Test Failure OpenSSH 7.1 P2 on HPE NSE for key-commands

[Randall S. Becker]

On February 9, 2016 8:05 PM, Darren Tucker wrote:
> To: Randall S. Becker <rsbecker at nexbridge.com>
> Cc: 'OpenSSH Devel List' <openssh-unix-dev at mindrot.org>
> Subject: Re: Test Failure OpenSSH 7.1 P2 on HPE NSE for key-commands
> 
> On Tue, Feb 09, 2016 at 07:46:45PM -0500, Randall S. Becker wrote:
> [...]
> > SUPERUSER ends up being 65535, which is root on this platform.
> > SUPER.SUPER is the actual name of root. /var and /var/run are both
> > 755, while /var/run/keycommand_SUPER.SUPER is 644.
> 
> OK, I think the ownership is the problem.

Confirmed.

> auth2-pubkey.c:subprocess() does this:
> 
> 	if (stat(av[0], &st) < 0)
> [...]
> 	if (auth_secure_path(av[0], &st, NULL, 0,
> 	    errmsg, sizeof(errmsg)) != 0) {
> 		error("Unsafe %s \"%s\": %s", tag, av[0], errmsg);
> 
> The 4th arg to auth_secure_path is the UID we expect the file to be owned
> by.
> 
> If you apply the following and compile with -DROOT_UID=65535 does it
> work?

Replacing 
 	if (auth_secure_path(av[0], &st, NULL, 0,
with
	if (auth_secure_path(av[0], &st, NULL, SUPERUSER,

Causes the keys-command test to pass! I would prefer this change to
introducing ROOT_UID as a duplicate since we already have SUPERUSER. What
I'm not sure about is whether SUPERUSER originated with a branch of ours or
not. To be investigated later. The original #define we had was in include.h
#define SUPERUSER 0, which we wrapped defining SUPERUSER 65535 on our
platform and it is used throughout. No real issue changing it to ROOT_UID if
we must .

> What does ./config.guess report the platform as?

>From config.status:
S["host_os"]="nsk"
S["host_vendor"]="tandem"
S["host_cpu"]="nse"
S["host"]="nse-tandem-nsk"
S["build_os"]="nsk"
S["build_vendor"]="tandem"
S["build_cpu"]="nse"
S["build"]="nse-tandem-nsk"

Cheers,
Randall

-- Brief whoami: NonStop&UNIX developer since approximately
UNIX(421664400)/NonStop(211288444200000000)
-- In my real life, I talk too much.