-diff -ruNp openssh-9.8p1.orig/servconf.c openssh-9.8p1/servconf.c
---- openssh-9.8p1.orig/servconf.c 2024-07-01 06:36:28.000000000 +0200
-+++ openssh-9.8p1/servconf.c 2024-07-01 11:17:17.929993456 +0200
-@@ -94,6 +94,8 @@ initialize_server_options(ServerOptions
- options->use_pam = -1;
- options->pam_service_name = NULL;
-
-+ options->use_chroot = -1;
-+
- /* Standard Options */
- options->num_ports = 0;
- options->ports_from_cmdline = 0;
-@@ -299,6 +301,9 @@ fill_default_server_options(ServerOption
- if (options->pam_service_name == NULL)
- options->pam_service_name = xstrdup(SSHD_PAM_SERVICE);
-
-+ if (options->use_chroot == -1)
-+ options->use_chroot = 0;
-+
- /* Standard Options */
- if (options->num_host_key_files == 0) {
- /* fill default hostkeys for protocols */
-@@ -538,6 +543,7 @@ typedef enum {
- sBadOption, /* == unknown option */
- /* Portable-specific options */
- sUsePAM, sPAMServiceName,
-+ sUseChroot,
- /* Standard Options */
- sPort, sHostKeyFile, sLoginGraceTime,
- sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
-@@ -595,6 +601,11 @@ static struct {
- { "usepam", sUnsupported, SSHCFG_GLOBAL },
- { "pamservicename", sUnsupported, SSHCFG_ALL },
- #endif
-+#ifdef CHROOT
-+ { "usechroot", sUseChroot, SSHCFG_GLOBAL },
-+#else
-+ { "usechroot", sUnsupported, SSHCFG_GLOBAL },
-+#endif /* CHROOT */
- { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
- /* Standard Options */
- { "port", sPort, SSHCFG_GLOBAL },
-@@ -1338,6 +1349,10 @@ process_server_config_line_depth(ServerO
+--- openssh-10.4p1.orig/servconf.c 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/servconf.c 2026-07-06 21:23:34.091821111 +0200
+@@ -1185,6 +1185,11 @@ process_server_config_line_depth(ServerO
*charptr = xstrdup(arg);
break;
-
+ #endif
++#ifdef CHROOT
+ case sUseChroot:
+ intptr = &options->use_chroot;
+ goto parse_flag;
-+
++#endif
+
/* Standard Options */
case sBadOption:
- goto out;
-diff -urNp -x '*.orig' openssh-8.8p1.org/servconf.h openssh-8.8p1/servconf.h
---- openssh-8.8p1.org/servconf.h 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/servconf.h 2021-12-09 20:13:16.486586503 +0100
-@@ -183,6 +183,7 @@ typedef struct {
- int max_authtries;
- int max_sessions;
- char *banner; /* SSH-2 banner message */
-+ int use_chroot; /* Enable chrooted enviroment support */
- int use_dns;
- int client_alive_interval; /*
- * poke the client this often to
-diff -urNp -x '*.orig' openssh-8.8p1.org/session.c openssh-8.8p1/session.c
---- openssh-8.8p1.org/session.c 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/session.c 2021-12-09 20:13:16.489919836 +0100
-@@ -1359,6 +1359,10 @@ void
+--- openssh-10.4p1.orig/servconf.h 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/servconf.h 2026-07-06 21:23:28.301821115 +0200
+@@ -268,6 +268,7 @@ SSHCONF_ALIAS(KeepAlive, TCPKeepAlive, S
+ SSHD_CONFIG_ENTRIES_LEGACY \
+ SSHD_CONFIG_ENTRIES_ALIASES \
+ SSHD_CONFIG_ENTRIES_PAM \
++ SSHD_CONFIG_ENTRIES_CHROOT \
