Change logs for openssh source package in Jammy

  • openssh (1:8.9p1-3ubuntu0.4) jammy; urgency=medium
      * d/p/fix-authorized-principals-command.patch: Fix the situation where
        sshd ignores AuthorizedPrincipalsCommand if AuthorizedKeysCommand
        is also set by checking if the value pointed to by the pointer
        'charptr' is NULL. (LP: #2031942)
     -- Michal Maloszewski <email address hidden>  Thu, 24 Aug 2023 15:40:24 +0200
  • openssh (1:8.9p1-3ubuntu0.3) jammy-security; urgency=medium
      * SECURITY UPDATE: remote code execution relating to PKCS#11 providers
        - debian/patches/CVE-2023-38408-1.patch: terminate process if requested
          to load a PKCS#11 provider that isn't a PKCS#11 provider in
        - debian/patches/CVE-2023-38408-2.patch: disallow remote addition of
          FIDO/PKCS11 provider in ssh-agent.1, ssh-agent.c.
        - debian/patches/CVE-2023-38408-3.patch: ensure FIDO/PKCS11 libraries
          contain expected symbols in misc.c, misc.h, ssh-pkcs11.c, ssh-sk.c.
        - CVE-2023-38408
     -- Marc Deslauriers <email address hidden>  Wed, 19 Jul 2023 15:41:52 -0400
  • openssh (1:8.9p1-3ubuntu0.1) jammy; urgency=medium
      * d/p/fix-poll-spin.patch: Fix poll(2) spin when a channel's output
        fd closes without data in the channel buffer.
        (LP: #1986521)
     -- Bryce Harrington <email address hidden>  Tue, 22 Nov 2022 23:38:19 -0800
  • openssh (1:8.9p1-3) unstable; urgency=medium
      * Allow ppoll_time64 in seccomp filter (closes: #1006445).
     -- Colin Watson <email address hidden>  Fri, 25 Feb 2022 23:30:49 +0000
  • openssh (1:8.9p1-2) unstable; urgency=medium
      * Improve detection of -fzero-call-used-regs=all support.
     -- Colin Watson <email address hidden>  Thu, 24 Feb 2022 16:09:56 +0000
  • openssh (1:8.9p1-1) unstable; urgency=medium
      * New upstream release (
        - sshd(8): fix an integer overflow in the user authentication path that,
          in conjunction with other logic errors, could have yielded
          unauthenticated access under difficult to exploit conditions.
        - sshd(8), portable OpenSSH only: this release removes in-built support
          for MD5-hashed passwords.
        - ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for
          restricting forwarding and use of keys added to ssh-agent(1).
        - ssh(1), sshd(8): add the <email address hidden> hybrid
          ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default
          KEXAlgorithms list (after the ECDH methods but before the prime-group
          DH ones). The next release of OpenSSH is likely to make this key
          exchange the default method.
        - ssh-keygen(1): when downloading resident keys from a FIDO token, pass
          back the user ID that was used when the key was created and append it
          to the filename the key is written to (if it is not the default).
          Avoids keys being clobbered if the user created multiple resident keys
          with the same application string but different user IDs.
        - ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys on
          tokens that provide user verification (UV) on the device itself,
          including biometric keys, avoiding unnecessary PIN prompts.
        - ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to
          perform matching of principals names against an allowed signers file.
          To be used towards a TOFU model for SSH signatures in git.
        - ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added to
          ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at
          authentication time.
        - ssh-keygen(1): allow selection of hash at sshsig signing time (either
          sha512 (default) or sha256).
        - ssh(1), sshd(8): read network data directly to the packet input buffer
          instead indirectly via a small stack buffer. Provides a modest
          performance improvement.
        - ssh(1), sshd(8): read data directly to the channel input buffer,
          providing a similar modest performance improvement.
