Bug 2682 - ssh-agent is unable to remove smartcard after introducing whitelist
Summary: ssh-agent is unable to remove smartcard after introducing whitelist
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Smartcard (show other bugs)
Version: 7.4p1
Hardware: Other Linux
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords: patch
Depends on:
Blocks: V_7_5
  Show dependency treegraph
 
Reported: 2017-02-22 03:16 AEDT by Jakub Jelen
Modified: 2021-04-23 15:02 AEST (History)
2 users (show)

See Also:


Attachments
proposed patch (1.38 KB, patch)
2017-02-22 03:16 AEDT, Jakub Jelen
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jakub Jelen 2017-02-22 03:16:03 AEDT
Created attachment 2946 [details]
proposed patch

Since the whitelisting of the PKCS#11 modules in ssh-agent, adding a PKCS#11 module, that is symlink to another file (as common in Fedora/RHEL) we are unable to remove the module with the same path:

    /usr/lib64/pkcs11/opensc-pkcs11.so -> ../opensc-pkcs11.so

The ssh-agent says:

    $ ssh-add -s /usr/lib64/pkcs11/opensc-pkcs11.so
    Enter passphrase for PKCS#11: 
    Card added: /usr/lib64/pkcs11/opensc-pkcs11.so
    $ ssh-add -e /usr/lib64/opensc-pkcs11.so
    Could not remove card "/usr/lib64/opensc-pkcs11.so": agent refused operation

From the ssh-agent log we can see:

    process_remove_smartcard_key: pkcs11_del_provider failed

the problem is the call to the realpath(3), which resolves the symlinks and passes to the pkcs11-code already target of that symlink.

I understand that it is needed for the whitelist to be effective, but it is getting confusing that one input is sanitized, the second not and they are compared with each other (in pkcs11_provider_lookup()).

We should probably add the realpath call to the remove routine too to make it more user-friendly. Proposed patch is also adding some more debug information.
Comment 1 Damien Miller 2017-03-15 12:55:34 AEDT
Comment on attachment 2946 [details]
proposed patch

looks ok to me
Comment 2 Damien Miller 2017-03-15 13:25:24 AEDT
Applied - this will be in OpenSSH 7.5, due next week.
Comment 3 Damien Miller 2021-04-23 15:02:28 AEST
closing resolved bugs as of 8.6p1 release