bug: stdio pipe is root owned so reopening it fails

Szabolcs Nagy nsz at port70.net
Fri May 1 02:46:04 AWST 2020


hello, when dropbear server runs on host

$ echo hi | ssh user at host 'cat'

works as expected (so reading stdin works), but

$ echo hi | ssh user at host 'cat /proc/self/fd/0'

fails with EPERM (the open syscall in cat that is).

it seems the /proc file is user owned but it's a magic symlink
to a pipe that is owned by root so reopening it fails:

$ ssh user at host 'stat -L /proc/self/fd/0'
  File: /proc/self/fd/0
  Size: 0               Blocks: 0          IO Block: 4096   fifo
Device: bh/11d  Inode: 7193        Links: 1
Access: (0600/prw-------)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-04-30 18:29:01.000000000
Modify: 2020-04-30 18:29:01.000000000
Change: 2020-04-30 18:29:01.000000000

i haven't seen this behaviour with openssh and affects some
scripts that use /dev/stdin, /dev/stdout, /dev/stderr
(which just point to /proc/self/fd/{1,2,3})

if there is a simple workaround i'd like to hear about it.
thanks


More information about the Dropbear mailing list