        - ssh(1): extend the PubkeyAuthentication configuration directive to
          accept yes|no|unbound|host-bound to allow control over one of the
          protocol extensions used to implement agent-restricted keys.
        - sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and
          PubkeyAuthOptions can be used in a Match block.
        - sshd(8): fix possible string truncation when constructing paths to
          .rhosts/.shosts files with very long user home directory names.
        - ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512
          exchange hashes.
        - ssh(1): don't put the TTY into raw mode when SessionType=none, avoids
          ^C being unable to kill such a session.
        - scp(1): fix some corner-case bugs in SFTP-mode handling of ~-prefixed
        - ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to select
          RSA keys when only RSA/SHA2 signature algorithms are configured (this
          is the default case). Previously RSA keys were not being considered in
          the default case.
        - ssh-keysign(1): make ssh-keysign use the requested signature algorithm
          and not the default for the key type. Part of unbreaking hostbased
          auth for RSA/SHA2 keys.
        - ssh(1): stricter UpdateHostkey signature verification logic on the
          client-side. Require RSA/SHA2 signatures for RSA hostkeys except when
          RSA/SHA1 was explicitly negotiated during initial KEX.
        - ssh(1), sshd(8): fix signature algorithm selection logic for
          UpdateHostkeys on the server side. The previous code tried to prefer
          RSA/SHA2 for hostkey proofs of RSA keys, but missed some cases. This
          will use RSA/SHA2 signatures for RSA keys if the client proposed these
          algorithms in initial KEX.
        - All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2).
          This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1) and
          sftp-server(8), as well as the sshd(8) listen loop and all other FD
          read/writability checks. On platforms with missing or broken
          poll(2)/ppoll(2) syscalls a select(2)-based compat shim is available.
        - ssh-keygen(1): the "-Y find-principals" command was verifying key
          validity when using ca certs but not with simple key lifetimes within
          the allowed signers file.
        - ssh-keygen(1): make sshsig verify-time argument parsing optional.
        - sshd(8): fix truncation in rhosts/shosts path construction.
        - ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA
          keys (we already did this for RSA keys). Avoids fatal errors for
          PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B
        - ssh(1), ssh-agent(1): improve the testing of credentials against
          inserted FIDO: ask the token whether a particular key belongs to it in
          cases where the token supports on-token user-verification (e.g.
          biometrics) rather than just assuming that it will accept it. Will
          reduce spurious "Confirm user presence" notifications for key handles
          that relate to FIDO keys that are not currently inserted in at least
          some cases.
        - ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to allow
          for the preceding two ECN bits.
        - ssh-keygen(1): add missing -O option to usage() for the "-Y sign"
        - ssh-keygen(1): fix a NULL deref when using the find-principals
          function, when matching an allowed_signers line that contains a
          namespace restriction, but no restriction specified on the
        - ssh-agent(1): fix memleak in process_extension().
        - ssh(1): suppress "Connection to xxx closed" messages when LogLevel is
          set to "error" or above.
        - ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing compressed
          packet data.
        - scp(1): when recursively transferring files in SFTP mode, create the
          destination directory if it doesn't already exist to match scp(1) in
          legacy RCP mode behaviour.
        - scp(1): many improvements in error message consistency between scp(1)
          in SFTP mode vs legacy RCP mode.
        - sshd(8): fix potential race in SIGTERM handling.
        - ssh(1), ssh(8): since DSA keys are deprecated, move them to the end of
          the default list of public keys so that they will be tried last.
        - ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match wildcard
          principals in allowed_signers files.
        - ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's
          implementation does not work in a chroot when the kernel does not have
          close_range(2). It tries to read from /proc/self/fd and when that
          fails dies with an assertion of sorts. Instead, call close_range(2)
          directly from our compat code and fall back if that fails.
        - Correct handling of exceptfds/POLLPRI in our select(2)-based
          poll(2)/ppoll(2) compat implementation.
      * Drop patch to work around,
        since the fix for that is in Debian stable.
