From e4174904272e073c0a42d1e1a09dda35e892b33b Mon Sep 17 00:00:00 2001 From: Chris Lesiak Date: Mon, 17 Dec 2018 22:25:32 +0000 Subject: [PATCH] package/openssh: Set /var/empty permissions The openssh privilege separation feature, enabled by default, requires that the path /var/empty exists and has certain permissions (not writable by the sshd user). Note that nothing ever gets writting in this directory, so it works fine on a readonly rootfs. See README.privsep included as part of the openssh distribution. Signed-off-by: Chris Lesiak Signed-off-by: Arnout Vandecappelle (Essensium/Mind) (cherry picked from commit f85665c58562a967e3dcb5f72fa8af0a606c9274) Signed-off-by: Peter Korsgaard --- package/openssh/openssh.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index 07f3e0d663..9175f9589d 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -22,6 +22,10 @@ define OPENSSH_USERS sshd -1 sshd -1 * - - - SSH drop priv user endef +define OPENSSH_PERMISSIONS + /var/empty d 755 root root - - - - - +endef + ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),) OPENSSH_CONF_OPTS += --without-pie endif