[Bug 236312] blacklist issues, related to base sshd

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236312

            Bug ID: 236312
           Summary: blacklist issues, related to base sshd
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs at FreeBSD.org
          Reporter: cem at freebsd.org

I wrote a bit more about it here:
https://lists.freebsd.org/pipermail/freebsd-bugs/2019-February/087172.html

The salient parts are:

1. blacklistd in FreeBSD has the novel BAD_USER signal (added in fork from
NetBSD).  It ignores this signal entirely.  It should not.  (sshd notifies
about this signal in multiple locations.)  A conservative and easy fix here
would be to treat it the same as an AUTHFAIL.

2. I believe I was mistaken about CLOEXEC and confused the distinction between
exec and fork.  CLOFORK would, indeed, be problematic.  CLOEXEC is ok.

3. sendmsg() failure handling and retry is probably broken in a capability
environment or chroot/jail.  Hope blacklistd started before your daemon!

4. libblacklist is probably initialized later than it should be in FreeBSD
sshd.

5. FreeBSD sshd is missing a catch-all notify in cleanup_exit() on code 255.

I wanted to file a bug to track these issues before I forgot.

-- 
You are receiving this mail because:
You are the assignee for the bug.