diff --git a/components/supervisor/openssh/BUILD.yaml b/components/supervisor/openssh/BUILD.yaml index 23a9348033e2fa..2a0945eee48267 100644 --- a/components/supervisor/openssh/BUILD.yaml +++ b/components/supervisor/openssh/BUILD.yaml @@ -9,7 +9,5 @@ packages: - ["rm", "-rf", "components-supervisor-openssh--docker-build"] - name: docker-build type: docker - srcs: - - "*.patch" config: dockerfile: leeway.Dockerfile diff --git a/components/supervisor/openssh/leeway.Dockerfile b/components/supervisor/openssh/leeway.Dockerfile index 302c64871c9989..27030c2f46b705 100644 --- a/components/supervisor/openssh/leeway.Dockerfile +++ b/components/supervisor/openssh/leeway.Dockerfile @@ -54,12 +54,10 @@ RUN ./configure \ --with-privsep-user=nobody \ --with-ssl-engine -COPY supervisorenv.patch . ENV aports=https://raw.githubusercontent.com/alpinelinux/aports/master/main/openssh RUN curl -fsSL \ "${aports}/{avoid-redefined-warnings-when-building-with-utmps,disable-forwarding-by-default,fix-utmp,fix-verify-dns-segfault,gss-serv.c,sftp-interactive}.patch" \ | patch -p1 -RUN cat supervisorenv.patch | patch -p1 RUN make install-nosysconf exec_prefix=/openssh RUN TEST_SSH_UNSAFE_PERMISSIONS=1 \ diff --git a/components/supervisor/openssh/supervisorenv.patch b/components/supervisor/openssh/supervisorenv.patch deleted file mode 100644 index dad1babcd94cca..00000000000000 --- a/components/supervisor/openssh/supervisorenv.patch +++ /dev/null @@ -1,14 +0,0 @@ ---- a/session.c 2021-10-29 07:07:35.794323753 +0000 -+++ b/session.c 2021-10-29 07:23:07.420640891 +0000 -@@ -1126,6 +1126,11 @@ - options.permit_user_env_allowlist); - } - -+ snprintf(buf, sizeof buf, "%.200s/%s/supervisor_env", -+ pw->pw_dir, _PATH_SSH_USER_DIR); -+ read_environment_file(&env, &envsize, buf, -+ options.permit_user_env_allowlist); -+ - #ifdef USE_PAM - /* - * Pull in any environment variables that may have diff --git a/components/supervisor/pkg/supervisor/ssh.go b/components/supervisor/pkg/supervisor/ssh.go index 9c19f434388392..d63a9a021ad700 100644 --- a/components/supervisor/pkg/supervisor/ssh.go +++ b/components/supervisor/pkg/supervisor/ssh.go @@ -33,9 +33,9 @@ func newSSHServer(ctx context.Context, cfg *Config, envvars []string) (*sshServe return nil, xerrors.Errorf("unexpected error creating SSH key: %w", err) } } - err = writeSSHEnv(cfg, envvars) + err = ensureSSHDir(cfg) if err != nil { - return nil, xerrors.Errorf("unexpected error creating SSH env: %w", err) + return nil, xerrors.Errorf("unexpected error creating SSH dir: %w", err) } return &sshServer{ @@ -103,6 +103,18 @@ func (s *sshServer) handleConn(ctx context.Context, conn net.Conn) { "-oLogLevel DEBUG", // enabled DEBUG mode by default } + envs := make([]string, 0) + for _, env := range s.envvars { + s := strings.SplitN(env, "=", 2) + if len(s) != 2 { + continue + } + envs = append(envs, fmt.Sprintf("%s=%s", s[0], fmt.Sprintf("\"%s\"", strings.ReplaceAll(s[1], "\"", "\\\"")))) + } + if len(envs) > 0 { + args = append(args, fmt.Sprintf("-oSetEnv %s", strings.Join(envs, " "))) + } + socketFD, err := conn.(*net.TCPConn).File() if err != nil { log.WithError(err).Error("cannot start SSH server") @@ -189,7 +201,7 @@ func prepareSSHKey(ctx context.Context, sshkey string) error { return nil } -func writeSSHEnv(cfg *Config, envvars []string) error { +func ensureSSHDir(cfg *Config) error { home := "/home/gitpod" d := filepath.Join(home, ".ssh") @@ -197,13 +209,6 @@ func writeSSHEnv(cfg *Config, envvars []string) error { if err != nil { return xerrors.Errorf("cannot create $HOME/.ssh: %w", err) } - - fn := filepath.Join(d, "supervisor_env") - err = os.WriteFile(fn, []byte(strings.Join(envvars, "\n")), 0o644) - if err != nil { - return xerrors.Errorf("cannot write %s: %w", fn, err) - } - _ = exec.Command("chown", "-R", fmt.Sprintf("%d:%d", gitpodUID, gitpodGID), d).Run() return nil