openssh/openssh-7.3p1-log-in-chroot.patch

diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/log.c openssh-7.3p1-log-in-chroot/log.c
--- openssh-7.3p1/log.c	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/log.c	2016-08-07 19:22:31.491195708 +0200
@@ -250,6 +250,11 @@
 void
 log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
 {
+	log_init_handler(av0, level, facility, on_stderr, 1);
+}
+
+void
+log_init_handler(char *av0, LogLevel level, SyslogFacility facility, int on_stderr, int reset_handler) {
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
 	struct syslog_data sdata = SYSLOG_DATA_INIT;
 #endif
@@ -273,8 +278,10 @@
 		exit(1);
 	}
 
-	log_handler = NULL;
-	log_handler_ctx = NULL;
+	if (reset_handler) {
+		log_handler = NULL;
+		log_handler_ctx = NULL;
+	}
 
 	log_on_stderr = on_stderr;
 	if (on_stderr)
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/log.h openssh-7.3p1-log-in-chroot/log.h
--- openssh-7.3p1/log.h	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/log.h	2016-08-07 19:22:31.492195697 +0200
@@ -49,6 +49,7 @@
 typedef void (log_handler_fn)(LogLevel, const char *, void *);
 
 void     log_init(char *, LogLevel, SyslogFacility, int);
+void     log_init_handler(char *, LogLevel, SyslogFacility, int, int);
 void     log_change_level(LogLevel);
 int      log_is_on_stderr(void);
 void     log_redirect_stderr_to(const char *);
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/monitor.c openssh-7.3p1-log-in-chroot/monitor.c
--- openssh-7.3p1/monitor.c	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/monitor.c	2016-08-07 19:22:31.493195686 +0200
@@ -343,6 +343,8 @@
 	close(pmonitor->m_log_sendfd);
 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
 
+	pmonitor->m_state = "preauth";
+
 	authctxt = _authctxt;
 	memset(authctxt, 0, sizeof(*authctxt));
 
@@ -447,6 +449,8 @@
 	close(pmonitor->m_recvfd);
 	pmonitor->m_recvfd = -1;
 
+	pmonitor->m_state = "postauth";
+
 	monitor_set_child_handler(pmonitor->m_pid);
 	signal(SIGHUP, &monitor_child_handler);
 	signal(SIGTERM, &monitor_child_handler);
@@ -539,7 +543,7 @@
 	if (log_level_name(level) == NULL)
 		fatal("%s: invalid log level %u (corrupted message?)",
 		    __func__, level);
-	do_log2(level, "%s [preauth]", msg);
+	do_log2(level, "%s [%s]", msg, pmonitor->m_state);
 
 	buffer_free(&logmsg);
 	free(msg);
@@ -1958,13 +1962,28 @@
 		    (ssh_packet_comp_free_func *)mm_zfree);
 	}
 
+	mon->m_state = "";
+
 	return mon;
 }
 
 void
-monitor_reinit(struct monitor *mon)
+monitor_reinit(struct monitor *mon, const char *chroot_dir)
 {
-	monitor_openfds(mon, 0);
+	struct stat dev_log_stat;
+	char *dev_log_path;
+	int do_logfds = 0;
+
+	if (chroot_dir != NULL) {
+		xasprintf(&dev_log_path, "%s/dev/log", chroot_dir);
+
+		if (stat(dev_log_path, &dev_log_stat) != 0) {
+			debug("%s: /dev/log doesn't exist in %s chroot - will try to log via monitor using [postauth] suffix", __func__, chroot_dir);
+			do_logfds = 1;
+		}
+		free(dev_log_path);
+	}
+	monitor_openfds(mon, do_logfds);
 }
 
 #ifdef GSSAPI
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/monitor.h openssh-7.3p1-log-in-chroot/monitor.h
--- openssh-7.3p1/monitor.h	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/monitor.h	2016-08-07 19:22:31.493195686 +0200
@@ -77,10 +77,11 @@
 	struct mm_master	*m_zlib;
 	struct kex		**m_pkex;
 	pid_t			 m_pid;
+	char		*m_state;
 };
 
 struct monitor *monitor_init(void);
-void monitor_reinit(struct monitor *);
+void monitor_reinit(struct monitor *, const char *);
 void monitor_sync(struct monitor *);
 
 struct Authctxt;
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/session.c openssh-7.3p1-log-in-chroot/session.c
--- openssh-7.3p1/session.c	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/session.c	2016-08-07 19:23:24.961601311 +0200
@@ -162,6 +162,7 @@
 
 static int is_child = 0;
 static int in_chroot = 0;
+static int have_dev_log = 1;
 
 /* Name and directory of socket for authentication agent forwarding. */
 static char *auth_sock_name = NULL;
@@ -529,8 +530,8 @@
 		is_child = 1;
 
 		/* Child.  Reinitialize the log since the pid has changed. */
-		log_init(__progname, options.log_level,
-		    options.log_facility, log_stderr);
+		log_init_handler(__progname, options.log_level,
+		    options.log_facility, log_stderr, have_dev_log);
 
