upstream: don't sigdie() in signal handler in privsep child process;

this can end up causing sandbox violations per bz3286; ok dtucker@

OpenBSD-Commit-ID: a7f40b2141dca4287920da68ede812bff7ccfdda

diff --git a/sshd.c b/sshd.c
index 5aa04d0507c0cf4ffee6354a4e38d757f2250b50..88497f5f2aae52e623a181b2b3bf6215e1b49bde 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.572 2021/04/03 06:18:41 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.573 2021/05/07 03:09:38 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -366,11 +366,14 @@ grace_alarm_handler(int sig)
                kill(0, SIGTERM);
        }
 
-       /* XXX pre-format ipaddr/port so we don't need to access active_state */
        /* Log error and exit. */
-       sigdie("Timeout before authentication for %s port %d",
-           ssh_remote_ipaddr(the_active_state),
-           ssh_remote_port(the_active_state));
+       if (use_privsep && pmonitor != NULL && pmonitor->m_pid <= 0)
+               cleanup_exit(255); /* don't log in privsep child */
+       else {
+               sigdie("Timeout before authentication for %s port %d",
+                   ssh_remote_ipaddr(the_active_state),
+                   ssh_remote_port(the_active_state));
+       }
 }
 
 /* Destroy the host and server keys.  They will no longer be needed. */