[Bug 236312] blacklist issues, related to base sshd

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Wed Mar 6 06:13:49 UTC 2019


            Bug ID: 236312
           Summary: blacklist issues, related to base sshd
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs at FreeBSD.org
          Reporter: cem at freebsd.org

I wrote a bit more about it here:

The salient parts are:

1. blacklistd in FreeBSD has the novel BAD_USER signal (added in fork from
NetBSD).  It ignores this signal entirely.  It should not.  (sshd notifies
about this signal in multiple locations.)  A conservative and easy fix here
would be to treat it the same as an AUTHFAIL.

2. I believe I was mistaken about CLOEXEC and confused the distinction between
exec and fork.  CLOFORK would, indeed, be problematic.  CLOEXEC is ok.

3. sendmsg() failure handling and retry is probably broken in a capability
environment or chroot/jail.  Hope blacklistd started before your daemon!

4. libblacklist is probably initialized later than it should be in FreeBSD

5. FreeBSD sshd is missing a catch-all notify in cleanup_exit() on code 255.

I wanted to file a bug to track these issues before I forgot.

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list