Package: wdm
Version: 1.28-19
Severity: important
Recently I enabled selinux on my desktop box and ran into a bad bug in
wdm (Maybe this bug is not in wdm than in glibc, so feel free to
reassign)
WDM starts without any problem but when I log in as user, it crashes
with the following stacktrace:
: Failed to get default security context for klaus.
wdm: *** Error in `-:0 ': free(): invalid pointer: 0x80101d24 ***
wdm: ======= Backtrace: =========
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b]
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527]
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1]
wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698]
wdm: -:0 (+0xd104)[0x800f4104]
wdm: -:0 (+0x8450)[0x800ef450]
wdm: -:0 (+0x8828)[0x800ef828]
wdm: -:0 (+0x8077)[0x800ef077]
wdm: -:0 (+0xe24e)[0x800f524e]
wdm: -:0 (main+0x1a5)[0x800e9ff5]
wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517]
wdm: -:0 (+0x3327)[0x800ea327]
(The trace is from a i386 box but the bug also happens on a amd64 one)
I was able to reporduce that bug on a second machine. It is not possible
to log in with selinux enabled (even not in permissive mode as I have it
currently:
~> getenforce
Permissive
As told above, that might be a bug in glibc. In this case, please
reassign.
Not related to the box I run reportbug as the one I tested selinux has
normal debian kernel and the one I run reportbug has a custom one
without selinux.
Dear Maintainer, hello Klaus Ethgen,
I just tried to get some more information out of this bug.
I could not reproduce it with a stretch testing or unstable
as of date 2016-07-20 inside a i386 qemu VM.
As far as I see is the problematic function in WDM:
(gdb) list ManageSession # wdm-1.28/src/wdm/session.c
...
522 static Bool
523 StartClient (
524 struct verify_info *verify,
525 struct display *d,
526 int *pidp,
527 char *name,
528 char *passwd)
529 {
...
627 #ifdef WITH_SELINUX
628 if (is_selinux_enabled())
629 {
630 security_context_t scontext;
631 if (get_default_context(name,NULL,&scontext))
632 WDMError("Failed to get default security context"
633 " for %s.", name);
634 WDMDebug("setting security context to %s", scontext);
635 if (setexeccon(scontext))
636 {
637 freecon(scontext);
638 WDMError("Failed to set exec security context %s "
639 "for %s.", scontext, name);
640 }
641 freecon(scontext);
642 }
643 #endif
There it looks like function get_default_context failed - the message
"Failed to get default security context" appears in the log.
Therefore variable scontext may have stayed uninitilized,
which led to the observed crash in line 637, when trying to free
that uninitilized pointer.
(gdb) list freecon # libselinux-2.5/src/freecon.c
5
6 void freecon(char * con)
7 {
8 free(con);
9 }
I think this crash may happen with current testing version of wdm too,
when get_default_context fails.
But why in the first place the get_default_context may have failed I cannot say.
Does this problem still occour?
Or is it known if there was a selinux misconfiguration on this machine at that time?
Was there any other selinux configuration done?
Attached file shows some notes about the debugging attempts.
Kind regards,
Bernhard
wdm: *** Error in `-:0 ': free(): invalid pointer: 0x80101d24 ***
wdm: ======= Backtrace: =========
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b] | 0x...29b |
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527] | 0x...527 |
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1] | 0x...cd1 |
wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698] | 0x...698 | 0xb7df7698: 0xb7df7693 <freecon_internal+19>: call 0xb7df25b0 <free@plt>
wdm: -:0 (+0xd104)[0x800f4104] | 0x...104 | 0x8000d104: 0x8000d0ff <ManageSession+1871>: call 0x80002d80 ; 637 freecon(scontext);
wdm: -:0 (+0x8450)[0x800ef450] | 0x...450 | 0x80008450: 0x8000844b <StartDisplay+187>: call 0x8000c9b0 <ManageSession>
wdm: -:0 (+0x8828)[0x800ef828] | 0x...828 | 0x80008828: 0x80008826 <ForEachDisplay+38>: call *%esi
wdm: -:0 (+0x8077)[0x800ef077] | 0x...077 | 0x80008077: 0x80008072 <WaitForChild+1298>: call 0x80008800 <ForEachDisplay>
wdm: -:0 (+0xe24e)[0x800f524e] | 0x...24e | 0x8000e24e: 0x8000e249 <WaitForSomething+73>: call 0x80007b60 <WaitForChild>
wdm: -:0 (main+0x1a5)[0x800e9ff5] | 0x...ff5 | 0x80002ff5: 0x80002ff0 <main+416>: call 0x8000e200 <WaitForSomething>
wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517] | 0x...517 |
wdm: -:0 (+0x3327)[0x800ea327] | 0x...327 |
Dear Maintainer, hello Klaus Ethgen,
I just tried to get some more information out of this bug.
