Skip to content

Commit 81bcaaa

Browse files
bingbing8manojampalam
bingbing8
authored and
manojampalam
committed
Add mode support in open() and onboard file perm related changes and tests (#145)
PowerShell/Win32-OpenSSH#710 PowerShell/Win32-OpenSSH#725 PowerShell/Win32-OpenSSH#729 PowerShell/Win32-OpenSSH#731 PowerShell/Win32-OpenSSH#732
1 parent a4250af commit 81bcaaa

22 files changed

+1118
-754
lines changed

‎authfile.c

-8
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,6 @@ sshkey_save_private_blob(struct sshbuf *keybuf, const char *filename)
6161

6262
if ((fd = open(filename, O_WRONLY | O_CREAT | O_TRUNC, 0600)) < 0)
6363
return SSH_ERR_SYSTEM_ERROR;
64-
#ifdef WINDOWS /* WINDOWS */
65-
/*
66-
Set the owner of the private key file to current user and only grant
67-
current user the full control access
68-
*/
69-
if (set_secure_file_permission(filename, NULL) != 0)
70-
return SSH_ERR_SYSTEM_ERROR;
71-
#endif /* WINDOWS */
7264
if (atomicio(vwrite, fd, (u_char *)sshbuf_ptr(keybuf),
7365
sshbuf_len(keybuf)) != sshbuf_len(keybuf)) {
7466
oerrno = errno;

‎contrib/win32/openssh/OpenSSHBuildHelper.psm1

+2-2
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ function Package-OpenSSH
300300
}
301301
$buildDir = Join-Path $repositoryRoot ("bin\" + $folderName + "\" + $Configuration)
302302
$payload = "sshd.exe", "ssh.exe", "ssh-agent.exe", "ssh-add.exe", "sftp.exe"
303-
$payload += "sftp-server.exe", "scp.exe", "ssh-shellhost.exe", "ssh-keygen.exe"
303+
$payload += "sftp-server.exe", "scp.exe", "ssh-shellhost.exe", "ssh-keygen.exe", "ssh-keyscan.exe"
304304
$payload += "sshd_config", "install-sshd.ps1", "uninstall-sshd.ps1"
305305

306306
$packageName = "OpenSSH-Win64"
@@ -503,7 +503,7 @@ function Install-OpenSSH
503503
& "$OpenSSHDir\ssh-keygen.exe" -A
504504

505505
$keyFiles = Get-ChildItem "$OpenSSHDir\ssh_host_*_key*" | % {
506-
Add-PermissionToFileACL -FilePath $_.FullName -User "NT Service\sshd" -Perm "Read"
506+
Adjust-HostKeyFileACL -FilePath $_.FullName
507507
}
508508

509509

‎contrib/win32/openssh/OpenSSHCommonUtils.psm1

+137-31
Original file line numberDiff line numberDiff line change
@@ -30,48 +30,147 @@ function Get-RepositoryRoot
3030

3131
<#
3232
.Synopsis
33-
Sets the Secure File ACL.
34-
1. Removed all user acl except Administrators group, system, and current user
35-
2. whether or not take the owner
33+
Set owner of the file to by LOCALSYSTEM account
34+
Set private host key be fully controlled by LOCALSYSTEM and Administrators
35+
Set public host key be fully controlled by LOCALSYSTEM and Administrators, read access by everyone
3636
3737
.Outputs
3838
N/A
3939
4040
.Inputs
4141
FilePath - The path to the file
42-
takeowner - if want to take the ownership
4342
#>
44-
function Cleanup-SecureFileACL
43+
function Adjust-HostKeyFileACL
4544
{
46-
[CmdletBinding()]
47-
param([string]$FilePath, [System.Security.Principal.NTAccount] $Owner)
45+
param (
46+
[parameter(Mandatory=$true)]
47+
[string]$FilePath
48+
)
4849

