Re: ssh policy hassles

I'm still at work on the sshd problem. Just as a summary:

	kernel: 2.6.0-test5
	using devpts
	Russell Coker policy
	Colin's selinux experimental branch debian packages

Via the artifice of 
	/root/newrules.pl > /etc/selinux/domain/tmp.te
	make load

I've been able to get a copy of Colin's ssh source running with my own added debugging printout. I've (thus far) not been able to get sshd running under gdb with enforcing on so I can't get much of a look at the ephemeral /dev/pts.

I've captured the point of failure though, and am not sure why it should be so since it happens only with enforcing turned on:

# TEST 1 ENFORCE=1
#
# ssh refuses rhost authentication

Sep 27 11:10:30 cvs ssh(pam_unix)[515]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=scout.islandone.org user=root

# ssh accepts password as valid

Sep 27 11:10:37 cvs sshd[515]: Accepted password for root from 10.0.0.25 port 2968 ssh2

# ssh sets security context

Sep 27 11:10:37 cvs sshd[515]: default security context is root:staff_r:staff_t

# ssh has a pty now

Sep 27 11:10:37 cvs sshd[515]: setting tty /dev/pts/0 context to root:object_r:staff_devpts_t

# But it fails a test in sshpty.c where it does a stat on the file and compares the
# results of the stat. The failure is caused by st.gid = 0 instead of the expected 5.
# (DMA is a token on my debug statements)
Sep 27 11:10:37 cvs sshd[515]: fatal: DMA pty=/dev/pts/0 pwuid=0 stuid=0 gid=5 stgid=0

# We see further failures as it tries to release the pty
Sep 27 11:10:37 cvs sshd[515]: error: chown /dev/pts/0 0 0 failed: Permission denied Sep 27 11:10:37 cvs sshd[515]: error: chmod /dev/pts/0 0666 failed: Permission denied

# TEST 1 ENFORCE=0
#
# First part is the same

Sep 27 11:32:45 cvs ssh(pam_unix)[559]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=scout.islandone.org user=root

Sep 27 11:32:50 cvs sshd[559]: Accepted password for root from 10.0.0.25 port 2982 ssh2
Sep 27 11:32:50 cvs sshd[559]: default security context is root:staff_r:staff_t
Sep 27 11:32:50 cvs sshd[559]: setting tty /dev/pts/0 context to root:object_r:staff_devpts_t

# But it succeeds and the session is good and the connection works.
Sep 27 11:32:50 cvs ssh(pam_unix)[559]: session opened for user root by (uid=0) Sep 27 11:32:50 cvs sshd[561]: setting security context to root:staff_r:staff_t

Has anyone a suggestion as to what is happening? There are no avc's at this point so this looks like something deeper.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.