[ssh_x509] update secure copy to properly clear setuid/setgid bits and some build hints

[ssh_x509 at roumenpetrov.info]

Hello,

This is message of a commit that will be in patch release 18.0.3 .

The 18.0 release includes correction for issue with assigned CVE-2026-35385 "a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root and without -p (preserve mode)". It is categorised as important.

Since I don't have enough time to check, it was added to PKIX-SSH as is. Also it was added to my internal TODO list for additional validation. Validation (code review) shows that proposed correction is incomplete. So the mentioned commit in "subject" of the email, resolves the issue in all cases.


----

In the same time was reported issue with original modification on Android build with source fortification. The is the key message of this email.
So I would like to share with you some hints about build process. Core rules are in m4.android.m4 but some other are not easy visible.


SecureBox as addon to TermOne Plus and SecureBox Pro supports Android API Level(SDK) 16() as minimum (32-bit Android 4.1, Jelly Bean). To ensure this minimum build is without source fortification.

On Android, when a function is fortified in API Level X, it is inlined and calls a new function. Fortified functions used by a project define the minimum supported API. In additional minimum SDK supported by a NDK release defines set of fortified functions.
To ensure consistent and independent from NDK build, all packages used in my Android applications are build without source fortification. This is true for TermOne Plus.
Remark: Source fortification is similar to assert and data validation is preferable to assertions.


Other impacts - ssh configuration flag: --without-hardening     Don't use toolchain hardening flags.

PKIX-SSH does no uses -ftrapv as binaries may crash, for instance on 64-bit ARM. It is commented in script. I receive a number or negative letters. The 64-bit ARM architecture has now been tested, but that wasn't the case in the past.

Also -fzero-call-used-regs are no used. This Functionality does not work in many versions of the compilers. Please note that when cross-compiling, for example for Android host, the compiler cannot be tested. Failure is at runtime and usually build environment cannot execute host binaries.


Remaining are linked flags and source fortification.
The linker flags -Wl,-z,relro  -Wl,-z,now and -Wl,-z,noexecstack are used for all Android builds. It is used android build model these flags are set. For project that use autoconf or similar these flags should be set when package is build.

Source fortification was part of "hardening". That is no longer the case. Now pre-processor directive is separated and could be excluded by: --without-fortify       Don't use source fortification.
Remark: By default is used hardening value. Also when hardening is excluded fortification could be included and vice versa.


Regards,
Roumen Petrov