NetBSD Problem Report #60367

From www@netbsd.org  Thu Jun 25 11:34:26 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 031601A923A
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 25 Jun 2026 11:34:26 +0000 (UTC)
Message-Id: <20260625113425.1D1511A923B@mollari.NetBSD.org>
Date: Thu, 25 Jun 2026 11:34:25 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: openssh lacks rlimit sandboxing from portable version since -11
X-Send-Pr-Version: www-1.0
X-From4GNATS: "nia@pkgsrc.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60367
>Category:       security
>Synopsis:       openssh lacks rlimit sandboxing from portable version since -11
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    security-officer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jun 25 11:35:00 +0000 2026
>Closed-Date:    Tue Oct 13 17:53:25 +0000 2026
>Last-Modified:  Tue Oct 13 17:53:25 +0000 2026
>Originator:     nia
>Release:        -11, head
>Organization:
The NetBSD Foundation
>Environment:
>Description:
In privsep_child_demote in sshd-auth.c, portable OpenSSH initializes
an rlimit sandbox. However, in the OpenBSD derived version used in
NetBSD, it does not. We should port this feature from the portable
version.

In NetBSD releases before 11, we seem to do this properly. So it's
a regression.
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60367 CVS commit: src/crypto/external/bsd/openssh/dist
Date: Thu, 25 Jun 2026 11:42:48 +0000

 Module Name:	src
 Committed By:	nia
 Date:		Thu Jun 25 11:42:48 UTC 2026

 Modified Files:
 	src/crypto/external/bsd/openssh/dist: sshd-auth.c

 Log Message:
 sshd(8): Restore rlimit sandbox from portable openssh.

 This is used as an alternative to pledge sandboxing.

 PR security/60367

 XXX pullup-11


 To generate a diff of this commit:
 cvs rdiff -u -r1.6 -r1.7 src/crypto/external/bsd/openssh/dist/sshd-auth.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60367 CVS commit: src/doc
Date: Thu, 25 Jun 2026 11:44:35 +0000

 Module Name:	src
 Committed By:	nia
 Date:		Thu Jun 25 11:44:34 UTC 2026

 Modified Files:
 	src/doc: 3RDPARTY

 Log Message:
 doc: openssh rlimit sandbox

 PR security/60367


 To generate a diff of this commit:
 cvs rdiff -u -r1.2223 -r1.2224 src/doc/3RDPARTY

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60367 CVS commit: [netbsd-11] src/crypto/external/bsd/openssh/dist
Date: Mon, 29 Jun 2026 18:26:51 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Jun 29 18:26:51 UTC 2026

 Modified Files:
 	src/crypto/external/bsd/openssh/dist [netbsd-11]: sshd-auth.c

 Log Message:
 Pull up following revision(s) (requested by nia in ticket #349):

 	crypto/external/bsd/openssh/dist/sshd-auth.c: revision 1.7

 sshd(8): Restore rlimit sandbox from portable openssh.

 This is used as an alternative to pledge sandboxing.
 PR security/60367


 To generate a diff of this commit:
 cvs rdiff -u -r1.3.2.3 -r1.3.2.4 \
     src/crypto/external/bsd/openssh/dist/sshd-auth.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: nia@NetBSD.org
State-Changed-When: Tue, 13 Oct 2026 17:53:25 +0000
State-Changed-Why:


>Unformatted:

Home	PR Database Search