jonathan/openssh
1
0
Fork 0
forked from rpms/openssh
Code Pull Requests Activity
0fcb25a8d2
openssh/openssh-5.9p1-sesandbox.patch
Jan F. Chadima 28b0dc63f4 selinux sandbox rewrite 
two factor authentication tweaking
2011-09-19 07:26:32 +02:00

322 lines
11 KiB
Diff
Raw Blame History

diff -up openssh-5.9p1/Makefile.in.sesandbox openssh-5.9p1/Makefile.in
--- openssh-5.9p1/Makefile.in.sesandbox 2011-09-19 04:10:05.706521484 +0200
+++ openssh-5.9p1/Makefile.in 2011-09-19 04:10:15.092646473 +0200
@@ -90,7 +90,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
sftp-server.o sftp-common.o \
roaming_common.o roaming_serv.o \
- sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o
+ sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o sandbox-selinux.o
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
diff -up openssh-5.9p1/configure.ac.sesandbox openssh-5.9p1/configure.ac
--- openssh-5.9p1/configure.ac.sesandbox 2011-08-18 06:48:24.000000000 +0200
+++ openssh-5.9p1/configure.ac 2011-09-19 04:10:15.193521356 +0200
@@ -2476,7 +2476,7 @@ AC_SUBST([SSH_PRIVSEP_USER])
# Decide which sandbox style to use
sandbox_arg=""
AC_ARG_WITH([sandbox],
- [ --with-sandbox=style Specify privilege separation sandbox (no, darwin, rlimit, systrace)],
+ [ --with-sandbox=style Specify privilege separation sandbox (no, darwin, rlimit, systrace, selinux)],
[
if test "x$withval" = "xyes" ; then
sandbox_arg=""
@@ -2499,6 +2499,10 @@ elif test "x$sandbox_arg" = "xdarwin" ||
AC_MSG_ERROR([Darwin seatbelt sandbox requires sandbox.h and sandbox_init function])
SANDBOX_STYLE="darwin"
AC_DEFINE([SANDBOX_DARWIN], [1], [Sandbox using Darwin sandbox_init(3)])
+elif test "x$sandbox_arg" = "xselinux" || \
+ test "x$WITH_SELINUX" = "x1"; then
+ SANDBOX_STYLE="selinux"
+ AC_DEFINE([SANDBOX_SELINUX], [1], [Sandbox using selinux(8)])
elif test "x$sandbox_arg" = "xrlimit" || \
( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" ) ; then
test "x$ac_cv_func_setrlimit" != "xyes" && \
diff -up openssh-5.9p1/openbsd-compat/port-linux.c.sesandbox openssh-5.9p1/openbsd-compat/port-linux.c
--- openssh-5.9p1/openbsd-compat/port-linux.c.sesandbox 2011-09-19 04:10:14.731521450 +0200
+++ openssh-5.9p1/openbsd-compat/port-linux.c 2011-09-19 04:10:15.292521265 +0200
@@ -459,24 +459,24 @@ ssh_selinux_setup_pty(char *pwname, cons
debug3("%s: done", __func__);
}
-void
+int
ssh_selinux_change_context(const char *newname)
{
- int len, newlen;
+ int len, newlen, rv = -1;
char *oldctx, *newctx, *cx;
void (*switchlog) (const char *fmt,...) = logit;
if (!ssh_selinux_enabled())
- return;
+ return -2;
if (getcon((security_context_t *)&oldctx) < 0) {
logit("%s: getcon failed with %s", __func__, strerror(errno));
- return;
+ return -1;
}
if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) ==
NULL) {
logit ("%s: unparseable context %s", __func__, oldctx);
- return;
+ return -1;
}
/*
@@ -484,8 +484,10 @@ ssh_selinux_change_context(const char *n
* security context.