     -- Colin Watson <email address hidden>  Thu, 24 Feb 2022 11:06:15 +0000
  • openssh (1:8.8p1-1) unstable; urgency=medium
      * New upstream release (,
        closes: #996391):
        - This release disables RSA signatures using the SHA-1 hash algorithm by
          default.  (Existing RSA keys may still be used and do not need to be
          replaced; see NEWS.Debian if you have problems connecting to old SSH
        - ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs directive
          to accept a "none" argument to specify the default behaviour.
        - scp(1): when using the SFTP protocol, continue transferring files
          after a transfer error occurs, better matching original scp/rcp
        - ssh(1): fixed a number of memory leaks in multiplexing,
        - ssh-keygen(1): avoid crash when using the -Y find-principals command.
        - A number of documentation and manual improvements.
        - ssh(1)/sshd(8): some fixes to the pselect(2) replacement compatibility
      * Work around missing RSA SHA-2 signature support in conch until the
        upstream fix lands in Debian.
     -- Colin Watson <email address hidden>  Tue, 15 Feb 2022 19:20:21 +0000
  • openssh (1:8.7p1-4) unstable; urgency=medium
      [ Daniel Baumann ]
      * Fix typo in openssh-client.alternatives (closes: #1002803).
      [ Colin Watson ]
      * Further clarify socket activation instructions.
     -- Colin Watson <email address hidden>  Wed, 29 Dec 2021 12:08:38 +0000
  • openssh (1:8.7p1-3) unstable; urgency=medium
      * Include unit test binaries in openssh-tests even if building with
      * Install built version of sshd_config, with corrected PATH and PidFile.
      * Upgrade to debhelper v13.
      * debian/copyright: Use HTTPS in Source field.
      * Update renamed Lintian tag name in Lintian override.
      * debian/watch: Upgrade to version 4.
      * Clarify instructions for using socket activation to avoid accidental
        attempts to start the non-socket-activated service that can result in
        systems without a running sshd (closes: #1001320).
      * Remove maintainer script code for upgrades from before Debian 9.
      * Make the sysvinit script provide "ssh" as well as "sshd".
      * Set Rules-Requires-Root: no.
      * Use dh_installalternatives.
      * Simplify some debhelper overrides slightly.
     -- Colin Watson <email address hidden>  Wed, 29 Dec 2021 01:12:00 +0000
  • openssh (1:8.7p1-2build1) jammy; urgency=medium
      * No-change rebuild against openssl3
     -- Simon Chopin <email address hidden>  Wed, 01 Dec 2021 16:09:22 +0000
  • openssh (1:8.7p1-2) unstable; urgency=medium
      * Backport from upstream:
        - Avoid NULL deref in -Y find-principals (closes: #999593).
     -- Colin Watson <email address hidden>  Sat, 13 Nov 2021 13:40:50 +0000
  • openssh (1:8.7p1-1) unstable; urgency=medium
      * debian/upstream/signing-key.asc: Update from upstream.
      * New upstream release (
        - scp(1): this release changes the behaviour of remote to remote copies
          (e.g. "scp host-a:/path host-b:") to transfer through the local host
          by default (closes: #734386, LP: #1462758). This was previously
          available via the -3 flag. A -R flag has been added to select the old
        - ssh(1)/sshd(8): both the client and server are now using a stricter
          configuration file parser.
        - ssh(1): when using SSHFP DNS records for host key verification, ssh(1)
          will verify all matching records instead of just those with the
          specific signature type requested.
        - ssh-keygen(1): when generating a FIDO key and specifying an explicit
          attestation challenge (using -Ochallenge), the challenge will now be
          hashed by the builtin security key middleware.
        - sshd(8): environment="..." directives in authorized_keys files are now
          first-match-wins and limited to 1024 discrete environment variable
        - scp(1): experimental support for transfers using the SFTP protocol as
          a replacement for the venerable SCP/RCP protocol that it has
          traditionally used. SFTP offers more predictable filename handling and
          does not require expansion of glob(3) patterns via the shell on the
          remote side.
