Bug 1726

Summary: ChrootDirectory doesn't work with SE Linux
Product: Portable OpenSSH Reporter: Colin Watson <cjwatson>
Component: sshdAssignee: Assigned to nobody <unassigned-bugs>
Status: CLOSED FIXED    
Severity: normal CC: djm, dtucker
Priority: P2    
Version: 5.3p1   
Hardware: Other   
OS: Linux   
URL: http://bugs.debian.org/556644
Bug Depends on:    
Bug Blocks: 1743    
Attachments:
Description Flags
call ssh_selinux_setup_exec_context before chrooting dtucker: ok+

Description Colin Watson 2010-03-02 01:00:00 AEDT 
Created attachment 1800 [details]
call ssh_selinux_setup_exec_context before chrooting

This patch is from Russell Coker <russell@coker.com.au>; I know little about SE Linux myself and defer to him for domain knowledge.  He says:

"The following patch allows the chroot functionality for sftp (and probably regular logins) work with SE Linux.  After chroot() is called the SE Linux context setting won't work unless /selinux and /proc are mounted in the chroot environment.  Even worse, if the user has control over the chroot environment then they may be able to control the context that they get (I haven't verified this)."
Comment 1 Damien Miller 2010-03-26 11:05:05 AEDT 
Patch applied and will be in OpenSSH-5.5. FYI there is no risk of privilege escalation because we ensure that the ChrootDirectory is root-owned and not writable by the user.
Comment 2 Damien Miller 2010-04-16 15:50:20 AEST 
Mass move of bugs RESOLVED->CLOSED following the release of openssh-5.5p1