disable features when post-auth sshd runs as root

On platforms that require root privilege for the post-authentication
sshd-session process (e.g. OpenServer 5, QNX 6), disable and restrict
a number of features that assume user privilege.

This includes GatewayPorts, StreamLocalForwarding and -R forwardings
binding to ports <1024

channels.c

@@ -4344,6 +4344,14 @@ check_rfwd_permission(struct ssh *ssh, struct Forward *fwd)
 	u_int i, permit, permit_adm = 1;
 	struct permission *perm;
 
+#ifdef SKIP_PRIVDROP
+	if (fwd->listen_path != NULL)
+		return 0;
+	if (allowed_open->listen_port != FWD_PERMIT_ANY_PORT &&
+	    allowed_open->listen_port < 1024)
+		return 0;
+#endif
+
 	/* XXX apply GatewayPorts override before checking? */
 
 	permit = pset->all_permitted;

defines.h

@@ -1007,4 +1007,20 @@ struct winsize {
 # endif
 #endif
 
+/*
+ * Hack for systems that don't support FD passing: retain privileges
+ * in the post-auth privsep process so it can allocate PTYs directly.
+ *
+ * Instead of doing what we did <= 9.7, which was to disable post-auth
+ * privsep entirely, we run with temporarily_use_uid, restoring root
+ * only to allocate ptys or in the child to permanently change UID.
+ *
+ * Cygwin doesn't need to drop privs here although it doesn't support
+ * fd passing, as AFAIK PTY allocation on this platform doesn't require
+ * special privileges to begin with.
+ */
+#if defined(DISABLE_FD_PASSING) && !defined(HAVE_CYGWIN)
+# define SKIP_PRIVDROP 1
+#endif
+
 #endif /* _DEFINES_H */

servconf.c

@@ -273,6 +273,18 @@ fill_default_server_options(ServerOptions *options)
 {
 	u_int i;
 
+	/* Portable-specific overrides */
+#ifdef SKIP_PRIVDROP
+	if (options->allow_streamlocal_forwarding != -1 &&
+	    options->allow_streamlocal_forwarding != FORWARD_DENY)
+		logit("StreamlocalForwarding is not supported on this system");
+	options->allow_streamlocal_forwarding = 0;
+	if (options->fwd_opts.gateway_ports != -1 &&
+	    options->fwd_opts.gateway_ports == 0)
+		logit("GatewayPorts is not supported on this system");
+	options->fwd_opts.gateway_ports = 0;
+#endif
+
 #define SSHCONF_INT(var, conf, flags, ms, def, cp) \
 	if (options->var == -1) \
 		options->var = def;

sshd-session.c

@@ -371,21 +371,6 @@ privsep_preauth(struct ssh *ssh)
 static void
 privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
 {
-	int skip_privdrop = 0;
-
-	/*
-	 * Hack for systems that don't support FD passing: retain privileges
-	 * in the post-auth privsep process so it can allocate PTYs directly.
-	 * This is basically equivalent to what we did <= 9.7, which was to
-	 * disable post-auth privsep entirely.
-	 * Cygwin doesn't need to drop privs here although it doesn't support
-	 * fd passing, as AFAIK PTY allocation on this platform doesn't require
-	 * special privileges to begin with.
-	 */
-#if defined(DISABLE_FD_PASSING) && !defined(HAVE_CYGWIN)
-	skip_privdrop = 1;
-#endif
-
 	/* New socket pair */
 	monitor_reinit(pmonitor);
 
@@ -412,9 +397,10 @@ privsep_postauth(struct ssh *ssh, Authctxt *authctxt)
 
 	reseed_prngs();
 
+#ifndef SKIP_PRIVDROP
 	/* Drop privileges */
-	if (!skip_privdrop)
-		do_setusercontext(authctxt->pw);
+	do_setusercontext(authctxt->pw);
+#endif
 
 	/* It is safe now to apply the key state */
 	monitor_apply_keystate(ssh, pmonitor);