openssh/openssh-6.4p1-forcepermissions.patch
2014-02-08 10:47:01 +00:00

82 lines
2.6 KiB
Diff

Index: openssh-6.4p1/sftp-server.8
===================================================================
--- openssh-6.4p1.orig/sftp-server.8
+++ openssh-6.4p1/sftp-server.8
@@ -35,6 +35,7 @@
.Op Fl f Ar log_facility
.Op Fl l Ar log_level
.Op Fl u Ar umask
+.Op Fl m Ar force_file_permissions
.Sh DESCRIPTION
.Nm
is a program that speaks the server side of SFTP protocol
@@ -104,6 +105,10 @@ Sets an explicit
.Xr umask 2
to be applied to newly-created files and directories, instead of the
user's default mask.
+.It Fl m Ar force_file_permissions
+Sets explicit file permissions to be applied to newly-created files instead
+of the default or client requested mode. Numeric values include:
+777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set.
.El
.Pp
For logging to work,
Index: openssh-6.4p1/sftp-server.c
===================================================================
--- openssh-6.4p1.orig/sftp-server.c
+++ openssh-6.4p1/sftp-server.c
@@ -73,6 +73,10 @@ u_int version;
/* Disable writes */
int readonly;
+/* Force file permissions */
+int permforce = 0;
+long permforcemode;
+
/* portable attributes, etc. */
typedef struct Stat Stat;
@@ -557,6 +561,10 @@ process_open(void)
a = get_attrib();
flags = flags_from_portable(pflags);
mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
+ if (permforce == 1) {
+ mode = permforcemode;
+ (void)umask(0); /* so umask does not interfere */
+ }
logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode);
if (readonly &&
@@ -1391,7 +1399,7 @@ sftp_server_usage(void)
fprintf(stderr,
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
- "[-l log_level]\n\t[-u umask]\n",
+ "[-l log_level]\n\t[-u umask]\n[-m force_file_permissions]\n",
__progname);
exit(1);
}
@@ -1414,7 +1422,7 @@ sftp_server_main(int argc, char **argv,
pw = pwcopy(user_pw);
- while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:cehR")) != -1) {
+ while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:m:cehR")) != -1) {
switch (ch) {
case 'R':
readonly = 1;
@@ -1453,6 +1461,13 @@ sftp_server_main(int argc, char **argv,
fatal("Invalid umask \"%s\"", optarg);
(void)umask((mode_t)mask);
break;
+ case 'm':
+ permforce = 1;
+ permforcemode = strtol(optarg, &cp, 8);
+ if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
+ cp == optarg || (permforcemode == 0 && errno != 0))
+ fatal("Invalid umask \"%s\"", optarg);
+ break;
case 'h':
default:
sftp_server_usage();