mirror of https://github.com/wolfSSL/wolfssh.git
f494688e3a
QNX system images fix the host key's owner and modes, and the daemon cannot change either, so the secure gate refuses to load a key the integrator has no way to correct. Add a hand-defined WOLFSSH_NO_HOSTKEY_PERMS, further conditional on QNX, that hands only that policy to the platform. - Fold the macro and the QNX test into the internal WOLFSSHD_HOSTKEY_RELAX_PERMS in wolfsshd.c. - Add a relaxPerms argument to wolfSSHD_OpenSecureFile() that skips the owner, mode and ancestor-directory checks. - Keep the structural checks: lstat, O_NOFOLLOW, S_ISREG and the dev/ino recheck, so a symlink, a non-regular file or a swap during the open is still refused. - Set it only on the host key load, leaving the host cert, UserCAKeysFile, authorized_keys and shadow gates unchanged. - Log at startup when the guard is built in. - Add six test_OpenSecureFile scenarios for the relaxed path, unreachable at runtime off QNX and so otherwise uncovered. Issue: ZD-22308 |
||
|---|---|---|
| .. | ||
| wolfssh | ||
| wolfsshd | ||
| include.am | ||
| wolfssh-options.c | ||