MIRRORS/poky
1
0
Fork 0
mirror of git://git.yoctoproject.org/poky.git synced 2025-07-05 05:04:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

openssh: limit read access to sshd_config

Browse Source 
Enhance security by limiting read access for /etc/sshd_config to user root as it
may reveal unsecure configurations.

Reading access is limited in the install append as the default value 0644 is
hardcoded in the openssh makefile and is not configurable. Therefore the
permissions are modified in the install append.

(From OE-Core rev: a5c4897585dfcc10fc70feefaeda1bbdf4ea3847)

Signed-off-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Louis Rannou 2025-07-03 14:14:36 +02:00 committed by Richard Purdie
parent ceda35947e
commit 09a0516358
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
meta/recipes-connectivity/openssh/openssh_10.0p1.bb
View File

@ -102,7 +102,7 @@ CACHED_CONFIGUREVARS += "ac_cv_header_maillock_h=no"
do_configure:prepend () {
export LD="${CC}"
install -m 0644 ${UNPACKDIR}/sshd_config ${B}/
install -m 0600 ${UNPACKDIR}/sshd_config ${B}/
install -m 0644 ${UNPACKDIR}/ssh_config ${B}/
}
@ -153,9 +153,12 @@ do_install:append () {
install -m 644 ${UNPACKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd
install -m 0755 ${S}/contrib/ssh-copy-id ${D}${bindir}
# Limit sshd_config access to the owner (default is 0644)
chmod 0600 ${D}${sysconfdir}/ssh/sshd_config
# Create config files for read-only rootfs
install -d ${D}${sysconfdir}/ssh
install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
install -m 0600 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly
install -d ${D}${systemd_system_unitdir}
if ${@bb.utils.contains('PACKAGECONFIG','systemd-sshd-socket-mode','true','false',d)}; then