openssh/patches/openssh-5.8p1-keyperm.patch

   1 diff -up openssh-5.8p1/authfile.c.keyperm openssh-5.8p1/authfile.c
   2 --- openssh-5.8p1/authfile.c.keyperm    2010-12-01 02:03:39.000000000 +0100
   3 +++ openssh-5.8p1/authfile.c    2011-04-21 16:43:36.859648916 +0200
   4 @@ -57,6 +57,7 @@
   5  #include <stdlib.h>
   6  #include <string.h>
   7  #include <unistd.h>
   8 +#include <grp.h>
   9
  10  #include "xmalloc.h"
  11  #include "cipher.h"
  12 @@ -600,6 +612,13 @@ key_perm_ok(int fd, const char *filename
  13  #ifdef HAVE_CYGWIN
  14         if (check_ntsec(filename))
  15  #endif
  16 +       if (st.st_mode & 040) {
  17 +               struct group *gr;
  18 +
  19 +               if ((gr = getgrnam("ssh_keys")) && (st.st_gid == gr->gr_gid))
  20 +                       st.st_mode &= ~040;
  21 +       }
  22 +
  23         if ((st.st_uid == getuid()) && (st.st_mode & 077) != 0) {
  24                 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
  25                 error("@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @");