Bug 1325 - SELinux support broken when SELinux is in permissive mode
Summary: SELinux support broken when SELinux is in permissive mode
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 4.6p1
Hardware: Other Linux
: P2 normal
Assignee: Assigned to nobody
URL: http://bugs.debian.org/cgi-bin/bugrep...
Keywords:
Depends on:
Blocks: V_4_7 V_4_6_P2
  Show dependency treegraph
 
Reported: 2007-06-28 02:54 AEST by Colin Watson
Modified: 2008-04-04 10:00 AEDT (History)
2 users (show)

See Also:


Attachments
add missing break statements (715 bytes, patch)
2007-06-28 02:54 AEST, Colin Watson
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Colin Watson 2007-06-28 02:54:13 AEST
Created attachment 1313 [details]
add missing break statements

This bug was originally reported as Debian bug #430838. (Please ignore the information about OpenSSH 4.3 there, as the SELinux support at that point was due to a Debian patch.)

When SELinux is configured in permissive mode, failure to get the security context should (from the code) result in an error() but not a fatal(). However, the following appears in syslog:

Jun 27 09:56:07 teleri sshd[12293]: pam_selinux: Open Session
Jun 27 09:56:07 teleri sshd[12293]: Unable to get valid context for bts, No valid tty
Jun 27 09:56:07 teleri sshd[12293]: error: PAM: pam_open_session(): Authentication failure
Jun 27 09:56:07 teleri sshd[12293]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for bts
Jun 27 09:56:07 teleri sshd[12293]: fatal: ssh_selinux_getctxbyname: Failed to get default SELinux security context for bts (in enforcing mode)

This is due to missing break statements in the relevant switch, so the code wrongly falls through from error() to fatal(). Patch attached.
Comment 1 Damien Miller 2007-06-28 08:48:49 AEST
This patch is embarrassingly correct. Applied - thanks!
Comment 2 Damien Miller 2008-04-04 10:00:03 AEDT
Close resolved bugs after release.