dtucker at zip
Mar 21, 2008, 6:38 PM
Post #2 of 2
(1787 views)
Permalink
|
|
Re: ChrootDirectory fails if compiled with SELinux support (whether or not using SELinux)
[In reply to]
|
|
On Fri, Mar 21, 2008 at 05:16:56PM +0100, Alexandre Rossi wrote:
> If compiled with SELinux support, OpenSSH 4.8 current cvs fails for
> accounts where the new ChrootDirectory option is active :
[...]
> I do not use SELinux nor know how it works but my guess would be that
> the ssh_selinux_setup_exec_context() call at line 1442 of ./session.c
> fails because it expects to find some /dev or /proc SELinux interface.
> But the call to chroot() is before that, so the call fails.
>
> As most distros ship openssh with SELinux support compiled in, this
> makes ChrootDirectory unusable without a recompile or special SELinux
> setup in the chroot even if one does not use it.
>
> I have no clue on a fix because it does not seem possible to chroot
> AFTER executing the SELinux context.
This should at least allow it to work when selinux support is compiled
in but selinux is disabled. I have no idea if it's possible to make
it work with selinux enabled.
Index: session.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh/session.c,v
retrieving revision 1.364
diff -u -p -r1.364 session.c
--- session.c 15 Mar 2008 06:27:58 -0000 1.364
+++ session.c 22 Mar 2008 01:23:48 -0000
@@ -1350,6 +1350,10 @@ do_setusercontext(struct passwd *pw)
#endif /* HAVE_CYGWIN */
{
+#ifdef WITH_SELINUX
+ /* Cache selinux status for later use */
+ (void)ssh_selinux_enabled();
+#endif
#ifdef HAVE_SETPCRED
if (setpcred(pw->pw_name, (char **)NULL) == -1)
fatal("Failed to set process credentials");
Index: openbsd-compat/port-linux.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh/openbsd-compat/port-linux.c,v
retrieving revision 1.4
diff -u -p -r1.4 port-linux.c
--- openbsd-compat/port-linux.c 27 Jun 2007 22:48:03 -0000 1.4
+++ openbsd-compat/port-linux.c 22 Mar 2008 01:24:06 -0000
@@ -36,7 +36,7 @@
#include <selinux/get_context_list.h>
/* Wrapper around is_selinux_enabled() to log its return value once only */
-static int
+int
ssh_selinux_enabled(void)
{
static int enabled = -1;
Index: openbsd-compat/port-linux.h
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh/openbsd-compat/port-linux.h,v
retrieving revision 1.1
diff -u -p -r1.1 port-linux.h
--- openbsd-compat/port-linux.h 22 Apr 2006 11:26:08 -0000 1.1
+++ openbsd-compat/port-linux.h 22 Mar 2008 01:28:06 -0000
@@ -20,6 +20,7 @@
#define _PORT_LINUX_H
#ifdef WITH_SELINUX
+int ssh_selinux_enabled(void);
void ssh_selinux_setup_pty(char *, const char *);
void ssh_selinux_setup_exec_context(char *);
#endif
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
|