          SFTP support may be enabled via a temporary scp -s flag. It is
          intended for SFTP to become the default transfer mode in the near
          future, at which time the -s flag will be removed. The -O flag exists
          to force use of the original SCP/RCP protocol for cases where SFTP may
          be unavailable or incompatible.
        - sftp-server(8): add a protocol extension to support expansion of ~/
          and ~user/ prefixed paths. This was added to support these paths when
          used by scp(1) while in SFTP mode.
        - ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to the
          ssh(1) -f flag. GHPR231
        - ssh(1): add a StdinNull directive to ssh_config(5) that allows the
          config file to do the same thing as -n does on the ssh(1) command-
          line. GHPR231
        - ssh(1): add a SessionType directive to ssh_config, allowing the
          configuration file to offer equivalent control to the -N (no session)
          and -s (subsystem) command-line flags (closes: #609122).
        - ssh-keygen(1): allowed signers files used by ssh-keygen(1) signatures
          now support listing key validity intervals alongside they key, and
          ssh-keygen(1) can optionally check during signature verification
          whether a specified time falls inside this interval. This feature is
          intended for use by git to support signing and verifying objects using
          ssh keys.
        - ssh-keygen(8): support printing of the full public key in a sshsig
          signature via a -Oprint-pubkey flag.
        - ssh(1)/sshd(8): start time-based re-keying exactly on schedule in the
          client and server mainloops. Previously the re-key timeout could
          expire but re-keying would not start until a packet was sent or
          received, causing a spin in select() if the connection was quiescent.
        - ssh-keygen(1): avoid Y2038 problem in printing certificate validity
          lifetimes. Dates past 2^31-1 seconds since epoch were displayed
          incorrectly on some platforms.
        - scp(1): allow spaces to appear in usernames for local to remote and
          scp -3 remote to remote copies.
        - ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
          in favour of KbdInteractiveAuthentication. The former is what was in
          SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated
          as somewhat but not entirely equivalent. We retain the old name as a
          deprecated alias so configuration files continue to work as well as a
          reference in the man page for people looking for it.
        - ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
          when extracting a key from a PKCS#11 certificate.
        - ssh(1): restore blocking status on stdio fds before close. ssh(1)
          needs file descriptors in non-blocking mode to operate but it was not
          restoring the original state on exit. This could cause problems with
          fds shared with other programs via the shell.
        - ssh(1)/sshd(8): switch both client and server mainloops from select(3)
          to pselect(3). Avoids race conditions where a signal may arrive
          immediately before select(3) and not be processed until an event
        - ssh(1): sessions started with ControlPersist were incorrectly
          executing a shell when the -N (no shell) option was specified (closes:
        - ssh(1): check if IPQoS or TunnelDevice are already set before
          overriding. Prevents values in config files from overriding values
          supplied on the command line.
        - ssh(1): fix debug message when finding a private key to match a
          certificate being attempted for user authentication. Previously it
          would print the certificate's path, whereas it was supposed to be
          showing the private key's path.
        - sshd(8): match host certificates against host public keys, not private
          keys. Allows use of certificates with private keys held in a
        - ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
          allows RSA/SHA2 signatures for public key authentication but fails to
          advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of
          these server to incorrectly match PubkeyAcceptedAlgorithms and
          potentially refuse to offer valid keys.
        - sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
          <email address hidden> extension but fails when the client tries to invoke
        - ssh(1): allow ssh_config SetEnv to override $TERM, which is otherwise
          handled specially by the protocol. Useful in ~/.ssh/config to set TERM
          to something generic (e.g. "xterm" instead of "xterm-256color") for
          destinations that lack terminfo entries.