I could not reproduce it with a stretch testing or unstable
as of date 2016-07-20 inside a i386 qemu VM.
As far as I see is the problematic function in WDM:
(gdb) list ManageSession # wdm-1.28/src/wdm/session.c
...
522 static Bool
523 StartClient (
524 struct verify_info *verify,
525 struct display *d,
526 int *pidp,
527 char *name,
528 char *passwd)
529 {
...
627 #ifdef WITH_SELINUX
628 if (is_selinux_enabled())
629 {
630 security_context_t scontext;
631 if (get_default_context(name,NULL,&scontext))
632 WDMError("Failed to get default security context"
633 " for %s.", name);
634 WDMDebug("setting security context to %s", scontext);
635 if (setexeccon(scontext))
636 {
637 freecon(scontext);
638 WDMError("Failed to set exec security context %s "
639 "for %s.", scontext, name);
640 }
641 freecon(scontext);
642 }
643 #endif
There it looks like function get_default_context failed - the message
"Failed to get default security context" appears in the log.
Therefore variable scontext may have stayed uninitilized,
which led to the observed crash in line 637, when trying to free
that uninitilized pointer.
(gdb) list freecon # libselinux-2.5/src/freecon.c
5
6 void freecon(char * con)
7 {
8 free(con);
9 }
I think this crash may happen with current testing version of wdm too,
when get_default_context fails.
But why in the first place the get_default_context may have failed I cannot say.
Does this problem still occour?
Or is it known if there was a selinux misconfiguration on this machine at that time?
Was there any other selinux configuration done?
Attached file shows some notes about the debugging attempts.
Kind regards,
Bernhard
wdm: *** Error in `-:0 ': free(): invalid pointer: 0x80101d24 ***
wdm: ======= Backtrace: =========
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6929b)[0xb738a29b] | 0x...29b |
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6f527)[0xb7390527] | 0x...527 |
wdm: /lib/i386-linux-gnu/libc.so.6(+0x6fcd1)[0xb7390cd1] | 0x...cd1 |
wdm: /lib/i386-linux-gnu/libselinux.so.1(freecon+0x18)[0xb750a698] | 0x...698 | 0xb7df7698: 0xb7df7693 <freecon_internal+19>: call 0xb7df25b0 <free@plt>
wdm: -:0 (+0xd104)[0x800f4104] | 0x...104 | 0x8000d104: 0x8000d0ff <ManageSession+1871>: call 0x80002d80 ; 637 freecon(scontext);
wdm: -:0 (+0x8450)[0x800ef450] | 0x...450 | 0x80008450: 0x8000844b <StartDisplay+187>: call 0x8000c9b0 <ManageSession>
wdm: -:0 (+0x8828)[0x800ef828] | 0x...828 | 0x80008828: 0x80008826 <ForEachDisplay+38>: call *%esi
wdm: -:0 (+0x8077)[0x800ef077] | 0x...077 | 0x80008077: 0x80008072 <WaitForChild+1298>: call 0x80008800 <ForEachDisplay>
wdm: -:0 (+0xe24e)[0x800f524e] | 0x...24e | 0x8000e24e: 0x8000e249 <WaitForSomething+73>: call 0x80007b60 <WaitForChild>
wdm: -:0 (main+0x1a5)[0x800e9ff5] | 0x...ff5 | 0x80002ff5: 0x80002ff0 <main+416>: call 0x8000e200 <WaitForSomething>
wdm: /lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf7)[0xb7339517] | 0x...517 |
wdm: -:0 (+0x3327)[0x800ea327] | 0x...327 |