#827672 WDM crashes after user logged in if selinux is enabled (and in permissive mode)

Package:
wdm
Source:
wdm
Description:
WINGs Display Manager - an xdm replacement with a WindowMaker look
Submitter:
Klaus Ethgen
Date:
2018-11-24 12:15:08 UTC
Severity:
important
#827672#5
Date:
2016-06-19 13:58:14 UTC
From:
To:
Package: wdm
Version: 1.28-19
Severity: important

Recently I enabled selinux on my desktop box and ran into a bad bug in
wdm (Maybe this bug is not in wdm than in glibc, so feel free to
reassign)

WDM starts without any problem but when I log in as user, it crashes
with the following stacktrace:
      : Failed to get default security context for klaus.
   wdm: *** Error in `-:0         ': free(): invalid pointer: 0x80101d24 ***
   wdm: ======= Backtrace: =========
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b]
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527]
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1]
   wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698]
   wdm: -:0         (+0xd104)[0x800f4104]
   wdm: -:0         (+0x8450)[0x800ef450]
   wdm: -:0         (+0x8828)[0x800ef828]
   wdm: -:0         (+0x8077)[0x800ef077]
   wdm: -:0         (+0xe24e)[0x800f524e]
   wdm: -:0         (main+0x1a5)[0x800e9ff5]
   wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517]
   wdm: -:0         (+0x3327)[0x800ea327]

(The trace is from a i386 box but the bug also happens on a amd64 one)

I was able to reporduce that bug on a second machine. It is not possible
to log in with selinux enabled (even not in permissive mode as I have it
currently:
   ~> getenforce
   Permissive

As told above, that might be a bug in glibc. In this case, please
reassign.

Not related to the box I run reportbug as the one I tested selinux has
normal debian kernel and the one I run reportbug has a custom one
without selinux.

#827672#10
Date:
2018-11-24 12:11:30 UTC
From:
To:
Dear Maintainer, hello Klaus Ethgen,
I just tried to get some more information out of this bug.

I could not reproduce it with a stretch testing or unstable
as of date 2016-07-20 inside a i386 qemu VM.

As far as I see is the problematic function in WDM:

    (gdb) list ManageSession            # wdm-1.28/src/wdm/session.c
    ...
    522     static Bool
    523     StartClient (
    524         struct verify_info  *verify,
    525         struct display      *d,
    526         int                 *pidp,
    527         char                *name,
    528         char                *passwd)
    529     {
    ...
    627     #ifdef WITH_SELINUX
    628             if (is_selinux_enabled())
    629             {
    630                     security_context_t scontext;
    631                     if (get_default_context(name,NULL,&scontext))
    632                             WDMError("Failed to get default security context"
    633                                             " for %s.", name);
    634                     WDMDebug("setting security context to %s", scontext);
    635                     if (setexeccon(scontext))
    636                     {
    637                             freecon(scontext);
    638                             WDMError("Failed to set exec security context %s "
    639                                             "for %s.", scontext, name);
    640                     }
    641                     freecon(scontext);
    642             }
    643     #endif


There it looks like function get_default_context failed - the message
"Failed to get default security context" appears in the log.

Therefore variable scontext may have stayed uninitilized,
which led to the observed crash in line 637, when trying to free
that uninitilized pointer.

    (gdb) list freecon                  # libselinux-2.5/src/freecon.c
    5
    6       void freecon(char * con)
    7       {
    8               free(con);
    9       }


I think this crash may happen with current testing version of wdm too,
when get_default_context fails.
But why in the first place the get_default_context may have failed I cannot say.

Does this problem still occour?
Or is it known if there was a selinux misconfiguration on this machine at that time?
Was there any other selinux configuration done?

Attached file shows some notes about the debugging attempts.