        - sftp-server(8): the <email address hidden> extension was incorrectly
          marked as an operation that writes to the filesystem, which made it
          unavailable in sftp-server read-only mode.
        - ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when the
          update removed more host keys than remain present.
        - Many manual page fixes.
        - sshd(8): handle GIDs > 2^31 in getgrouplist. When compiled in 32bit
          mode, the getgrouplist implementation may fail for GIDs greater than
        - ssh(1): xstrdup environment variable used by ForwardAgent.
        - sshd(8): don't sigdie() in signal handler in privsep child process;
          this can end up causing sandbox violations.
      * New upstream release (
        - sftp-server(8): add a new <email address hidden> protocol extension that
          allows a client to discover various server limits, including maximum
          packet size and maximum read/write length.
        - sftp(1): use the new <email address hidden> extension (when available) to
          select better transfer lengths in the client.
        - sshd(8): Add ModuliFile keyword to sshd_config to specify the location
          of the "moduli" file containing the groups for DH-GEX.
        - ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
          manual pages with the current default.
        - ssh(1): ensure that pkcs11_del_provider() is called before exit.
        - ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
          backslashes were not being dequoted correctly and quoted space in the
          middle of a string was being incorrectly split.
        - ssh(1): return non-zero exit status when killed by signal.
        - sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
          packet size. Also handle zero-length reads that are not explicitly
          banned by the spec.
        - sshd(8): don't mistakenly exit on transient read errors on the network
          socket (e.g. EINTR, EAGAIN).
        - Create a dedicated contrib/gnome-ssk-askpass3.c source instead of
          building it from the same file as used for GNOME2. Use the GNOME3
          gdk_seat_grab() to manage keyboard/mouse/server grabs for better
          compatibility with Wayland.
        - sshd(8): soft-disallow the fstatat64 syscall in the Linux seccomp-bpf
      * New upstream release (
        - ssh(1), sshd(8): change the first-preference signature algorithm from
          ECDSA to ED25519.
        - ssh(1), sshd(8): set the TOS/DSCP specified in the configuration for
          interactive use prior to TCP connect.
        - ssh(1), sshd(8): remove the pre-standardization cipher
          <email address hidden>.
        - ssh(1), sshd(8): update/replace the experimental post-quantum hybrid
          key exchange method based on Streamlined NTRU Prime coupled with
        - ssh(1): disable CheckHostIP by default. It provides insignificant
          benefits while making key rotation significantly more difficult,
          especially for hosts behind IP-based load-balancers (closes: #764027).
        - ssh(1): enable UpdateHostkeys by default subject to some conservative
          preconditions (closes: #875532):
          + The key was matched in the UserKnownHostsFile (and not in the
          + The same key does not exist under another name.
          + A certificate host key is not in use.
          + known_hosts contains no matching wildcard hostname pattern.
          + VerifyHostKeyDNS is not enabled.
          + The default UserKnownHostsFile is in use.
          We expect some of these conditions will be modified or relaxed in
        - ssh(1), sshd(8): add a new LogVerbose configuration directive that
          allows forcing maximum debug logging by file/function/line
        - ssh(1): when prompting the user to accept a new hostkey, display any
          other host names/addresses already associated with the key.
        - ssh(1): allow UserKnownHostsFile=none to indicate that no known_hosts
          file should be used to identify host keys.
        - ssh(1): add a ssh_config KnownHostsCommand option that allows the
          client to obtain known_hosts data from a command in addition to the
          usual files.
        - ssh(1): add a ssh_config PermitRemoteOpen option that allows the
          client to restrict the destination when RemoteForward is used with
        - ssh(1): for FIDO keys, if a signature operation fails with a
          "incorrect PIN" reason and no PIN was initially requested from the
          user, then request a PIN and retry the operation. This supports some
          biometric devices that fall back to requiring PIN when reading of the
          biometric failed, and devices that require PINs for all hosted
        - sshd(8): implement client address-based rate-limiting via new
          sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
          directives that provide more fine-grained control on a per-origin
          address basis than the global MaxStartups limit.
