Bug 880 - SELinux patch
Summary: SELinux patch
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 3.8p1
Hardware: All Linux
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks: V_4_4
  Show dependency treegraph
 
Reported: 2004-06-16 04:01 AEST by Daniel Walsh
Modified: 2023-01-13 13:57 AEDT (History)
1 user (show)

See Also:


Attachments
SELinux patch (5.28 KB, patch)
2004-06-16 04:03 AEST, Daniel Walsh
no flags Details | Diff
Revised diff (11.98 KB, patch)
2006-04-03 21:45 AEST, Damien Miller
no flags Details | Diff
Revised diff (11.98 KB, patch)
2006-04-03 21:46 AEST, Damien Miller
no flags Details | Diff
Split configure's $LIBS up (8.60 KB, patch)
2006-04-16 18:36 AEST, Darren Tucker
no flags Details | Diff
Tweaked patch (11.88 KB, patch)
2006-04-21 22:38 AEST, Damien Miller
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Walsh 2004-06-16 04:01:59 AEST
Please consider adding this patch to allow openssh to work with SELinux
Comment 1 Daniel Walsh 2004-06-16 04:03:21 AEST
Created attachment 648 [details]
SELinux patch
Comment 2 Damien Miller 2004-06-26 09:08:23 AEST
I was under the impression that this was going to be done using PAM modules?
Comment 3 Damien Miller 2006-04-03 21:45:48 AEST
Created attachment 1110 [details]
Revised diff
Comment 4 Damien Miller 2006-04-03 21:46:41 AEST
Created attachment 1111 [details]
Revised diff

This is a revised diff, based on Daniel's patch but fixing a few memory leaks and delaing with both older and new libselinux
Comment 5 Darren Tucker 2006-04-16 15:39:24 AEST
Comment on attachment 1111 [details]
Revised diff

>+LIBSELINUX=@LIBSELINUX@
[...]
>+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBSELINUX) $(LIBS)

Instead of doing this, I think we ought to split $LIBS up differently: generic libs required for all programs, one for just the crypto libs and associated, one for sshd only.  The latter could replace LIBPAM and LIBWRAP.

We're now in the situation where we need it: libdl is either not needed, needed for libpam only or needed for everything crypto-related (for openssl-0.9.8*) and this is messy to represent with the current implementation.

>+			if [ -x /sbin/restorecon ]; then
>+			    /sbin/restorecon $RSA1_KEY.pub
>+			fi

Is this a a valid thing to do, eg, if selinux is installed but disabled at runtime?

Still need to look through the rest of the patch...
Comment 6 Damien Miller 2006-04-16 18:23:58 AEST
(In reply to comment #5)
> Instead of doing this, I think we ought to split $LIBS up differently: generic
> libs required for all programs, one for just the crypto libs and associated,
> one for sshd only.  The latter could replace LIBPAM and LIBWRAP.

I agree, a $SSHDLIBS would be nicer.
 
> >+			if [ -x /sbin/restorecon ]; then
> >+			    /sbin/restorecon $RSA1_KEY.pub
> >+			fi
> 
> Is this a a valid thing to do, eg, if selinux is installed but disabled at
> runtime?

Ubuntu does it in a couple of things in /etc/init.d unconditionally, though not for ssh in the current stable release. I think it just resets the extended silesystem attributes on the file, which are only used by SELinux when it is actually turned on.

> Still need to look through the rest of the patch...
Comment 7 Darren Tucker 2006-04-16 18:36:55 AEST
Created attachment 1120 [details]
Split configure's $LIBS up

Here's a starting point, configure and Makefile bits only.  The libcrypto bits for sftp, sftp-server and scp can be removed later, but some reshuffling of other bits is needed first.
Comment 8 Daniel Walsh 2006-04-17 20:26:02 AEST
restorecon exits immediately if selinux is not enabled, with exit status 0.
Comment 9 Damien Miller 2006-04-21 21:48:35 AEST
Comment on attachment 1120 [details]
Split configure's $LIBS up

I like these changes, but I think it should be dealt with separately to this bug. Do you want to start making these changes now? The approach is fine...
Comment 10 Damien Miller 2006-04-21 22:38:53 AEST
Created attachment 1124 [details]
Tweaked patch

Tweaked patch - no functional change, just a little tidier with the preprocessor goop.
Comment 11 Darren Tucker 2006-04-22 20:46:25 AEST
Comment on attachment 1124 [details]
Tweaked patch

Patch seems ok to me.  (I don't know the selinux interface, though)
Comment 12 Darren Tucker 2006-04-22 20:54:10 AEST
Forgot to add: built and seemed to work ok on FC4.
Comment 13 Damien Miller 2006-04-22 21:27:55 AEST
Patch committed and will be in the 20060423+ snapshots. Thanks!
Comment 14 Darren Tucker 2006-09-28 19:25:21 AEST
With the release of 4.4, we believe that this bug is now closed.  For information about the release please see http://www.openssh.com/txt/release-4.4 .