Mailing List Archive

[Bug 839] Privilege Separation + PAM locks users out
http://bugzilla.mindrot.org/show_bug.cgi?id=839

dtucker@zip.com.au changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #600 is|0 |1
obsolete| |



------- Additional Comments From dtucker@zip.com.au 2004-05-21 13:08 -------
Created an attachment (id=639)
--> (http://bugzilla.mindrot.org/attachment.cgi?id=639&action=view)
Signal PAM "thread" if SIGCHLD is caused by the privsep slave exitting

Colin Watson pointed out that this may correspond to a Debian bug:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248125

It appears that what is happening is that the client exits, breaking the TCP
connection. When that happens, the privsep slave exits too, which causes a
SIGCHLD to be delivered to the monitor. The monitor then attempts to waitpid()
on the PAM "thread" which is still alive and blissfully unaware of a problem
(because nobody told it to die). That waitpid hangs the monitor's cleanup.

The attached patch tests adds a test for this case to the signal handler to
shoot the PAM thread itself if it has to. It the same as the one I sent to
the Debian bug except it resets SIGCHLD to prevent reentering the signal
handler when the second process exits.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 839] Privilege Separation + PAM locks users out [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=839

dtucker@zip.com.au changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Component|sshd |PAM support
OS/Version|Linux |All
Version|3.8p1 |3.8.1p1





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 839] Privilege Separation + PAM locks users out [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=839

djm@mindrot.org changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #639| |ok
Status| |



------- Additional Comments From djm@mindrot.org 2004-05-21 13:26 -------
(From update of attachment 639)
Looks sane to me.




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 839] Privilege Separation + PAM locks users out [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=839

dtucker@zip.com.au changed:

What |Removed |Added
----------------------------------------------------------------------------
OtherBugsDependingO| |822
nThis| |



------- Additional Comments From dtucker@zip.com.au 2004-05-24 12:00 -------
Thanks, patch id #639 has just been committed (to both HEAD and 3.8.1 branch).

William, could you please try either the patch or a snapshot[1] and confirm
whether or not the problem is fixed for you?

[1] ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/snapshot/ or one of its
mirrors.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 839] Privilege Separation + PAM locks users out [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=839

dtucker@zip.com.au changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Resolution| |FIXED



------- Additional Comments From dtucker@zip.com.au 2004-05-30 21:06 -------
Mario Holbe reports that the patch has been applied to Debian (unstable) and
fixes the problem for him.

I think this is now fixed, so I'm resolving this bug. If you can reproduce your
problem with either a current snapshot or 3.8.1p1 with patch id #639 then please
reopen this bug.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.