diff -up openssh-5.2p1/session.c.homechroot openssh-5.2p1/session.c --- openssh-5.2p1/session.c.homechroot 2009-06-23 11:33:36.052163641 +0200 +++ openssh-5.2p1/session.c 2009-06-23 11:33:36.372159228 +0200 @@ -1398,6 +1398,8 @@ do_nologin(struct passwd *pw) } } +int chroot_no_tree = 0; + /* * Chroot into a directory after checking it for safety: all path components * must be root-owned directories with strict permissions. @@ -1408,6 +1410,7 @@ safely_chroot(const char *path, uid_t ui const char *cp; char component[MAXPATHLEN]; struct stat st; + int last; if (*path != '/') fatal("chroot path does not begin at root"); @@ -1419,7 +1422,7 @@ safely_chroot(const char *path, uid_t ui * root-owned directory with strict permissions. */ for (cp = path; cp != NULL;) { - if ((cp = strchr(cp, '/')) == NULL) + if (((last = ((cp = strchr(cp, '/')) == NULL)))) strlcpy(component, path, sizeof(component)); else { cp++; @@ -1432,13 +1435,15 @@ safely_chroot(const char *path, uid_t ui if (stat(component, &st) != 0) fatal("%s: stat(\"%s\"): %s", __func__, component, strerror(errno)); - if (st.st_uid != 0 || (st.st_mode & 022) != 0) + if ((st.st_uid != 0 || (st.st_mode & 022) != 0) && !(last && st.st_uid == uid)) fatal("bad ownership or modes for chroot " "directory %s\"%s\"", cp == NULL ? "" : "component ", component); if (!S_ISDIR(st.st_mode)) fatal("chroot path %s\"%s\" is not a directory", cp == NULL ? "" : "component ", component); + if (st.st_uid != uid) + ++chroot_no_tree; } diff -up openssh-5.2p1/sftp-server.c.homechroot openssh-5.2p1/sftp-server.c --- openssh-5.2p1/sftp-server.c.homechroot 2008-07-04 06:10:19.000000000 +0200 +++ openssh-5.2p1/sftp-server.c 2009-06-23 11:33:36.374154561 +0200 @@ -887,6 +887,7 @@ process_opendir(void) static void process_readdir(void) { + extern int chroot_no_tree; DIR *dirp; struct dirent *dp; char *path; @@ -920,7 +921,7 @@ process_readdir(void) continue; stat_to_attrib(&st, &(stats[count].attrib)); stats[count].name = xstrdup(dp->d_name); - stats[count].long_name = ls_file(dp->d_name, &st, 0); + stats[count].long_name = ls_file(dp->d_name, &st, chroot_no_tree); count++; /* send up to 100 entries in one message */ /* XXX check packet size instead */ diff -up openssh-5.2p1/sftp-server-main.c.homechroot openssh-5.2p1/sftp-server-main.c --- openssh-5.2p1/sftp-server-main.c.homechroot 2009-02-21 22:47:02.000000000 +0100 +++ openssh-5.2p1/sftp-server-main.c 2009-06-23 11:33:36.378159051 +0200 @@ -27,6 +27,8 @@ #include "sftp.h" #include "misc.h" +int chroot_no_tree = 0; + void cleanup_exit(int i) {