        - ssh(1): Prefix keyboard interactive prompts with "(user@host)" to make
          it easier to determine which connection they are associated with in
          cases like scp -3, ProxyJump, etc. (closes: #343267).
        - sshd(8): fix sshd_config SetEnv directives located inside Match
        - ssh(1): when requesting a FIDO token touch on stderr, inform the user
          once the touch has been recorded.
        - ssh(1): prevent integer overflow when ridiculously large
          ConnectTimeout values are specified, capping the effective value (for
          most platforms) at 24 days.
        - ssh(1): consider the ECDSA key subtype when ordering host key
          algorithms in the client.
        - ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
          PubkeyAcceptedAlgorithms. The previous name incorrectly suggested that
          it control allowed key algorithms, when this option actually specifies
          the signature algorithms that are accepted. The previous name remains
          available as an alias (closes: #933665).
        - ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
          HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
        - sftp-server(8): add missing <email address hidden> documentation and
          advertisement in the server's SSH2_FXP_VERSION hello packet.
        - ssh(1), sshd(8): more strictly enforce KEX state-machine by banning
          packet types once they are received. Fixes memleak caused by duplicate
        - sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
          platforms instead of being limited by LONG_MAX.
        - Minor man page fixes (capitalization, commas, etc.)
        - sftp(1): when doing an sftp recursive upload or download of a
          read-only directory, ensure that the directory is created with write
          and execute permissions in the interim so that the transfer can
          actually complete, then set the directory permission as the final
        - ssh-keygen(1): document the -Z, check the validity of its argument
          earlier and provide a better error message if it's not correct.
        - ssh(1): ignore comments at the end of config lines in ssh_config,
          similar to what we already do for sshd_config.
        - sshd_config(5): mention that DisableForwarding is valid in a
          sshd_config Match block.
        - sftp(1): fix incorrect sorting of "ls -ltr" under some circumstances.
        - ssh(1), sshd(8): fix potential integer truncation of (unlikely)
          timeout values.
        - ssh(1): make hostbased authentication send the signature algorithm in
          its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type. This
          make HostbasedAcceptedAlgorithms do what it is supposed to - filter on
          signature algorithm and not key type.
        - sshd(8): add a number of platform-specific syscalls to the Linux
          seccomp-bpf sandbox.
        - sshd(8): remove debug message from sigchld handler that could cause
          deadlock on some platforms.
        - Sync contrib/ssh-copy-id with upstream.
      * Remove OpenBSD-specific rdomain references from sshd_config(5) (closes:
      * Define MAXHOSTNAMELEN on GNU/Hurd (thanks, Svante Signell; closes:
      * Build-depend on libelogind-dev as an alternative to libsystemd-dev on
        Linux (thanks, Svante Signell; closes: #997035).
      * Backport from upstream:
        - CVE-2021-41617 (closes: #995130): sshd(8) from OpenSSH 6.2 through 8.7
          failed to correctly initialise supplemental groups when executing an
          AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a
          AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive
          has been set to run the command as a different user. Instead these
          commands would inherit the groups that sshd(8) was started with.
      * Configure with ac_cv_func_closefrom=no to avoid an incompatibility with
        glibc 2.34's fallback_closefrom function (thanks, William 'jawn-smith'
        Wilson; LP: #1944621).
     -- Colin Watson <email address hidden>  Sat, 06 Nov 2021 12:23:47 +0000
  • openssh (1:8.4p1-6ubuntu2) impish; urgency=medium
      * Configure with ac_cv_func_closefrom=no to avoid an incompatibility
        with glibc 2.34's fallback_closefrom function (LP: #1944621)
     -- William 'jawn-smith' Wilson <email address hidden>  Tue, 21 Sep 2021 22:08:39 +0000