From 394726929026ccecd45ba96d25fa84f94ba940b9 Mon Sep 17 00:00:00 2001 From: Chris Lesiak Date: Mon, 17 Dec 2018 22:25:32 +0000 Subject: [PATCH] package/openssh: Set /var/empty permissions The openssh privilege separation feature, enabled by default, requires that the path /var/empty exists and has certain permissions (not writable by the sshd user). Note that nothing ever gets writting in this directory, so it works fine on a readonly rootfs. See README.privsep included as part of the openssh distribution. Signed-off-by: Chris Lesiak Signed-off-by: Arnout Vandecappelle (Essensium/Mind) --- package/openssh/openssh.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk index e6b3ce7c33..28f5979fcb 100644 --- a/package/openssh/openssh.mk +++ b/package/openssh/openssh.mk @@ -23,6 +23,10 @@ define OPENSSH_USERS sshd -1 sshd -1 * - - - SSH drop priv user endef +define OPENSSH_PERMISSIONS + /var/empty d 755 root root - - - - - +endef + ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),) OPENSSH_CONF_OPTS += --without-pie endif