*/
if (strncmp(cx, SSH_SELINUX_UNCONFINED_TYPE,
- sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0)
+ sizeof(SSH_SELINUX_UNCONFINED_TYPE) - 1) == 0) {
switchlog = debug3;
+ rv = -2;
+ }
newlen = strlen(oldctx) + strlen(newname) + 1;
newctx = xmalloc(newlen);
@@ -499,8 +501,11 @@ ssh_selinux_change_context(const char *n
if (setcon(newctx) < 0)
switchlog("%s: setcon %s from %s failed with %s", __func__,
newctx, oldctx, strerror(errno));
+ else
+ rv = 0;
xfree(oldctx);
xfree(newctx);
+ return rv;
}
void
diff -up openssh-5.9p1/openbsd-compat/port-linux.h.sesandbox openssh-5.9p1/openbsd-compat/port-linux.h
--- openssh-5.9p1/openbsd-compat/port-linux.h.sesandbox 2011-09-19 04:10:14.817647868 +0200
+++ openssh-5.9p1/openbsd-compat/port-linux.h 2011-09-19 04:10:15.401648009 +0200
@@ -23,7 +23,7 @@
int ssh_selinux_enabled(void);
void ssh_selinux_setup_pty(char *, const char *);
void ssh_selinux_setup_exec_context(char *);
-void ssh_selinux_change_context(const char *);
+int ssh_selinux_change_context(const char *);
void ssh_selinux_chopy_context(void);
void ssh_selinux_setfscreatecon(const char *);
#endif
diff -up openssh-5.9p1/sandbox-darwin.c.sesandbox openssh-5.9p1/sandbox-darwin.c
--- openssh-5.9p1/sandbox-darwin.c.sesandbox 2011-06-26 23:18:21.000000000 +0200
+++ openssh-5.9p1/sandbox-darwin.c 2011-09-19 04:10:15.490523231 +0200
@@ -83,6 +83,12 @@ ssh_sandbox_child(struct ssh_sandbox *bo
}
void
+ssh_sandbox_privileged_child(struct ssh_sandbox *box)
+{
+ /* empty */
+}
+
+void
ssh_sandbox_parent_finish(struct ssh_sandbox *box)
{
free(box);
diff -up openssh-5.9p1/sandbox-null.c.sesandbox openssh-5.9p1/sandbox-null.c
--- openssh-5.9p1/sandbox-null.c.sesandbox 2011-06-23 11:45:51.000000000 +0200
+++ openssh-5.9p1/sandbox-null.c 2011-09-19 04:10:15.599458687 +0200
@@ -58,6 +58,12 @@ ssh_sandbox_child(struct ssh_sandbox *bo
}
void
+ssh_sandbox_privileged_child(struct ssh_sandbox *box)
+{
+ /* empty */
+}
+
+void
ssh_sandbox_parent_finish(struct ssh_sandbox *box)
{
free(box);
diff -up openssh-5.9p1/sandbox-rlimit.c.sesandbox openssh-5.9p1/sandbox-rlimit.c
--- openssh-5.9p1/sandbox-rlimit.c.sesandbox 2011-06-23 11:45:51.000000000 +0200
+++ openssh-5.9p1/sandbox-rlimit.c 2011-09-19 04:10:16.077647289 +0200
@@ -78,6 +78,12 @@ ssh_sandbox_child(struct ssh_sandbox *bo
}
void
+ssh_sandbox_privileged_child(struct ssh_sandbox *box)
+{
+ /* empty */
+}
+
+void
ssh_sandbox_parent_finish(struct ssh_sandbox *box)
{
free(box);
diff -up openssh-5.9p1/sandbox-selinux.c.sesandbox openssh-5.9p1/sandbox-selinux.c
--- openssh-5.9p1/sandbox-selinux.c.sesandbox 2011-09-19 04:10:16.179526059 +0200
+++ openssh-5.9p1/sandbox-selinux.c 2011-09-19 04:39:00.058646230 +0200
@@ -0,0 +1,122 @@
+/* $Id: sandbox-selinux.c,v 1.0 2011/01/17 10:15:30 jfch Exp $ */
+
+/*
+ * Copyright 2011 Red Hat, Inc. All rights reserved.
+ * Use is subject to license terms.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
+ */
+
+
+#include "includes.h"
+
+#ifdef SANDBOX_SELINUX
+
+#include <sys/types.h>
+
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/resource.h>
+
+#include "log.h"
+#include "ssh-sandbox.h"
+#include "xmalloc.h"
+#include "openbsd-compat/port-linux.h"
+
+/* selinux based sandbox */
+
+struct ssh_sandbox {
+ pid_t child_pid;
+};
+
+struct ssh_sandbox *
+ssh_sandbox_init(void)
+{
+ struct ssh_sandbox *box;
+
+ /*
+ * Strictly, we don't need to maintain any state here but we need
+ * to return non-NULL to satisfy the API.
