From 290ef936bb806c2f903f313609b40fb19c503aba Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 23 Jul 2026 11:40:14 -0700
Subject: [PATCH] fix: restore privileges on SHELL_Subsystem error paths

SHELL_Subsystem() raises privileges to look up user information, but the
three pipe() failures and the forkpty() failure return WS_FATAL_ERROR
without dropping them again. HandleConnection() then runs its teardown --
wolfSSH_shutdown(), up to ten wolfSSH_worker() iterations, and the socket
drain -- still elevated when UsePrivilegeSeparation is yes or sandbox.
Drop permissions before each of the four returns, reusing the wording the
daemon already logs for a failed drop.

The forkpty() path also returned with all six pipe descriptors still
open. Close them there, as the pipe() failure paths already do, and reset
the slots to -1 to keep the child-branch invariant that an entry is
either a live descriptor or -1.

Issue: F-6980
---
 apps/wolfsshd/wolfsshd.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/apps/wolfsshd/wolfsshd.c b/apps/wolfsshd/wolfsshd.c
index 54031b6f8..a2c5d3be3 100644
--- a/apps/wolfsshd/wolfsshd.c
+++ b/apps/wolfsshd/wolfsshd.c
@@ -1463,12 +1463,22 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
     if (!ptyReq || forcedCmd) {
         if (pipe(stdoutPipe) != 0) {
             wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Issue creating stdout pipe");
+            if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
+                wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Error lowering permissions level");
+                exit(1);
+            }
             return WS_FATAL_ERROR;
         }
         if (pipe(stderrPipe) != 0) {
             close(stdoutPipe[0]);
             close(stdoutPipe[1]);
             wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Issue creating stderr pipe");
+            if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
+                wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Error lowering permissions level");
+                exit(1);
+            }
             return WS_FATAL_ERROR;
         }
         if (pipe(stdinPipe) != 0) {
@@ -1477,6 +1487,11 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
             close(stderrPipe[0]);
             close(stderrPipe[1]);
             wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Issue creating stdin pipe");
+            if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
+                wolfSSH_Log(WS_LOG_ERROR,
+                        "[SSHD] Error lowering permissions level");
+                exit(1);
+            }
             return WS_FATAL_ERROR;
         }
     }
@@ -1487,6 +1502,25 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
         /* forkpty failed, so return */
         ChildRunning = 0;
         wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Issue creating new forkpty");
+        if (!ptyReq || forcedCmd) {
+            close(stdoutPipe[0]);
+            close(stdoutPipe[1]);
+            close(stderrPipe[0]);
+            close(stderrPipe[1]);
+            close(stdinPipe[0]);
+            close(stdinPipe[1]);
+            stdoutPipe[0] = -1;
+            stdoutPipe[1] = -1;
+            stderrPipe[0] = -1;
+            stderrPipe[1] = -1;
+            stdinPipe[0]  = -1;
+            stdinPipe[1]  = -1;
+        }
+        if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
+            wolfSSH_Log(WS_LOG_ERROR,
+                    "[SSHD] Error lowering permissions level");
+            exit(1);
+        }
         return WS_FATAL_ERROR;
     }
     else if (childPid == 0) {