Skip to content

Commit c76fac6

Browse files
committed
disable Unix-domain socket forwarding when privsep is disabled
1 parent 022c978 commit c76fac6

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

Diff for: usr.bin/ssh/serverloop.c

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: serverloop.c,v 1.188 2016/11/30 03:00:05 djm Exp $ */
1+
/* $OpenBSD: serverloop.c,v 1.189 2016/12/14 00:36:34 djm Exp $ */
22
/*
33
* Author: Tatu Ylonen <ylo@cs.hut.fi>
44
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -472,7 +472,8 @@ server_request_direct_streamlocal(void)
472472

473473
/* XXX fine grained permissions */
474474
if ((options.allow_streamlocal_forwarding & FORWARD_LOCAL) != 0 &&
475-
!no_port_forwarding_flag && !options.disable_forwarding) {
475+
!no_port_forwarding_flag && !options.disable_forwarding &&
476+
use_privsep) {
476477
c = channel_connect_to_path(target,
477478
"direct-streamlocal@openssh.com", "direct-streamlocal");
478479
} else {
@@ -748,7 +749,8 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
748749

749750
/* check permissions */
750751
if ((options.allow_streamlocal_forwarding & FORWARD_REMOTE) == 0
751-
|| no_port_forwarding_flag || options.disable_forwarding) {
752+
|| no_port_forwarding_flag || options.disable_forwarding ||
753+
!use_privsep) {
752754
success = 0;
753755
packet_send_debug("Server has disabled port forwarding.");
754756
} else {

0 commit comments

Comments
 (0)