+ */
+ debug3("selinux sandbox init");
+ box = xcalloc(1, sizeof(*box));
+ box->child_pid = 0;
+ return box;
+}
+
+void
+ssh_sandbox_child(struct ssh_sandbox *box)
+{
+ struct rlimit rl_zero;
+
+ rl_zero.rlim_cur = rl_zero.rlim_max = 0;
+
+ if (setrlimit(RLIMIT_FSIZE, &rl_zero) == -1)
+ fatal("%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s",
+ __func__, strerror(errno));
+ if (setrlimit(RLIMIT_NOFILE, &rl_zero) == -1)
+ fatal("%s: setrlimit(RLIMIT_NOFILE, { 0, 0 }): %s",
+ __func__, strerror(errno));
+#ifdef HAVE_RLIMIT_NPROC
+ if (setrlimit(RLIMIT_NPROC, &rl_zero) == -1)
+ fatal("%s: setrlimit(RLIMIT_NPROC, { 0, 0 }): %s",
+ __func__, strerror(errno));
+#endif
+}
+
+void
+ssh_sandbox_privileged_child(struct ssh_sandbox *box)
+{
+ switch (ssh_selinux_change_context("sshd_sandbox_t")) {
+ case 0:
+ debug3("selinux sandbox child sucessfully enabled");
+ break;
+ case -2:
+ logit("selinux sandbox not useful");
+ break;
+ case -1:
+ fatal("cannot set up selinux sandbox");
+ default:
+ fatal("inmternal error in selinux sandbox");
+ }
+}
+
+void
+ssh_sandbox_parent_finish(struct ssh_sandbox *box)
+{
+ free(box);
+ debug3("%s: finished", __func__);
+}
+
+void
+ssh_sandbox_parent_preauth(struct ssh_sandbox *box, pid_t child_pid)
+{
+ debug3("selinux sandbox parent sucessfully enabled");
+ box->child_pid = child_pid;
+}
+
+#endif /* SANDBOX_NULL */
diff -up openssh-5.9p1/sandbox-systrace.c.sesandbox openssh-5.9p1/sandbox-systrace.c
--- openssh-5.9p1/sandbox-systrace.c.sesandbox 2011-08-05 22:16:23.000000000 +0200
+++ openssh-5.9p1/sandbox-systrace.c 2011-09-19 04:10:16.268646532 +0200
@@ -109,6 +109,12 @@ ssh_sandbox_child(struct ssh_sandbox *bo
close(box->child_sock);
}
+void
+ssh_sandbox_privileged_child(struct ssh_sandbox *box)
+{
+ /* empty */
+}
+
static void
ssh_sandbox_parent(struct ssh_sandbox *box, pid_t child_pid,
const struct sandbox_policy *allowed_syscalls)
diff -up openssh-5.9p1/ssh-sandbox.h.sesandbox openssh-5.9p1/ssh-sandbox.h
--- openssh-5.9p1/ssh-sandbox.h.sesandbox 2011-06-23 11:45:51.000000000 +0200
+++ openssh-5.9p1/ssh-sandbox.h 2011-09-19 04:10:16.392523931 +0200
@@ -19,5 +19,6 @@ struct ssh_sandbox;
struct ssh_sandbox *ssh_sandbox_init(void);
void ssh_sandbox_child(struct ssh_sandbox *);
+void ssh_sandbox_privileged_child(struct ssh_sandbox *);
void ssh_sandbox_parent_finish(struct ssh_sandbox *);
void ssh_sandbox_parent_preauth(struct ssh_sandbox *, pid_t);
diff -up openssh-5.9p1/sshd.c.sesandbox openssh-5.9p1/sshd.c
--- openssh-5.9p1/sshd.c.sesandbox 2011-09-19 04:10:14.564467584 +0200
+++ openssh-5.9p1/sshd.c 2011-09-19 04:36:43.324520132 +0200
@@ -728,10 +730,12 @@ privsep_preauth(Authctxt *authctxt)
set_log_handler(mm_log_handler, pmonitor);
/* Demote the child */
- if (getuid() == 0 || geteuid() == 0)
+ if (getuid() == 0 || geteuid() == 0) {
+ ssh_sandbox_privileged_child(box);
privsep_preauth_child();
+ }
setproctitle("%s", "[net]");
if (box != NULL) {
ssh_sandbox_child(box);
xfree(box);
}
View Git Blame Copy Permalink