Create and install sshd random relink kit.

../Makefile.inc and Makfile are concatenated for reuse, which hopefully won't
be too fragile, we'll see if we need a different approach.
The resulting sshd binary is tested with the new sshd -V option before
installation.  As the binary layout is now semi-unknown (meaning
relative, fixed, and gadget offsets are not precisely known), change
the filesystem permissions to 511 to prevent what I call "logged in BROP".
I have ideas for improving this further but this is a first step
ok djm

diff --git a/usr.bin/ssh/sshd/Makefile b/usr.bin/ssh/sshd/Makefile
index 3645526..22659d1 100644 (file)
--- a/usr.bin/ssh/sshd/Makefile
+++ b/usr.bin/ssh/sshd/Makefile
@@ -1,4 +1,4 @@
-#      $OpenBSD: Makefile,v 1.106 2022/05/27 05:02:46 djm Exp $
+#      $OpenBSD: Makefile,v 1.107 2023/01/18 20:43:15 deraadt Exp $
 
 .PATH:         ${.CURDIR}/..
 
@@ -14,6 +14,7 @@ SRCS+=        ${SRCS_BASE} ${SRCS_KEX} ${SRCS_KEXS} ${SRCS_KEY} ${SRCS_KEYP} \
        ${SRCS_SK_CLIENT}
 
 PROG=  sshd
+BINMODE=511
 BINDIR=        /usr/sbin
 MAN=   sshd.8 sshd_config.5
 
@@ -46,3 +47,22 @@ DPADD+=      ${LIBUTIL}
 LDADD+=        -lz
 DPADD+=        ${LIBZ}
 .endif
+
+# The random relink kit, used on OpenBSD by /etc/rc
+
+Makefile.relink: ${.CURDIR}/../Makefile.inc ${.CURDIR}/Makefile
+       # XXX assume a concatenation of these is OK
+       cat ${.CURDIR}/../Makefile.inc ${.CURDIR}/Makefile > Makefile.relink
+
+${PROG} sshd.tar: ${OBJS} Makefile.relink
+       tar cf $@ ${OBJS} Makefile.relink
+
+afterinstall: sshd.tar
+       install -d -o root -g wheel -m 755 \
+           ${DESTDIR}/usr/share/relink/usr/sbin/sshd
+       install -o ${BINOWN} -g ${BINGRP} -m 640 \
+           sshd.tar ${DESTDIR}/usr/share/relink/usr/sbin/sshd/sshd.tar
+
+relink:
+       cc -o sshd `echo ${OBJS} | tr ' ' '\n' | sort -R` ${LDADD}
+       ./sshd -V && install -o root -g wheel -m ${BINMODE} sshd /usr/sbin/sshd