[openssh-commits] [openssh] branch master updated (4b29da595 -> ac6ad1afd)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from 4b29da595 Don't automatically enable FORTIFY_SOURCE.
     new b37c095aa disable features when post-auth sshd runs as root
     new ac6ad1afd remove the --disable-fd-passing configure option

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit ac6ad1afd1c3531fad2e96a00c84bd9867cf5561
Author: Damien Miller <djm at mindrot.org>
Date:   Tue Oct 6 16:48:54 2026 +1100

    remove the --disable-fd-passing configure option
    
    Also add a deprecation warning when the lack FD passing support and also
    requires root for the post-auth sshd-session process

commit b37c095aa39bb2c01754673dec50a684a536db24
Author: Damien Miller <djm at mindrot.org>
Date:   Tue Oct 6 16:43:39 2026 +1100

    disable features when post-auth sshd runs as root
    
    On platforms that require root privilege for the post-authentication
    sshd-session process (e.g. OpenServer 5, QNX 6), disable and restrict
    a number of features that assume user privilege.
    
    This includes GatewayPorts, StreamLocalForwarding and -R forwardings
    binding to ports <1024

Summary of changes:
 channels.c     |  8 ++++++++
 configure.ac   | 23 +++++++++++++----------
 defines.h      | 16 ++++++++++++++++
 servconf.c     | 12 ++++++++++++
 sshd-session.c | 20 +++-----------------
 5 files changed, 52 insertions(+), 27 deletions(-)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.