Kind regards,
Bernhard


   wdm: *** Error in `-:0         ': free(): invalid pointer: 0x80101d24 ***
   wdm: ======= Backtrace: =========
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b]               | 0x...29b |
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527]               | 0x...527 |
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1]               | 0x...cd1 |
   wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698]     | 0x...698 | 0xb7df7698: 0xb7df7693 <freecon_internal+19>:    call   0xb7df25b0 <free@plt>
   wdm: -:0         (+0xd104)[0x800f4104]                                 | 0x...104 | 0x8000d104: 0x8000d0ff <ManageSession+1871>:     call   0x80002d80                    ; 637                             freecon(scontext);
   wdm: -:0         (+0x8450)[0x800ef450]                                 | 0x...450 | 0x80008450: 0x8000844b <StartDisplay+187>:       call   0x8000c9b0 <ManageSession>
   wdm: -:0         (+0x8828)[0x800ef828]                                 | 0x...828 | 0x80008828: 0x80008826 <ForEachDisplay+38>:      call   *%esi
   wdm: -:0         (+0x8077)[0x800ef077]                                 | 0x...077 | 0x80008077: 0x80008072 <WaitForChild+1298>:      call   0x80008800 <ForEachDisplay>
   wdm: -:0         (+0xe24e)[0x800f524e]                                 | 0x...24e | 0x8000e24e: 0x8000e249 <WaitForSomething+73>:    call   0x80007b60 <WaitForChild>
   wdm: -:0         (main+0x1a5)[0x800e9ff5]                              | 0x...ff5 | 0x80002ff5: 0x80002ff0 <main+416>:       call   0x8000e200 <WaitForSomething>
   wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517] | 0x...517 |
   wdm: -:0         (+0x3327)[0x800ea327]                                 | 0x...327 |

#827672#13
Date:
2018-11-24 12:11:30 UTC
From:
To:
Dear Maintainer, hello Klaus Ethgen,
I just tried to get some more information out of this bug.

I could not reproduce it with a stretch testing or unstable
as of date 2016-07-20 inside a i386 qemu VM.

As far as I see is the problematic function in WDM:

    (gdb) list ManageSession            # wdm-1.28/src/wdm/session.c
    ...
    522     static Bool
    523     StartClient (
    524         struct verify_info  *verify,
    525         struct display      *d,
    526         int                 *pidp,
    527         char                *name,
    528         char                *passwd)
    529     {
    ...
    627     #ifdef WITH_SELINUX
    628             if (is_selinux_enabled())
    629             {
    630                     security_context_t scontext;
    631                     if (get_default_context(name,NULL,&scontext))
    632                             WDMError("Failed to get default security context"
    633                                             " for %s.", name);
    634                     WDMDebug("setting security context to %s", scontext);
    635                     if (setexeccon(scontext))
    636                     {
    637                             freecon(scontext);
    638                             WDMError("Failed to set exec security context %s "
    639                                             "for %s.", scontext, name);
    640                     }
    641                     freecon(scontext);
    642             }
    643     #endif


There it looks like function get_default_context failed - the message
"Failed to get default security context" appears in the log.

Therefore variable scontext may have stayed uninitilized,
which led to the observed crash in line 637, when trying to free
that uninitilized pointer.

    (gdb) list freecon                  # libselinux-2.5/src/freecon.c
    5
    6       void freecon(char * con)
    7       {
    8               free(con);
    9       }


I think this crash may happen with current testing version of wdm too,
when get_default_context fails.
But why in the first place the get_default_context may have failed I cannot say.

Does this problem still occour?
Or is it known if there was a selinux misconfiguration on this machine at that time?
Was there any other selinux configuration done?

Attached file shows some notes about the debugging attempts.

Kind regards,
Bernhard


   wdm: *** Error in `-:0         ': free(): invalid pointer: 0x80101d24 ***
   wdm: ======= Backtrace: =========
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b]               | 0x...29b |
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527]               | 0x...527 |
   wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1]               | 0x...cd1 |
   wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698]     | 0x...698 | 0xb7df7698: 0xb7df7693 <freecon_internal+19>:    call   0xb7df25b0 <free@plt>
   wdm: -:0         (+0xd104)[0x800f4104]                                 | 0x...104 | 0x8000d104: 0x8000d0ff <ManageSession+1871>:     call   0x80002d80                    ; 637                             freecon(scontext);
   wdm: -:0         (+0x8450)[0x800ef450]                                 | 0x...450 | 0x80008450: 0x8000844b <StartDisplay+187>:       call   0x8000c9b0 <ManageSession>
   wdm: -:0         (+0x8828)[0x800ef828]                                 | 0x...828 | 0x80008828: 0x80008826 <ForEachDisplay+38>:      call   *%esi
   wdm: -:0         (+0x8077)[0x800ef077]                                 | 0x...077 | 0x80008077: 0x80008072 <WaitForChild+1298>:      call   0x80008800 <ForEachDisplay>
   wdm: -:0         (+0xe24e)[0x800f524e]                                 | 0x...24e | 0x8000e24e: 0x8000e249 <WaitForSomething+73>:    call   0x80007b60 <WaitForChild>
   wdm: -:0         (main+0x1a5)[0x800e9ff5]                              | 0x...ff5 | 0x80002ff5: 0x80002ff0 <main+416>:       call   0x8000e200 <WaitForSomething>
   wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517] | 0x...517 |
   wdm: -:0         (+0x3327)[0x800ea327]                                 | 0x...327 |