openssh bugs - Aug 2010 - [Bug 1811] New: ssh_selinux_enabled() fails without mounted /proc

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

           Summary: ssh_selinux_enabled() fails without mounted /proc
           Product: Portable OpenSSH
           Version: 5.5p1
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: sshd
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: openssh at bugs.werbittewas.de


is_selinux_enabled() may return -1, if it cannot open /proc/filesystems
as you can see in the code:
http://userspace.selinuxproject.org/trac/browser/libselinux/src/enabled.c

unfortunately the function ssh_selinux_enabled() does not check against
failure (maybe due bad documentation of is_selinux_enabled() ), but use
any non-0-value as enabled. further calls to any selinux-function will
fail and no login is possible!

so please change the line "enabled = is_selinux_enabled();" in
openbsd-compat/port-linux.c to something like "enabled = (1
=is_selinux_enabled());" or - if you think that a selinux-failure at
this point have to lead to denied login - add an option to config to
disable selinux-usage of sshd.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at zip.com.au
             Blocks|                            |1803

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

--- Comment #1 from Darren Tucker <dtucker at zip.com.au> 2010-09-10
10:20:40 EST ---
Created attachment 1921
  --> https://bugzilla.mindrot.org/attachment.cgi?id=1921
openssh-selinux-enabled.patch

Check return value of is_selinux_enabled for exact success value.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #1921|                            |ok?(djm at mindrot.org)
              Flags|                            |

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #1921|ok?(djm at mindrot.org)        |ok+
              Flags|                            |

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

Darren Tucker <dtucker at zip.com.au> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #2 from Darren Tucker <dtucker at zip.com.au> 2010-09-10
10:31:32 EST ---
patch has been committed and will be in the 5.7p1 release.  Thanks!

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=1811

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #3 from Damien Miller <djm at mindrot.org> 2011-01-24 12:33:42
EST ---
Move resolved bugs to CLOSED after 5.7 release

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.