agent: Add option to open socket as specific user

This can prevent an attack where user A passes the path to user B's
ssh-agent socket to the daemon that is running as root.
This commit is contained in:
Tobias Brunner
2025-12-10 18:34:19 +01:00
parent a768f57286
commit 8b467ad39a
5 changed files with 100 additions and 12 deletions
+1
View File
@@ -20,6 +20,7 @@
ENUM(builder_part_names, BUILD_FROM_FILE, BUILD_END,
"BUILD_FROM_FILE",
"BUILD_AGENT_SOCKET",
"BUILD_AGENT_USER",
"BUILD_BLOB",
"BUILD_BLOB_ASN1_DER",
"BUILD_BLOB_PEM",
+2
View File
@@ -49,6 +49,8 @@ enum builder_part_t {
BUILD_FROM_FILE,
/** unix socket of a ssh/pgp agent, char* */
BUILD_AGENT_SOCKET,
/** user to access a ssh/pgp agent socket, char* */
BUILD_AGENT_USER,
/** An arbitrary blob of data, chunk_t */
BUILD_BLOB,
/** DER encoded ASN.1 blob, chunk_t */