[bug#55034] [PATCH 0/1] Let openssh trust /gnu/store

[Alexey Abramov via Guix-patches via <guix-patches@gnu.org>]

This patch allows users to use /gnu/store objects for AuthorizedKeysCommand
and similar options. According to the sshd_config(5):

> The program must be owned by root, not writable by group or others, and
> specified by an absolute path.

However, this is not the case for Guix, even though it is RO. OpenSSH doesn't
check if the location mounted or ended up on the RO mount point.

I think implementing a check for RO location is much harder here, rather
than to trust /gnu/store path. The same way OpenSSH does with users' home
directory.

Let me know what you think.

Alexey Abramov (1):
  gnu: openssh: Trust /gnu/store directory

 gnu/local.mk                                  |  1 +
 .../openssh-trust-gnu-store-directory.patch   | 35 +++++++++++++++++++
 gnu/packages/ssh.scm                          |  3 +-
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/openssh-trust-gnu-store-directory.patch

-- 
2.34.0