Repository navigation
setsid is never called on the child process after a fork in main_noinetd since version 2020.79 #180
Description
The main dropbear process is terminated if we send a TERM signal to the process group of a dropbear session process to terminate a specific session.
The problem seems to be that the setsid is never called on the child process after a fork in main_noinetd since version 2020.79.
The setsid is presently called in main_noinetd only if DEBUG_NOFORK is not defined and DEBUG_NOFORK is defined in debug.h.
The problem seems to have been introduced in commit 2a81289 when the usage of the DEBUG_NOFORK was reworked.
Activity
davidbernard04 commentedon Jul 7, 2022
@mkj I've talked with my colleague @m5jt because I myself did not understood well the above description.
So the regression issue caused by 2a81289 is because the DEBUG_NOFORK rework was incomplete and a
#ifndef DEBUG_NOFORKwas forgotten a little later in the file. See: https://github.com/mkj/dropbear/blob/DROPBEAR_2020.79/svr-main.c#L306On our side, for some use-cases we are calling
getgid()on the dropbear child to cleanup any potential children, and since the above issue is preventing the child to have his own "process group", our software ended up killing the server.BTW we can see the issue with a simple "ps" on a stock Ubuntu 22.04:
Note the PGID of the dropbear child (second line), which is identical to the PID of the parent (first line).
Re-add missing setsid(), missed #ifdef conversion
mkj commentedon Jul 18, 2022
Thanks for tracking that down
security/dropbear: update to 2022.83
dropbear: update to 2022.83nb1.
dropbear: update to 2022.83nb1.
dropbear: update to 2022.83nb1.
security/dropbear: update to 2022.83
dropbear: update to 2022.83nb1.