49-
$myACL = Get-ACL $filePath
50-
$myACL.SetAccessRuleProtection($True, $True)
51-
Set-Acl -Path $filePath -AclObject $myACL
50+
$myACL = Get-ACL $FilePath
51+
$myACL.SetAccessRuleProtection($True, $FALSE)
52+
Set-Acl -Path $FilePath -AclObject $myACL
5253

53-
$myACL = Get-ACL $filePath
54-
if($owner -ne $null)
54+
$systemAccount = New-Object System.Security.Principal.NTAccount("NT AUTHORITY", "SYSTEM")
55+
$adminAccount = New-Object System.Security.Principal.NTAccount("BUILTIN","Administrators")
56+
$everyoneAccount = New-Object System.Security.Principal.NTAccount("EveryOne")
57+
$myACL = Get-ACL $FilePath
58+
59+
$myACL.SetOwner($systemAccount)
60+
61+
if($myACL.Access)
5562
{
56-
$myACL.SetOwner($owner)
63+
$myACL.Access | % {
64+
if(-not ($myACL.RemoveAccessRule($_)))
65+
{
66+
throw "failed to remove access of $($_.IdentityReference.Value) rule in setup "
67+
}
68+
}
69+
}
70+
71+
$adminACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
72+
($adminAccount, "FullControl", "None", "None", "Allow")
73+
$myACL.AddAccessRule($adminACE)
74+
75+
$systemACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
76+
($systemAccount, "FullControl", "None", "None", "Allow")
77+
$myACL.AddAccessRule($systemACE)
78+
79+
if($FilePath.EndsWith(".pub"))
80+
{
81+
$everyoneAce = New-Object System.Security.AccessControl.FileSystemAccessRule `
82+
("Everyone", "Read", "None", "None", "Allow")
83+
$myACL.AddAccessRule($everyoneAce)
5784
}
58-
85+
else
86+
{
87+
#this only is needed when the private host keys are not registered with agent
88+
$sshdAce = New-Object System.Security.AccessControl.FileSystemAccessRule `
89+
("NT service\sshd", "Read", "None", "None", "Allow")
90+
$myACL.AddAccessRule($sshdAce)
91+
}
92+
Set-Acl -Path $FilePath -AclObject $myACL
93+
}
94+
95+
<#
96+
.Synopsis
97+
Set owner of the user key file
98+
Set ACL to have private user key be fully controlled by LOCALSYSTEM and Administrators, Read, write access by owner
99+
Set public user key be fully controlled by LOCALSYSTEM and Administrators, Read, write access by owner, read access by everyone
100+
101+
.Outputs
102+
N/A
103+
104+
.Inputs
105+
FilePath - The path to the file
106+
Owner - owner of the file
107+
OwnerPerms - the permissions grant to the owner
108+
#>
109+
function Adjust-UserKeyFileACL
110+
{
111+
param (
112+
[parameter(Mandatory=$true)]
113+
[string]$FilePath,
114+
[System.Security.Principal.NTAccount] $Owner = $null,
115+
[System.Security.AccessControl.FileSystemRights[]] $OwnerPerms = $null
116+
)
117+
118+
$myACL = Get-ACL $FilePath
119+
$myACL.SetAccessRuleProtection($True, $FALSE)
120+
Set-Acl -Path $FilePath -AclObject $myACL
121+
122+
$systemAccount = New-Object System.Security.Principal.NTAccount("NT AUTHORITY", "SYSTEM")
123+
$adminAccount = New-Object System.Security.Principal.NTAccount("BUILTIN","Administrators")
124+
$everyoneAccount = New-Object System.Security.Principal.NTAccount("EveryOne")
125+
$myACL = Get-ACL $FilePath
126+
127+
$actualOwner = $null
128+
if($Owner -eq $null)
129+
{
130+
$actualOwner = New-Object System.Security.Principal.NTAccount($($env:USERDOMAIN), $($env:USERNAME))
131+
}
132+
else
133+
{
134+
$actualOwner = $Owner
135+
}
136+
137+
$myACL.SetOwner($actualOwner)
138+
59139
if($myACL.Access)
60140
{
61141
$myACL.Access | % {
62-
if (($_ -ne $null) -and ($_.IdentityReference.Value -ine "BUILTIN\Administrators") -and
63-
($_.IdentityReference.Value -ine "NT AUTHORITY\SYSTEM") -and
64-
($_.IdentityReference.Value -ine "$(whoami)"))
142+
if(-not ($myACL.RemoveAccessRule($_)))
65143
{
66-
if(-not ($myACL.RemoveAccessRule($_)))
67-
{
68-
throw "failed to remove access of $($_.IdentityReference.Value) rule in setup "
69-
}
144+
throw "failed to remove access of $($_.IdentityReference.Value) rule in setup "
70145
}
71146
}
147+
}
148+
149+
$adminACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
150+
($adminAccount, "FullControl", "None", "None", "Allow")
151+
$myACL.AddAccessRule($adminACE)
152+
153+
$systemACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
154+
($systemAccount, "FullControl", "None", "None", "Allow")
155+
$myACL.AddAccessRule($systemACE)
156+
157+
if($OwnerPerms)
158+
{
159+
$OwnerPerms | % {
160+
$ownerACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
161+
($actualOwner, $_, "None", "None", "Allow")
162+
$myACL.AddAccessRule($ownerACE)
163+
}
72164
}
73165

