh-6.4p1-sftp_homechroot.patch
-
+Patch34:        openssh-6.4p1-forcepermissions.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -195,6 +195,7 @@ Helper applications for OpenSSH which retrieve keys from various sources.
 %patch31 -p2
 %patch32 -p2
 %patch33 -p2
+%patch34 -p1
 cp %{SOURCE3} %{SOURCE4} .
 
 %build