Bug 240891 - With MAC_BIBA (presumably MAC_MLS as well) sshd cannot set the login class properly
Summary: With MAC_BIBA (presumably MAC_MLS as well) sshd cannot set the login class pr...
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 12.0-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-09-28 09:57 UTC by kayront
Modified: 2019-09-30 12:03 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description kayront 2019-09-28 09:57:35 UTC 
I *think* this is the same as https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=177698 from several years back.

With the following login class in /etc/login.conf:

admin:\
        :label=biba/low(low-5):\
        :tc=default:

And with the user properly set to that login class (confirmed by grepping /etc/master.passwd), after logging in over ssh:

$ id -c && getpmac
daemon
biba/low(low-5),partition/0

(Note that the login class is set to *daemon* .. it seems to have failed silently to set it and some default was applied)



Now if we go back to login.conf and change biba/low(low-5) to biba/low(low-high):

$ id -c && getpmac
admin
biba/low(low-high),partition/0


I am not entirely sure why this is happening, but the practical effect is removing the ability to set login classes for SSH users that cannot reach biba/high, which greatly defeats the purpose of employing MAC_BIBA to ensure the system's integrity.