security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Releases Activity

agent: Enable restricted, browser, and ssh socket by default. 

* agent/gpg-agent.c (main): Provide defaults for 'extra-socket' and
'browser-socket', enable ssh socket by default, but do not emit the
'SSH_AUTH_SOCK' variable unless it has been explicitly requested.
* configure.ac (GPG_AGENT_{EXTRA,BROWSER}_SOCK_NAME): New definitions.
* doc/gpg-agent.texi: Update documentation.
--

This change enables the restricted, browser, and ssh socket by
default.  Note that in all cases, the user has to do some additional
configuration to her setup to make use of these features.  Therefore,
this should not break any existing setups, but makes it simpler to
discover and use these features.

Signed-off-by: Justus Winter <justus@g10code.com>
This commit is contained in:
Justus Winter 2016-09-15 14:47:00 +02:00
parent 8d37018050
commit e11686f973
3 changed files with 26 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
agent/gpg-agent.c
View File

@ -1045,6 +1045,18 @@ main (int argc, char **argv )
agent_exit (0);
}
if (! opt.extra_socket)
{
opt.extra_socket = 1; /* (1 = points into r/o section) */
socket_name_extra = GPG_AGENT_EXTRA_SOCK_NAME;
}
if (! opt.browser_socket)
{
opt.browser_socket = 1; /* (1 = points into r/o section) */
socket_name_browser = GPG_AGENT_BROWSER_SOCK_NAME;
}
set_debug ();
if (atexit (cleanup))
@ -1241,13 +1253,10 @@ main (int argc, char **argv )
&socket_nonce_browser);
}
if (ssh_support)
{
socket_name_ssh = create_socket_name (GPG_AGENT_SSH_SOCK_NAME, 1);
fd_ssh = create_server_socket (socket_name_ssh, 0, 1,
&redir_socket_name_ssh,
&socket_nonce_ssh);
}
socket_name_ssh = create_socket_name (GPG_AGENT_SSH_SOCK_NAME, 1);
fd_ssh = create_server_socket (socket_name_ssh, 0, 1,
&redir_socket_name_ssh,
&socket_nonce_ssh);
/* If we are going to exec a program in the parent, we record
the PID, so that the child may check whether the program is
@ -1313,8 +1322,7 @@ main (int argc, char **argv )
*socket_name_extra = 0;
if (opt.browser_socket)
*socket_name_browser = 0;
if (ssh_support)
*socket_name_ssh = 0;
*socket_name_ssh = 0;
if (argc)
{ /* Run the program given on the commandline. */

4
configure.ac
View File

@ -1753,6 +1753,10 @@ AC_DEFINE_UNQUOTED(GPGTAR_NAME, "gpgtar", [The name of the gpgtar tool])
AC_DEFINE_UNQUOTED(GPG_AGENT_SOCK_NAME, "S.gpg-agent",
[The name of the agent socket])
AC_DEFINE_UNQUOTED(GPG_AGENT_EXTRA_SOCK_NAME, "S.gpg-agent.rstrd",
[The name of the agent socket for remote access])
AC_DEFINE_UNQUOTED(GPG_AGENT_BROWSER_SOCK_NAME, "S.gpg-agent.brwsr",
[The name of the agent socket for browsers])
AC_DEFINE_UNQUOTED(GPG_AGENT_SSH_SOCK_NAME, "S.gpg-agent.ssh",
[The name of the agent socket for ssh])
AC_DEFINE_UNQUOTED(DIRMNGR_INFO_NAME, "DIRMNGR_INFO",

6
doc/gpg-agent.texi
View File

@ -537,6 +537,9 @@ pinentry to pop up at the @code{tty} or display you started the agent.
@anchor{option --extra-socket}
@item --extra-socket @var{name}
@opindex extra-socket
The extra socket is always created, you may use this option to change
the name of the socket.
Also listen on native gpg-agent connections on the given socket. The
intended use for this extra socket is to setup a Unix domain socket
forwarding from a remote machine to this socket on the local machine.
@ -552,7 +555,8 @@ remote machine.
@opindex enable-ssh-support
@opindex enable-putty-support
Enable the OpenSSH Agent protocol.
The OpenSSH Agent protocol is always enabled, but @command{gpg-agent}
will only set the @code{SSH_AUTH_SOCK} variable if this flag is given.
In this mode of operation, the agent does not only implement the
gpg-agent protocol, but also the agent protocol used by OpenSSH