Bug 225360

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

Description of problem:
When SELinux is enabled, sudo invokes "sesh".  However, because "sesh" lacks some signal handling, it can hang.
If SELinux is enabled (even in permissive mode), the following will cause sudo to apparently hang:
$ sudo bash
# suspend
This hang occurs because bash will send a SIGTSTP to itself, but sesh (which is invoked by sudo when SELinux is enabled) only looks for termination signals, not all signals of its children.

The following patch seems to remediate the problem:
# cat /usr/src/redhat/SOURCES/sudo-1.6.7p5-sesh-stopsig.patch
--- sudo-1.6.7p5/sesh.c.sigstop 2005-09-19 17:38:15.000000000 +0200
+++ sudo-1.6.7p5/sesh.c 2005-09-19 17:41:48.000000000 +0200
@@ -1,4 +1,5 @@
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <limits.h>
 #include <sys/types.h>
@@ -22,19 +23,33 @@
     int status;
     int ret;

-    do {
-      if ((ret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
+    while (1) {
+      if ((ret = waitpid(pid, &status, WUNTRACED)) < 0 && errno == EINTR)
         continue;
       else if (ret < 0) {
         perror("waitpid failed");
         exit(1);
       }
-    } while (0);
+
+      if (!WIFSTOPPED(status))
+       break;
+
+      /* Reset the handler in case it was inherited ignored,
+        but the child reset it and stopped anyway.  */
+      signal(WSTOPSIG(status), SIG_DFL);
+      raise(WSTOPSIG(status));
+
+      /* Now we stop until continued ourselves.  */
+      kill(getpgid(pid) == pid ? -pid : pid, SIGCONT);
+    }

     if (WIFEXITED(status))
       exit(WEXITSTATUS(status));
+    else if (WIFSIGNALED(status))
+      /* XXX print here like the shell would? */
+      exit(128 + WTERMSIG(status));
     else
-      exit(1);
+      exit(127);               /* Should never happen.  */
   } else {
     /* Child */
     execv(argv[1], &argv[1]);


Version-Release number of selected component (if applicable):
sudo-1.6.7p5-30.1.3

How reproducible:
Always


Steps to Reproduce:
1. Ensure SELinux is enabled (set SELINUX=permissive in /etc/sysconfig/selinux and reboot).
2. sudo bash
3. suspend

Actual Results:
The bash shell is suspended, but the sesh process that sudo invoked is still running, causing an apparent hang.  No tty characters (ctrl-\, ctrl-c, etc) will restore functionality.  If you have another root shell on the system, you can kill the appropriate processes.

Expected Results:
sesh should have caught the SIGTSTP the child bash shell sent to itself and suspended itself.  When resumed, sesh should send a SIGCONT to the child.

If SELinux is not enabled, there is no issue because "sesh" is not invoked, and sudo merely executes the command line explicitly.  However, sudo's design to use a common process that fields subcommands when used in a SELinux environment means that "middle" process should watch for signals of its children and act upon them accordingly rather than ignoring them.  I presume the reason for "sesh" is to provide a common executable that can be authorized for context authorization changes within SELinux, rather than having to register every sudo command that might be executed as being authorized to allow its uid context to be switched from its parent.

Additional info:
See patch...

# cat /usr/src/redhat/SOURCES/sudo-1.6.7p5-sesh-stopsig.patch
--- sudo-1.6.7p5/sesh.c.sigstop 2005-09-19 17:38:15.000000000 +0200
+++ sudo-1.6.7p5/sesh.c 2005-09-19 17:41:48.000000000 +0200
@@ -1,4 +1,5 @@
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <limits.h>
 #include <sys/types.h>
@@ -22,19 +23,33 @@
     int status;
     int ret;

-    do {
-      if ((ret = waitpid(pid, &status, 0)) < 0 && errno == EINTR)
+    while (1) {
+      if ((ret = waitpid(pid, &status, WUNTRACED)) < 0 && errno == EINTR)
         continue;
       else if (ret < 0) {
         perror("waitpid failed");
         exit(1);
       }
-    } while (0);
+
+      if (!WIFSTOPPED(status))
+       break;
+
+      /* Reset the handler in case it was inherited ignored,
+        but the child reset it and stopped anyway.  */
+      signal(WSTOPSIG(status), SIG_DFL);
+      raise(WSTOPSIG(status));
+
+      /* Now we stop until continued ourselves.  */
+      kill(getpgid(pid) == pid ? -pid : pid, SIGCONT);
+    }

     if (WIFEXITED(status))
       exit(WEXITSTATUS(status));
+    else if (WIFSIGNALED(status))
+      /* XXX print here like the shell would? */
+      exit(128 + WTERMSIG(status));
     else
-      exit(1);
+      exit(127);               /* Should never happen.  */
   } else {
     /* Child */
     execv(argv[1], &argv[1]);