Bug 1567

Summary:

Insufficient privileges to chroot() on AIX

Product:

Portable OpenSSH

Reporter:

Xavier Lapie <bana>

Component:

sshd

Assignee:

Assigned to nobody <unassigned-bugs>

Status:

CLOSED FIXED

Severity:

major

CC:

cartmanltd, cristi.terpea, dtucker

Priority:

Version:

5.2p1

Hardware:

PPC

OS:

AIX

Bug Depends on:

Bug Blocks:

1560, 1626

Attachments:

Description	Flags
move setpcred (and usrinfo) on AIX to after chroot	none
override the real uid in setpcred and leave it to permanently_set_uid to set	djm: ok+
Same as #1662, but only override if chroot directory is set.	none
truss log on AIX 6.1	none
patch for setpcred with chroot	none
Updated AIX setpcred/chroot patch	none

Description Xavier Lapie 2009-03-07 00:59:11 AEDT

I need to use sftp-only accounts, chroot()ed in their home dirs, on AIX 5.3 with OpenSSH_5.2p1.
But there is a problem with the chroot() call.

In the do_setusercontext() function,  chroot() is called after the setpcred() (only AIX is concerned by the setpcred() call), so privileges are already dropped when chroot() is called.

When not calling setpcred(), the chroot() does not fail and the privileges
are dropped anyway within the permanently_set_uid() call, just after the
safely_chroot() call.

Is the setpcred() really usefull ?

Comment 1 Kieron Curtis 2009-03-20 16:33:57 AEDT

This is related to [Bug 1575] OpenSSH 5.2p1 failure using ChrootDirectory option on AIX.

Comment 2 Darren Tucker 2009-07-12 22:35:56 AEST

*** Bug 1575 has been marked as a duplicate of this bug. ***

Comment 3 Darren Tucker 2009-07-12 22:56:13 AEST

Created attachment 1661 [details]
move setpcred (and usrinfo) on AIX to after chroot

I think the usefulness of setpcred depends on which LAMs you have on your system.  We can probably move the setpcred to after the chroot.

Comment 4 Darren Tucker 2009-07-13 00:22:30 AEST

Created attachment 1662 [details]
override the real uid in setpcred and leave it to permanently_set_uid to set

Hrm, except that doesn't seem to actually work.  This one seems to, though.

Comment 5 Damien Miller 2009-07-31 10:36:53 AEST

Comment on attachment 1662 [details]
override the real uid in setpcred and leave it to permanently_set_uid to set

>--- session.c	21 Jun 2009 09:50:08 -0000	1.383
>+++ session.c	12 Jul 2009 14:04:22 -0000
...
> #ifdef HAVE_SETPCRED
>-		if (setpcred(pw->pw_name, (char **)NULL) == -1)
>+		/* set all creds except real user ID */
>+		char *creds[] = { "REAL_USER=root", NULL };

Maybe mention that RUID=root is needed for chroot() in the comment.

Comment 6 Darren Tucker 2009-08-17 09:56:33 AEST

Created attachment 1669 [details]
Same as #1662, but only override if chroot directory is set.

Added comment as suggested, also made behave differently only if needed (ie chroot directory set).

Comment 7 Darren Tucker 2009-08-18 11:03:22 AEST

Apparently I'm a moron and pasted this into the wrong bug last time:

I think the patch in bug #1249 will also solve it: it uses setpcred to
set up everying in the LAM except for real userid, and then lets
permanently_set_uid() take care of the latter.

Anyway, target 5.3 for David's fix (ie moving setpcred).

Comment 8 Darren Tucker 2009-08-20 16:23:41 AEST

Fixed with the patch from bug #1249, which will be in the 5.3p1 release.  Thanks for the report.

Comment 9 Damien Miller 2009-10-06 15:02:55 AEDT

Mass move of RESOLVED bugs to CLOSED now that 5.3 is out.

Comment 10 Cristi Terpea 2009-11-20 23:18:39 AEDT

Created attachment 1728 [details]
truss log on AIX 6.1

Comment 11 Cristi Terpea 2009-11-20 23:19:17 AEDT

Created attachment 1729 [details]
patch for setpcred with chroot

Comment 12 Cristi Terpea 2009-11-20 23:19:56 AEDT

I tested openssh-5.3p1 on 3 machines:
  AIX ... 1 5 004036AA4C00
  AIX ... 3 5 0040D7CB4C00
  AIX ... 1 6 0003EADAD300
on each of them I got the same result:
  ...
  debug3: safely_chroot: checking '/home/test'
  Changed root directory to "/home/test"
  Failed to set process credentials
then it quits.
I attached the truss log from AIX 6.1 (truss_log.txt)
I also attached the fix that worked for me (this code was posted already in https://bugzilla.mindrot.org/attachment.cgi?id=1669 ). I call setpcred before chroot.

Comment 13 Darren Tucker 2009-12-07 11:07:31 AEDT

Look at this (again) for 5.4

Comment 14 Darren Tucker 2009-12-07 11:08:26 AEDT

*** Bug 1678 has been marked as a duplicate of this bug. ***

Comment 15 Darren Tucker 2010-03-07 12:54:37 AEDT

Created attachment 1807 [details]
Updated AIX setpcred/chroot patch

Comment 16 Darren Tucker 2010-03-07 13:21:36 AEDT

Patch applied, will be in 5.4p1

Comment 17 Darren Tucker 2010-03-26 10:51:39 AEDT

With the release of 5.4p1, this bug is now considered closed.