Bug 1527565

Description of problem:
In OpenSSH 7.4 there was a fix for refusing Unix-domain socket forwarding when privilege separation is disabled, but because privsep is always disabled for the root user, this broke socket forwarding for root. Would be nice to backport this fix in your 7.4 package.


Version-Release number of selected component (if applicable):
$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.4 (Maipo)
$ rpm -qi openssh-server
Name        : openssh-server
Version     : 7.4p1
Release     : 13.el7_4

How reproducible:
Always

Steps to Reproduce:
1. Boot CentOS 7.4 machine
# cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
# rpm -qi openssh-server
Name : openssh-server
Version : 7.4p1
Release : 13.el7_4
2. Try to forward a socket over SSH and access it
ssh -nNT -L /tmp/docker.sock:/var/run/docker.sock root@IP
3. Try to access the socket
DOCKER_HOST=unix:///tmp/docker.sock docker version

Actual results:
channel 1: open failed: administratively prohibited: open failed
channel 1: open failed: administratively prohibited: open failed

Expected results:
Output from the socket connection

Additional info:
In the OpenSSH 7.4 release notes (more info on https://bugs.chromium.org/p/project-zero/issues/detail?id=1010)

 * sshd(8): When privilege separation is disabled, forwarded Unix-
   domain sockets would be created by sshd(8) with the privileges of
   'root' instead of the authenticated user. This release refuses
   Unix-domain socket forwarding when privilege separation is disabled
   (Privilege separation has been enabled by default for 14 years).
   Reported by Jann Horn of Project Zero.

In OpenSSH 7.5 release notes:

 * sshd(8): Fix Unix domain socket forwarding for root (regression in
   OpenSSH 7.4).

More info here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858252;msg=9