[openssh-commits] [openssh] 12/87: upstream: avoid spurious disconnect if connecting as root with

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 9ca942330f1829e0c0e2fd4d96ed5a06449af156
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 00:58:02 2026 +0000

    upstream: avoid spurious disconnect if connecting as root with
    
    `PermitRootLogin forced-commands-only` enabled and a authorized_keys entry
    _without_ a `command=` option before a key _with_ this option.
    
    Anthropic ANT-2026-29SEM083
    
    OpenBSD-Commit-ID: ea9c2afc636e120f68a0b70087afb1d5ecc1f9e0
---
 auth-options.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/auth-options.c b/auth-options.c
index 4bbddd7ba..81fa4f68e 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.103 2026/09/16 00:33:44 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.104 2026/10/30 00:58:02 djm Exp $ */
 /*
  * Copyright (c) 2018 Damien Miller <djm at mindrot.org>
  *
@@ -821,11 +821,17 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
 	    0 : (u_int)opts->force_tun_device)) != 0)
 		return r;
 
-	/* String options; these may be NULL */
+	/*
+	 * String options; these may be NULL. In untrusted mode the
+	 * contents of the forced command are hidden, but its presence
+	 * must be preserved as PermitRootLogin=forced-commands-only
+	 * depends on it.
+	 */
 	if ((r = serialise_nullable_string(m,
 	    untrusted ? "yes" : opts->cert_principals)) != 0 ||
 	    (r = serialise_nullable_string(m,
-	    untrusted ? "true" : opts->force_command)) != 0 ||
+	    (untrusted && opts->force_command != NULL) ?
+	    "true" : opts->force_command)) != 0 ||
 	    (r = serialise_nullable_string(m,
 	    untrusted ? NULL : opts->required_from_host_cert)) != 0 ||
 	    (r = serialise_nullable_string(m,

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.