Bug#1070725: ssh-agent: take flock on socket file/dir in /tmp

Luca Boccassi <[email protected]> Wed, 08 May 2024 01:06:43 +0100

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<89b9beba914aed05fc5950e0bef08fa4cced654c.camel__18423.7233990402$1715126975$gmane$org@debian.org>

Package: openssh-client
Severity: important

Hi,

The default tmpfiles.d/tmp.conf will soon start cleaning up /tmp/ once
a day, automatically deleting files older than 10 days
(ctime/mtime/atime are all taken into account).

In order to avoid the ssh auth socket in /tmp being deleted while
in use (e.g.: long term session), please patch ssh-agent to take a
flock(2) on the /tmp/ssh-xxx directory while it's running, as per
documentation:

https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Age

Aside from this, it would be better to switch the location to
XDG_RUNTIME_DIR (/run/user/UID), as that's more appropriate for per-
user-session ephemeral state. The ssh agent provided by gnupg already
switched some time ago:

SSH_AUTH_SOCK=/run/user/1000/gnupg/S.gpg-agent.ssh

-- 
Kind regards,
Luca Boccassi

signature.asc (application/pgp-signature, 833 B)