Bug#1072221: secure_permission from user-group-modes.patch does not account for symlinks installed by systemd

On Thu, May 30, 2024 at 12:04:02PM -0400, Ryan Kavanagh wrote:
> systemd services that use ssh (e.g., backup services launched by a
> systemd timer) abort with:
> 
>     Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
> 
> After quickly tracing through the sources, I suspect that this is due to
> Debian's user-group-modes.patch. It introduces a function
> secure_permission and patches read_config_file_depth in readconf.c to
> use secure_permission to check that a configuration file is not world
> writeable. Unfortunately, the check
> 
>     if ((st->st_mode & 002) != 0)
> 
> in secure_permission does not account for symlinks.

I'm not sure that can be it, because as far as I can tell this is only
ever called on a stat buffer resulting from stat() or equivalent, not
lstat().  It shouldn't see the permissions on the symbolic link itself.

Are you in a position to trace any further?  A copy of one of the
relevant systemd units might be helpful information.