Bug 153711
| Summary: | pam_selinux.so will misreport errors on relabelling terminal devices | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Russell Coker <rcoker> |
| Component: | pam | Assignee: | Tomas Mraz <tmraz> |
| Status: | CLOSED RAWHIDE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.redhat.com/archives/fedora-selinux-list/2005-April/msg00010.html | ||
| Whiteboard: | |||
| Fixed In Version: | pam-0.79-3 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-04-05 07:40:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 170587 | ||
Should be fixed in the next pam build. |
From Bugzilla Helper: User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.0 (like Gecko) Description of problem: The below code from pam-0.78-selinux.patch has a bug. It should use ptr instead of ttybuf when reporting the error so that if the strncmp() returns zero the correct data will be used. This has been noted when su experiences sighup. + if(strncmp("/dev/", tty, 5)) { + snprintf(ttybuf,sizeof(ttybuf),"/dev/%s",tty); + ptr = ttybuf; + } + else + ptr = tty; + + if (setfilecon(ptr, context)) + { + syslog(LOG_NOTICE, + _("Warning! Could not relabel %s with %s, not relabeling.\n"), + ttybuf,context); + } Also note that in the case of a kill -1 on the sshd for a ssh login it's normal that the /dev/pts device will be gone before su notices anything has happened. So maybe ENOENT should not even be logged in this case. The URL I've given is for the fedora-selinux-list discussion of this issue. Version-Release number of selected component (if applicable): pam-0.78-5 How reproducible: Always Steps to Reproduce: Login via ssh and su to another account. Then kill -1 the sshd controlling the session. Note that su logs a message such as the following: Apr 3 11:58:51 localhost su[3659]: Warning! Could not relabel , \uffff\uff7f\u0661\uffff with user_u:object_r:devpts_t, not relabeling. Additional info: