Skip to content

Commit

Permalink
profiles: ssh: add ${RUNUSER}/gvfsd-sftp (#6479)
Browse files Browse the repository at this point in the history
Based on the report by @Saren-Arterius[1]:

Since GNOME gvfs 1.53+, the ssh client options `ControlMaster=auto` and
`ControlPath=/run/user/$UID/gvfsd-sftp/%C` are used to mount sftp.

Since `/run/user/$UID/gvfsd-sftp` is not whitelisted, gvfs sftp mount
with nautilus will fail with a meaningless error message shown in the
UI.

Steps to reproduce[1]:

Prepare ssh server or localhost, then run:

    ssh -o"ForwardX11 no" -o"ForwardAgent no" \
        -o"PermitLocalCommand no" -o"ClearAllForwardings yes" \
        -o"NoHostAuthenticationForLocalhost yes" \
        -o"ControlMaster auto" \
        -o"ControlPath=/run/user/${UID}/gvfsd-sftp/test" \
        -s {SSH_HOST} sftp

stderr shows:

    unix_listener: cannot bind to path /run/user/$UID/gvfsd-sftp/test.{RANDOM_STRING}: No such file or directory

And ssh exits with error code 255.

Fixes #5816.

[1] #5816 (comment)

Reported-by: @Saren-Arterius
Suggested-by: @Saren-Arterius
Reported-by: @Alex-Farol
Reported-by: @mirko
  • Loading branch information
kmk3 authored Sep 19, 2024
1 parent 3bbc6b5 commit 271fb1b
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions etc/profile-m-z/ssh.profile
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ include disable-programs.inc
whitelist ${RUNUSER}/gcr/ssh
whitelist ${RUNUSER}/gnupg/*/S.gpg-agent.ssh # custom gpg homedir setup
whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh # default gpg homedir setup
whitelist ${RUNUSER}/gvfsd-sftp
whitelist ${RUNUSER}/keyring/ssh
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
Expand Down

0 comments on commit 271fb1b

Please sign in to comment.