+ SSHD_CONFIG_ENTRIES_LASTLOG
+
+ #ifdef USE_PAM
+@@ -280,6 +281,14 @@ SSHCONF_UNSUPPORTED_INT(use_pam, UsePAM,
+ SSHCONF_UNSUPPORTED_STRING(pam_service_name, PAMServiceName, SSHCFG_ALL)
+ #endif
+
++#ifdef CHROOT
++#define SSHD_CONFIG_ENTRIES_CHROOT \
++SSHCONF_INTFLAG(use_chroot, UseChroot, SSHCFG_GLOBAL, 0, SSHCFG_COPY_NONE)
++#else
++#define SSHD_CONFIG_ENTRIES_CHROOT \
++SSHCONF_UNSUPPORTED_INT(use_chroot, UseChroot, SSHCFG_GLOBAL)
++#endif
++
+ #ifdef DISABLE_LASTLOG
+ #define SSHD_CONFIG_ENTRIES_LASTLOG \
+ SSHCONF_UNSUPPORTED_INT(print_lastlog, PrintLastLog, SSHCFG_GLOBAL)
+--- openssh-10.4p1.orig/session.c 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/session.c 2026-07-06 21:22:56.644136453 +0200
+@@ -1316,6 +1316,10 @@ void
do_setusercontext(struct passwd *pw)
{
char uidstr[32], *chroot_path, *tmp;
platform_setusercontext(pw);
-@@ -1401,6 +1405,29 @@ do_setusercontext(struct passwd *pw)
+@@ -1358,6 +1362,29 @@ do_setusercontext(struct passwd *pw)
free(options.chroot_directory);
options.chroot_directory = NULL;
in_chroot = 1;
}
#ifdef HAVE_LOGIN_CAP
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config openssh-8.8p1/sshd_config
---- openssh-8.8p1.org/sshd_config 2021-12-09 20:13:16.326586503 +0100
-+++ openssh-8.8p1/sshd_config 2021-12-09 20:13:16.489919836 +0100
-@@ -85,6 +85,10 @@ GSSAPIAuthentication yes
+--- openssh-10.4p1.orig/sshd_config 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/sshd_config 2026-07-06 21:22:56.644685847 +0200
+@@ -83,6 +83,10 @@ AuthorizedKeysFile .ssh/authorized_keys
# and KbdInteractiveAuthentication to 'no'.
#UsePAM no
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config.0 openssh-8.8p1/sshd_config.0
---- openssh-8.8p1.org/sshd_config.0 2021-09-26 16:06:42.000000000 +0200
-+++ openssh-8.8p1/sshd_config.0 2021-12-09 20:13:16.489919836 +0100
-@@ -1053,6 +1053,16 @@ DESCRIPTION
+--- openssh-10.4p1.orig/sshd_config.0 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/sshd_config.0 2026-07-06 21:22:56.645435161 +0200
+@@ -1309,6 +1309,16 @@ DESCRIPTION
open channels. This option may be useful in conjunction with
ChannelTimeout.
UseDNS Specifies whether sshd(8) should look up the remote host name,
and to check that the resolved host name for the remote IP
address maps back to the very same IP address.
-diff -urNp -x '*.orig' openssh-8.8p1.org/sshd_config.5 openssh-8.8p1/sshd_config.5
---- openssh-8.8p1.org/sshd_config.5 2021-09-26 16:03:19.000000000 +0200
-+++ openssh-8.8p1/sshd_config.5 2021-12-09 20:13:16.489919836 +0100
-@@ -1697,6 +1697,16 @@ Gives the facility code that is used whe
+--- openssh-10.4p1.orig/sshd_config.5 2026-07-06 09:57:12.000000000 +0200
++++ openssh-10.4p1/sshd_config.5 2026-07-06 21:22:56.646363281 +0200
+@@ -1982,6 +1982,16 @@ Gives the facility code that is used whe
The possible values are: DAEMON, USER, AUTH, LOCAL0, LOCAL1, LOCAL2,
LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7.
The default is AUTH.
