Changes between Version 1 and Version 2 of Ticket #59497, comment 12


Ignore:
Timestamp:
Nov 4, 2019, 1:37:21 PM (5 years ago)
Author:
Ionic (Mihai Moldovan)
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #59497, comment 12

    v1 v2  
    77With privilege separation enabled, the child spawned by `sshd` chroots into some specific directory.
    88
    9 In vanilla OpenSSH, enables the sandbox in the child process **after** reseeding the OpenSSL RNG and chrooting to that directory.
     9In vanilla OpenSSH, `sshd` enables the sandbox in the child process **after** reseeding the OpenSSL RNG and chrooting to that directory.
    1010
    1111However, since Apple (and we) use a special profile file, they (and we) enable the sandbox first, then do all the other things. It's mostly just a code move, but an important one, because a chrooted child couldn't ever be able to read the special profile file residing outside of the chroot.