wolfsshd: let QNX own the host key's permissions

[ejohnstown]

QNX system images fix the host private key's owner and modes, and the daemon cannot change either, so wolfSSHD_OpenSecureFile() refuses a key the integrator has no way to correct and wolfSSHd will not start.

Add WOLFSSH_NO_HOSTKEY_PERMS, hand-defined in user_settings.h or CPPFLAGS and additionally conditional on QNX.

• wolfsshd.c folds the macro and the QNX test into one internal WOLFSSHD_HOSTKEY_RELAX_PERMS.
• relaxPerms argument on wolfSSHD_OpenSecureFile() skips the owner, mode and ancestor-directory checks.
• Set only on the host key load. HostCertificate, UserCAKeysFile, authorized_keys and the shadow open keep the full gate everywhere.
• Startup logs when the guard is compiled in.

Still enforced regardless: lstat/O_NOFOLLOW (symlink), S_ISREG (FIFO, device, directory), and the dev/ino recheck (swap during open).

Issue: ZD-22308

[Copilot]

Pull request overview

Updates wolfsshd for QNX systems whose host-key ownership and permissions are managed externally, while retaining structural file-safety checks.

Changes:

• Adds QNX-gated host-key permission relaxation.
• Extends secure-file opening with a relaxPerms option.
• Limits relaxation to host-key loading and adds test coverage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Summary
apps/wolfsshd/wolfsshd.c	Applies relaxed checks only to QNX host-key loading.
apps/wolfsshd/test/test_configuration.c	Tests relaxed permission handling and retained structural checks.
apps/wolfsshd/auth.h	Updates the secure-file API declaration.
apps/wolfsshd/auth.c	Implements relaxed secure-file behavior and updates callers.

Suppressed comments (2)

apps/wolfsshd/wolfsshd.c:260

• This opt-in changes the result expected by the existing run_hostkey_perm_check() integration test: run_all_sshd_tests.sh:344-347 still launches wolfsshd with a mode-0666 host key and requires Refusing to load. On a QNX build that defines WOLFSSH_NO_HOSTKEY_PERMS, this path now succeeds, so the test suite exits with a false failure; make that assertion conditional on the same build guard or skip the negative case when the relaxation is enabled.

#if defined(WOLFSSH_NO_HOSTKEY_PERMS) && \
    (defined(__QNX__) || defined(__QNXNTO__))

apps/wolfsshd/wolfsshd.c:421

• This message is emitted at WS_LOG_INFO, but SetupCTX() runs while wolfSSHDLoggingCb is installed and that callback drops non-error messages unless debugMode is enabled; daemon mode switches to SyslogCb only after SetupCTX() returns. Consequently a normal startup will not record the fact that the permission guard was compiled out, contrary to the stated startup logging. Route this notice through a path visible during normal startup (or install the intended logging callback before SetupCTX()).

            wolfSSH_Log(WS_LOG_INFO, "[SSHD] Built with "
                "WOLFSSH_NO_HOSTKEY_PERMS, host key ownership and permissions "
                "are left to the platform");

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.