+++ /dev/null
-diff -urNp -x '*.orig' openssh-8.4p1.org/clientloop.c openssh-8.4p1/clientloop.c
---- openssh-8.4p1.org/clientloop.c 2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1/clientloop.c 2021-03-01 11:29:10.909905265 +0100
-@@ -127,6 +127,9 @@ extern int fork_after_authentication_fla
- /* Control socket */
- extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
-
-+/* if we process SIGPIPE */
-+extern int enable_sigpipe;
-+
- /*
- * Name of the host we are connecting to. This is the name given on the
- * command line, or the Hostname specified for the user-supplied name in a
-@@ -1518,6 +1518,8 @@ client_loop(struct ssh *ssh, int have_pt
- ssh_signal(SIGQUIT, signal_handler);
- if (ssh_signal(SIGTERM, SIG_IGN) != SIG_IGN)
- ssh_signal(SIGTERM, signal_handler);
-+ if (enable_sigpipe)
-+ ssh_signal(SIGPIPE, signal_handler);
- ssh_signal(SIGWINCH, window_change_handler);
- #ifdef SIGINFO
- ssh_signal(SIGINFO, siginfo_handler);
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh.0 openssh-8.4p1/ssh.0
---- openssh-8.4p1.org/ssh.0 2020-09-27 09:42:10.000000000 +0200
-+++ openssh-8.4p1/ssh.0 2021-03-01 11:29:10.909905265 +0100
-@@ -446,6 +446,8 @@ DESCRIPTION
- -y Send log information using the syslog(3) system module. By
- default this information is sent to stderr.
-
-+ -Z Enable SIGPIPE processing.
-+
- ssh may additionally obtain configuration data from a per-user
- configuration file and a system-wide configuration file. The file format
- and configuration options are described in ssh_config(5).
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh.1 openssh-8.4p1/ssh.1
---- openssh-8.4p1.org/ssh.1 2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1/ssh.1 2021-03-01 11:29:10.909905265 +0100
-@@ -42,7 +42,7 @@
- .Nd OpenSSH remote login client
- .Sh SYNOPSIS
- .Nm ssh
--.Op Fl 46AaCfGgKkMNnqsTtVvXxYy
-+.Op Fl 46AaCfGgKkMNnqsTtVvXxYyZ
- .Op Fl B Ar bind_interface
- .Op Fl b Ar bind_address
- .Op Fl c Ar cipher_spec
-@@ -142,6 +142,11 @@ on the local machine as the source addre
- of the connection.
- Only useful on systems with more than one address.
- .Pp
-+.It Fl Z
-+Enables processing of SIGPIPE. Useful when using ssh output as input for
-+another process, for example in a shell script. Be careful - it may break
-+port/X11 forwarding when used.
-+.Pp
- .It Fl C
- Requests compression of all data (including stdin, stdout, stderr, and
- data for forwarded X11, TCP and
-diff -urNp -x '*.orig' openssh-8.4p1.org/ssh.c openssh-8.4p1/ssh.c
---- openssh-8.4p1.org/ssh.c 2020-09-27 09:25:01.000000000 +0200
-+++ openssh-8.4p1/ssh.c 2021-03-01 11:29:10.909905265 +0100
-@@ -190,6 +190,9 @@ struct sshbuf *command;
- /* command to be executed */
- struct sshbuf *command;
-
-+/* Enable sigpipe */
-+int enable_sigpipe = 0;
-+
- /* # of replies received for global requests */
- static int forward_confirms_pending = -1;
-
-@@ -203,7 +206,7 @@ static void
- usage(void)
- {
- fprintf(stderr,
--"usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface] [-b bind_address]\n"
-+"usage: ssh [-46AaCfGgKkMNnqsTtVvXxYyZ] [-B bind_interface] [-b bind_address]\n"
- " [-c cipher_spec] [-D [bind_address:]port] [-E log_file]\n"
- " [-e escape_char] [-F configfile] [-I pkcs11] [-i identity_file]\n"
- " [-J destination] [-L address] [-l login_name] [-m mac_spec]\n"
-@@ -699,7 +699,7 @@ main(int ac, char **av)
-
- again:
- while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx"
-- "AB:CD:E:F:GI:J:KL:MNO:P:Q:R:S:TVw:W:XYy")) != -1) { /* HUZdhjruz */
-+ "AB:CD:E:F:GI:J:KL:MNO:P:Q:R:S:TVw:W:XYyZ")) != -1) { /* HUZdhjruz */
- switch (opt) {
- case '1':
- fatal("SSH protocol v.1 is no longer supported");
-@@ -1066,6 +1069,9 @@ main(int ac, char **av)
- case 'F':
- config = optarg;
- break;
-+ case 'Z':
-+ enable_sigpipe = 1;
-+ break;
- default:
- usage();
- }
TLD / packages / openssh.git / commitdiff