Repository navigation
profile.bashrc: Fix SSH by not allowing *opts helper values to leak - #4338
Merged
Merged
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
The shared hook change affects package builds broadly, and the reported validation does not yet include completed multi-architecture CI or image-level SSH checks.
No open issues 🎉
What changed in this PR
Fixes SSH client configuration permissions and isolates Portage install-option values between ebuilds and stacked hooks.
Changes:
- Resets install-option defaults for each hook while preserving the caller’s values.
- Explicitly sets SSH client configuration to
0644and server configuration to0600, and simplifies socket drop-in installation. - Adds an Alpha/Beta changelog entry for the SSH client fix.
| File | Description |
|---|---|
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc | Isolates install-option values for each stacked hook. |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh | Sets explicit file permissions and simplifies socket configuration installation. |
| changelog/bugfixes/2026-10-26-ssh-perms.md | Documents the Alpha/Beta SSH client fix. |
Review effort: Balanced
tormath1
moved this to ✅ Testing / in Review
in Flatcar tactical, release planning, and roadmap
tormath1
approved these changes
Oct 26, 2026
tormath1
left a comment
tormath1
left a comment
Contributor
There was a problem hiding this comment.
LGTM. Good that it has been noticed in Beta.
krnowak
approved these changes
Oct 26, 2026
krnowak
left a comment
krnowak
left a comment
Member
There was a problem hiding this comment.
Thanks for fixing it, I appreciate it!
chewi
force-pushed
the
chewi/mode-leak
branch
from
October 26, 2026 17:05
ba670ad to
9d82651
Compare
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
The /etc/ssh/sshd_config.d directory is supposed to have mode 0700, so 50-flatcar-sshd.conf having 0644 would not normally matter. However, sshd_config.d's mode is effectively overridden to 0755 by the systemd package. This is ultimately a Portage/PMS issue. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
chewi
force-pushed
the
chewi/mode-leak
branch
from
October 26, 2026 17:15
9d82651 to
c8717d8
Compare
github-project-automation
Bot
moved this from ✅ Testing / in Review
to Implemented
in Flatcar tactical, release planning, and roadmap
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Don't allow *opts (e.g.
insopts) or *into (e.g.insinto) helper values to leak between ebuilds and hook functions. They normally leak between ebuild phases, but leaking them to and from other scripts maintained by other people is hazardous. These default values come from Portage'sphase-helpers.sh.This issue broke the SSH client as a configuration file with bad permissions was unreadable.
Also tighten permissions on
50-flatcar-sshd.conf. The/etc/ssh/sshd_config.ddirectory is supposed to have mode0700, so50-flatcar-sshd.confhaving0644would not normally matter. However,sshd_config.d's mode is effectively overridden to0755by the systemd package. This is ultimately a Portage/PMS issue.How to use
Fire up the image and check that the SSH client works.
Testing done
So far, I've only locally tested this with emerge-amd64-usr, manually checking the permissions. I've kicked off a Jenkins build on another branch that includes these changes.
changelog/directory (user-facing change, bug fix, security fix, update)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.