OpenSSH 3.3 released

[Ben Lindstrom]

On Sat, 22 Jun 2002, Niels Provos wrote:

> On Fri, Jun 21, 2002 at 11:17:50PM -0500, Chris Adams wrote:
> > I'm (finally!) looking at privsep and Tru64 Unix (with HAVE_OSF_SIA
> > enabled), and I'm not sure I can see how it will work.  The problem is
> > in auth-sia.c session_setup_sia().
> You can delay that call until the very beginning of privilege
> separation in the post-authentication phase.
>
> > The sia_ses_estab() call has to run as root because in enhanced security
> [...]
> > The sia_ses_launch() call has to run as root as well because it
> > generates audit records and has to run in the child because it sets the
> > effective user and group IDs.
> Same for these.
>

You face the same issue that AIX does.

1. we need to get session_setup_sia() into do_setusercontext().
2. Need to preallocate a tty since TTY allocation does not normally
happen until WAY after privsep takes affect.

I think we could kill two birds with one stone if you look at how we can
semi-cleanly handle pre-allocation of a TTY while we still have root.

- Ben