 		/*
 		 * Create a new session and process group since the 4.4BSD
@@ -698,8 +699,8 @@
 		close(ptymaster);
 
 		/* Child.  Reinitialize the log because the pid has changed. */
-		log_init(__progname, options.log_level,
-		    options.log_facility, log_stderr);
+		log_init_handler(__progname, options.log_level,
+		    options.log_facility, log_stderr, have_dev_log);
 		/* Close the master side of the pseudo tty. */
 		close(ptyfd);
 
@@ -805,6 +806,7 @@
 	int ret;
 	const char *forced = NULL, *tty = NULL;
 	char session_type[1024];
+	struct stat dev_log_stat;
 
 	if (options.adm_forced_command) {
 		original_command = command;
@@ -839,6 +841,10 @@
 			tty += 5;
 	}
 
+	if (lstat("/dev/log", &dev_log_stat) != 0) {
+		have_dev_log = 0;
+	}
+
 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
 	    session_type,
 	    tty == NULL ? "" : " on ",
@@ -1671,14 +1677,6 @@
 	 * descriptors left by system functions.  They will be closed later.
 	 */
 	endpwent();
-
-	/*
-	 * Close any extra open file descriptors so that we don't have them
-	 * hanging around in clients.  Note that we want to do this after
-	 * initgroups, because at least on Solaris 2.3 it leaves file
-	 * descriptors open.
-	 */
-	closefrom(STDERR_FILENO + 1);
 }
 
 /*
@@ -1825,8 +1823,6 @@
 			exit(1);
 	}
 
-	closefrom(STDERR_FILENO + 1);
-
 	if (!options.use_login)
 		do_rc_files(s, shell);
 
@@ -1853,7 +1849,7 @@
 #ifdef WITH_SELINUX
 		ssh_selinux_change_context("sftpd_t");
 #endif
-		exit(sftp_server_main(i, argv, s->pw));
+		exit(sftp_server_main(i, argv, s->pw, have_dev_log));
 	}
 
 	fflush(NULL);
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/sftp.h openssh-7.3p1-log-in-chroot/sftp.h
--- openssh-7.3p1/sftp.h	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/sftp.h	2016-08-07 19:22:31.496195652 +0200
@@ -97,5 +97,5 @@
 
 struct passwd;
 
-int	sftp_server_main(int, char **, struct passwd *);
+int	sftp_server_main(int, char **, struct passwd *, int);
 void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/sftp-server.c openssh-7.3p1-log-in-chroot/sftp-server.c
--- openssh-7.3p1/sftp-server.c	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/sftp-server.c	2016-08-07 19:22:31.496195652 +0200
@@ -1498,7 +1498,7 @@
 }
 
 int
-sftp_server_main(int argc, char **argv, struct passwd *user_pw)
+sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
 {
 	fd_set *rset, *wset;
 	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
@@ -1512,7 +1512,7 @@
 
 	ssh_malloc_init();	/* must be called before any mallocs */
 	__progname = ssh_get_progname(argv[0]);
-	log_init(__progname, log_level, log_facility, log_stderr);
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
 
 	pw = pwcopy(user_pw);
 
@@ -1583,7 +1583,7 @@
 		}
 	}
 
-	log_init(__progname, log_level, log_facility, log_stderr);
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
 
 	/*
 	 * On platforms where we can, avoid making /proc/self/{mem,maps}
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/sftp-server-main.c openssh-7.3p1-log-in-chroot/sftp-server-main.c
--- openssh-7.3p1/sftp-server-main.c	2016-07-28 00:54:27.000000000 +0200
+++ openssh-7.3p1-log-in-chroot/sftp-server-main.c	2016-08-07 19:22:31.495195663 +0200
@@ -49,5 +49,5 @@
 		return 1;
 	}
 
-	return (sftp_server_main(argc, argv, user_pw));
+	return (sftp_server_main(argc, argv, user_pw, 0));
 }
diff -Naur -x '*.rej' -x '*.orig' -x '*~' openssh-7.3p1/sshd.c openssh-7.3p1-log-in-chroot/sshd.c
--- openssh-7.3p1/sshd.c	2016-08-07 19:22:07.254471533 +0200
+++ openssh-7.3p1-log-in-chroot/sshd.c	2016-08-07 19:22:31.497195640 +0200
@@ -744,7 +744,7 @@
 	}
 
 	/* New socket pair */
-	monitor_reinit(pmonitor);
+	monitor_reinit(pmonitor, options.chroot_directory);
 
 	pmonitor->m_pid = fork();
 	if (pmonitor->m_pid == -1)
@@ -762,6 +762,11 @@
 
 	close(pmonitor->m_sendfd);
 	pmonitor->m_sendfd = -1;
+	close(pmonitor->m_log_recvfd);
+	pmonitor->m_log_recvfd = -1;
+
+	if (pmonitor->m_log_sendfd != -1)
+		set_log_handler(mm_log_handler, pmonitor);
 
 	/* Demote the private keys to public keys. */
 	demote_sensitive_data();