bugzilla-daemon at bugzilla
Dec 13, 2011, 12:53 PM
Post #1 of 1
(83 views)
Permalink
|
|
[Bug 1960] New: Running sshd in wrong SELinux context causes segmentation fault when a user logs in
|
|
https://bugzilla.mindrot.org/show_bug.cgi?id=1960
Bug #: 1960
Summary: Running sshd in wrong SELinux context causes
segmentation fault when a user logs in
Classification: Unclassified
Product: Portable OpenSSH
Version: 5.8p1
Platform: amd64
OS/Version: Linux
Status: NEW
Severity: minor
Priority: P2
Component: sshd
AssignedTo: unassigned-bugs [at] mindrot
ReportedBy: sven.vermeulen [at] siphos
Created attachment 2119
--> https://bugzilla.mindrot.org/attachment.cgi?id=2119
Suggested one-line patch to fix this issue
On a SELinux-enabled Linux system (but running in permissive mode), if
the SSH daemon runs in the wrong context (for instance kernel_t) a
logon of a user through SSH causes the session to terminate abruptly
due to a segmentation fault.
This is caused by not initializing the local variable "sc" in the
openbsd-compat/port-linux.c::ssh_selinux_getctxbyname() function. The
call to get_default_context() will result in the return code -1, but
"sc" is left untouched (and thus not a valid security_context_t
instance). Later in the function, "sc" is returned to the calling
function (which is ssh_selinux_setup_exec_context) which tries to free
the context through freecon(user_ctx).
This can be fixed by initializing sc to NULL to begin with (see line
59):
55 /* Return the default security context for the given username */
56 static security_context_t
57 ssh_selinux_getctxbyname(char *pwname)
58 {
59 security_context_t sc = NULL;
60 char *sename = NULL, *lvl = NULL;
61 int r;
Because it is initialized to NULL, it will remain NULL if the context
of SSH is wrong, in which case there will be no attempt to freecon() it
in ssh_selinux_setup_exec_context. If the context is correct, "sc" will
be updated to point to a proper security_context_t instance.
--
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
|
