[openssh-commits] [openssh] 79/87: upstream: make a AuthorizedPrincipalsCommand with no specified

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 1aacf1073198affcab382eca2d809598fbc27888
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 09:04:01 2026 +0000

    upstream: make a AuthorizedPrincipalsCommand with no specified
    
    arguments do what it is documented to do: supply the target username as a
    default argument.
    
    Anthropic ANT-2026-YX19N77E
    
    OpenBSD-Commit-ID: 2cce51be98e3311666b4d715beea9588cfb55848
---
 auth2-pubkey.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index ad8e7353b..dbbe6ecdd 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.132 2026/10/11 20:41:20 dtucker Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.133 2026/10/30 09:04:01 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -499,6 +499,18 @@ match_principals_command(struct passwd *user_pw, const struct sshkey *key,
 		free(av[i]);
 		av[i] = tmp;
 	}
+
+	/*
+	 * If AuthorizedPrincipalsCommand was specified without arguments
+	 * then pass the target username as a single argument, as is done
+	 * for AuthorizedKeysCommand.
+	 */
+	if (ac == 1) {
+		av = xreallocarray(av, ac + 2, sizeof(*av));
+		av[ac++] = xstrdup(user_pw->pw_name);
+		av[ac] = NULL;
+	}
+
 	/* Prepare a printable command for logs, etc. */
 	command = argv_assemble(ac, av);
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.