74-
Set-Acl -Path $filePath -AclObject $myACL
166+
if($FilePath.EndsWith(".pub"))
167+
{
168+
$everyoneAce = New-Object System.Security.AccessControl.FileSystemAccessRule `
169+
("Everyone", "Read", "None", "None", "Allow")
170+
$myACL.AddAccessRule($everyoneAce)
171+
}
172+
173+
Set-Acl -Path $FilePath -AclObject $myACL
75174
}
76175

77176
<#
@@ -88,20 +187,27 @@ function Cleanup-SecureFileACL
88187
#>
89188
function Add-PermissionToFileACL
90189
{
91-
[CmdletBinding()]
92-
param(
190+
param (
191+
[parameter(Mandatory=$true)]
93192
[string]$FilePath,
193+
[parameter(Mandatory=$true)]
94194
[System.Security.Principal.NTAccount] $User,
95-
[System.Security.AccessControl.FileSystemRights]$Perm
195+
[parameter(Mandatory=$true)]
196+
[System.Security.AccessControl.FileSystemRights[]]$Perms
96197
)
97198

98-
$myACL = Get-ACL $filePath
199+
$myACL = Get-ACL $FilePath
99200

100-
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
101-
($User, $perm, "None", "None", "Allow")
102-
$myACL.AddAccessRule($objACE)
201+
if($Perms)
202+
{
203+
$Perms | % {
204+
$userACE = New-Object System.Security.AccessControl.FileSystemAccessRule `
205+
($User, $_, "None", "None", "Allow")
206+
$myACL.AddAccessRule($userACE)
207+
}
208+
}
103209

104-
Set-Acl -Path $filePath -AclObject $myACL
210+
Set-Acl -Path $FilePath -AclObject $myACL
105211
}
106212

107-
Export-ModuleMember -Function Get-RepositoryRoot, Add-PermissionToFileACL, Cleanup-SecureFileACL
213+
Export-ModuleMember -Function Get-RepositoryRoot, Add-PermissionToFileACL, Adjust-HostKeyFileACL, Adjust-UserKeyFileACL

‎contrib/win32/openssh/OpenSSHTestHelper.psm1

+11-12
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
$ErrorActionPreference = 'Stop'
2-
Import-Module $PSScriptRoot\OpenSSHCommonUtils.psm1 -DisableNameChecking
2+
Import-Module $PSScriptRoot\OpenSSHCommonUtils.psm1 -DisableNameChecking -Force
33

