Skip to contentSkip to conversation

package/openssh: Add tmpfiles.d snippet to create /var/empty

PATCH Superseded Chris Lesiak 2 participants 3 messages Feb 6, 2018 – Dec 16, 2018

lore
Share & tools
lore

Chris Lesiak

author
#0 lore raw

PATCH v2 1/1 package/openssh: Add tmpfiles.d snippet to create /var/empty

This is useful in volatile or stateless systems in which /var is empty.

Signed-off-by Chris Lesiak <[email protected]>

---
Changes v1 --> v2
- Use 0755 as the permission of /var/empty as suggested by Samual Martin <[email protected]> and the README.privsep included with openssh-7.6p1.

---
 package/openssh/openssh.mk        | 2 ++
 package/openssh/ssh_tmpfiles.conf | 1 +
 2 files changed, 3 insertions(+)
 create mode 100644 package/openssh/ssh_tmpfiles.conf
package/openssh/openssh.mk +2 -0
index fc82300ab7..bb43b2edec 100644
@@ -73,6 +73,8 @@ define OPENSSH_INSTALL_INIT_SYSTEMD
 	mkdir -p $(TARGET_DIR)/etc/systemd/system/multi-user.target.wants
 	ln -fs ../../../../usr/lib/systemd/system/sshd.service \
 		$(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/sshd.service
+	$(INSTALL) -m 0644 -D package/openssh/ssh_tmpfiles.conf \
+		$(TARGET_DIR)/usr/lib/tmpfiles.d/ssh.conf
 	$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
 endef
package/openssh/ssh_tmpfiles.conf new file +1 -0
new file mode 100644
index 0000000000..ca2a393542
@@ -0,0 +1 @@
+d /var/empty 0755 root root
Signature · 1 line
2.13.6
author
#1 lore raw

PATCH v3 1/1 package/openssh: Add tmpfiles.d snippet to create /var/empty

The openssh privilege separation feature, enabled by default, requires that the path /var/empty exist; see README.privsep included as part of the openssh distribution.

On a volatile or stateless system, that path might not exist. Use systemd-tmpfiles (if enabled) to ensure that the path exists and has the correct permissions.

Signed-off-by Chris Lesiak <[email protected]>

---
Changes v2 --> v3
- Provide a more detailed explanation as suggested by Arnout Vandecappelle<[email protected]>.
- Only bother if BR2_PACKAGE_SYSTEMD_TMPFILES=y
Changes v1 --> v2
- Use 0755 as the permission of /var/empty as suggested by Samual Martin <[email protected]> and the README.privsep included with openssh-7.6p1.

---
 package/openssh/openssh.mk        | 8 ++++++++
 package/openssh/ssh_tmpfiles.conf | 1 +
 2 files changed, 9 insertions(+)
 create mode 100644 package/openssh/ssh_tmpfiles.conf
package/openssh/openssh.mk +8 -0
index 5d099ceb13..cdafdedae4 100644
@@ -67,6 +67,13 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_SYSTEMD_TMPFILES),y)
+define OPENSSH_INSTALL_SYSTEMD_TMPFILES
+	$(INSTALL) -m 0644 -D package/openssh/ssh_tmpfiles.conf \
+		$(TARGET_DIR)/usr/lib/tmpfiles.d/ssh.conf
+endef
+endif
+
 define OPENSSH_INSTALL_INIT_SYSTEMD
 	$(INSTALL) -D -m 644 package/openssh/sshd.service \
 		$(TARGET_DIR)/usr/lib/systemd/system/sshd.service

@@ -74,6 +81,7 @@ define OPENSSH_INSTALL_INIT_SYSTEMD
 	ln -fs ../../../../usr/lib/systemd/system/sshd.service \
 		$(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/sshd.service
 	$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
+	$(OPENSSH_INSTALL_SYSTEMD_TMPFILES)
 endef
 
 define OPENSSH_INSTALL_INIT_SYSV
package/openssh/ssh_tmpfiles.conf new file +1 -0
new file mode 100644
index 0000000000..ca2a393542
@@ -0,0 +1 @@
+d /var/empty 0755 root root
Signature · 1 line
2.14.3
#2 lore raw

PATCH v3 1/1 package/openssh: Add tmpfiles.d snippet to create /var/empty

Chris, All,

On 2018-02-16 12:11 -0600, Chris Lesiak spake thusly:

Quoted 9 lines

The openssh privilege separation feature, enabled by default, requires that the path /var/empty exist; see README.privsep included as part of the openssh distribution.

On a volatile or stateless system, that path might not exist. Use systemd-tmpfiles (if enabled) to ensure that the path exists and has the correct permissions.

Signed-off-by Chris Lesiak <[email protected]>
Reviewed-by "Yann E. MORIN" <[email protected]>

nd it does work currently, because openssh does create /var/empty at build time, except it may have incorrect rights). Care to add a follow-up patch that sets appropriate rights (with OPENSSH_PERMISSIONS), please?

Note: currently, the rights *are* correct, because we enforce the umask, or because openssh' install procedure creates it correctly. But there is no guarantee that either will still be the case in the future (hint: the umask we may drop shortly!).

Regards,
Yann E. MORIN.

Quoted 55 lines

---
Changes v2 --> v3
- Provide a more detailed explanation as suggested by Arnout Vandecappelle<[email protected]>.
- Only bother if BR2_PACKAGE_SYSTEMD_TMPFILES=y
Changes v1 --> v2
- Use 0755 as the permission of /var/empty as suggested by Samual Martin <[email protected]> and the README.privsep included with openssh-7.6p1.

---
 package/openssh/openssh.mk        | 8 ++++++++
 package/openssh/ssh_tmpfiles.conf | 1 +
 2 files changed, 9 insertions(+)
 create mode 100644 package/openssh/ssh_tmpfiles.conf
package/openssh/openssh.mk +8 -0
index 5d099ceb13..cdafdedae4 100644
@@ -67,6 +67,13 @@ define OPENSSH_INSTALL_SYSTEMD_SYSUSERS
 endef
 endif
 
+ifeq ($(BR2_PACKAGE_SYSTEMD_TMPFILES),y)
+define OPENSSH_INSTALL_SYSTEMD_TMPFILES
+	$(INSTALL) -m 0644 -D package/openssh/ssh_tmpfiles.conf \
+		$(TARGET_DIR)/usr/lib/tmpfiles.d/ssh.conf
+endef
+endif
+
 define OPENSSH_INSTALL_INIT_SYSTEMD
 	$(INSTALL) -D -m 644 package/openssh/sshd.service \
 		$(TARGET_DIR)/usr/lib/systemd/system/sshd.service

@@ -74,6 +81,7 @@ define OPENSSH_INSTALL_INIT_SYSTEMD
 	ln -fs ../../../../usr/lib/systemd/system/sshd.service \
 		$(TARGET_DIR)/etc/systemd/system/multi-user.target.wants/sshd.service
 	$(OPENSSH_INSTALL_SYSTEMD_SYSUSERS)
+	$(OPENSSH_INSTALL_SYSTEMD_TMPFILES)
 endef
 
 define OPENSSH_INSTALL_INIT_SYSV
package/openssh/ssh_tmpfiles.conf new file +1 -0
new file mode 100644
index 0000000000..ca2a393542
@@ -0,0 +1 @@
+d /var/empty 0755 root root
Signature · 6 lines
2.14.3

_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'