44
[System.IO.DirectoryInfo] $repositoryRoot = Get-RepositoryRoot
55
# test environment parameters initialized with defaults
@@ -158,17 +158,12 @@ WARNING: Following changes will be made to OpenSSH configuration
158158
# copy new sshd_config
159159
Copy-Item (Join-Path $Script:E2ETestDirectory sshd_config) (Join-Path $script:OpenSSHBinPath sshd_config) -Force
160160

161-
#workaround for the cariggage new line added by git before copy them
162-
Get-ChildItem "$($Script:E2ETestDirectory)\sshtest_*key*" | % {
163-
(Get-Content $_.FullName -Raw).Replace("`r`n","`n") | Set-Content $_.FullName -Force
164-
}
165-
166161
#copy sshtest keys
167-
Copy-Item "$($Script:E2ETestDirectory)\sshtest*hostkey*" $script:OpenSSHBinPath -Force
168-
$owner = New-Object System.Security.Principal.NTAccount($env:USERDOMAIN, $env:USERNAME)
169-
Get-ChildItem "$($script:OpenSSHBinPath)\sshtest*hostkey*" -Exclude *.pub | % {
170-
Cleanup-SecureFileACL -FilePath $_.FullName -Owner $owner
171-
Add-PermissionToFileACL -FilePath $_.FullName -User "NT Service\sshd" -Perm "Read"
162+
Copy-Item "$($Script:E2ETestDirectory)\sshtest*hostkey*" $script:OpenSSHBinPath -Force
163+
Get-ChildItem "$($script:OpenSSHBinPath)\sshtest*hostkey*"| % {
164+
#workaround for the cariggage new line added by git before copy them
165+
(Get-Content $_.FullName -Raw).Replace("`r`n","`n") | Set-Content $_.FullName -Force
166+
Adjust-HostKeyFileACL -FilePath $_.FullName
172167
}
173168
Restart-Service sshd -Force
174169

@@ -190,6 +185,7 @@ WARNING: Following changes will be made to OpenSSH configuration
190185
Copy-Item $sshConfigFilePath (Join-Path $dotSshDirectoryPath config.ori) -Force
191186
}
192187
Copy-Item (Join-Path $Script:E2ETestDirectory ssh_config) $sshConfigFilePath -Force
188+
Adjust-UserKeyFileACL -FilePath $sshConfigFilePath -OwnerPerms "Read,Write"
193189

194190
# create test accounts
195191
#TODO - this is Windows specific. Need to be in PAL
@@ -216,9 +212,12 @@ WARNING: Following changes will be made to OpenSSH configuration
216212
$authorizedKeyPath = Join-Path $ssouserProfile .ssh\authorized_keys
217213
$testPubKeyPath = Join-Path $Script:E2ETestDirectory sshtest_userssokey_ed25519.pub
218214
Copy-Item $testPubKeyPath $authorizedKeyPath -Force -ErrorAction SilentlyContinue
215+
$owner = New-Object System.Security.Principal.NTAccount($SSOUser)
216+
Adjust-UserKeyFileACL -FilePath $authorizedKeyPath -Owner $owner -OwnerPerms "Read","Write"
219217
Add-PermissionToFileACL -FilePath $authorizedKeyPath -User "NT Service\sshd" -Perm "Read"
220218
$testPriKeypath = Join-Path $Script:E2ETestDirectory sshtest_userssokey_ed25519
221-
Cleanup-SecureFileACL -FilePath $testPriKeypath -owner $owner
219+
(Get-Content $testPriKeypath -Raw).Replace("`r`n","`n") | Set-Content $testPriKeypath -Force
220+
Adjust-UserKeyFileACL -FilePath $testPriKeypath -OwnerPerms "Read, Write"
222221
cmd /c "ssh-add $testPriKeypath 2>&1 >> $Script:TestSetupLogFile"
223222
Backup-OpenSSHTestInfo
224223
}

0 commit comments

Comments
 (0)