seccomp-bpf filter violation in sshd

[mike2307]

After enabling the preload of the libhardened_malloc.so, I'm not able to login any more via SSH. This is the case for a system running the Fedora 30 with all the latest updates as well as RHEL 7.7 with all the latest updates.

What I've done:

• Compiled libhardened_malloc.so with all default settings.
• Installed into /usr/local/lib64/
• Created /etc/ld.so.preload with content /usr/local/lib64/libhardened_malloc.so
• Created /etc/sysctl.d/51-hardened_malloc.conf with content vm.max_map_count = 524288
• Rebooted
• Everything working normal
• Trying to login via SSH from a different machine (where I'm getting Connection closed by 192.168.0.10 port 22)

I looked through the logs after a failed login and could find something in /var/log/audit/audit.log on the server's side.

...
type=ANOM_ABEND msg=audit(1566493285.761:2070): auid=4294967295 uid=74 gid=74 ses=4294967295 subj=system_u:system_r:sshd_net_t:s0-s0:c0.c1023 pid=56568 comm="sshd" reason="memory violation" sig=31
...
type=USER_LOGIN msg=audit(1566493285.762:2074): pid=56567 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.20 terminal=ssh res=failed'
...

Please help.
Must be caused by libhardened_malloc.so because removing it from /etc/ld.so.preload fixes the problem.

[thestinger]

I think this is a violation of their seccomp-bpf filter, which doesn't whitelist mprotect. It will need to be addressed like the man-db issue.

[thestinger]

You can see in https://github.com/openssh/openssh-portable/blob/master/sandbox-seccomp-filter.c that mprotect is not whitelisted.

[mike2307]

That was a quick response! :)
What is the man-db issue? Maybe I can try to patch/contribute...

[thestinger]

The same problem with getrandom rather than mprotect.

https://git.savannah.gnu.org/cgit/man-db.git/commit/?id=0951f82c611c4a3c14271b0fa9c4919c84b7afe7

It would technically be possible for hardened_malloc to use mmap with MAP_FIXED instead of mprotect to unprotect slabs, metadata and the non-guard portion of large allocations. However, mprotect makes more sense, is probably somewhat faster and should probably be whitelisted as part of permitted malloc usage. It's used by glibc malloc but they apparently don't trigger it. I think they'd be fine with adding it especially since OpenBSD malloc uses mprotect too.

[mike2307]

Someone already opened a pull request:
openssh/openssh-portable#142

[lukateras]

Fixed upstream in openssh/openssh-portable@f6906f9.

[thestinger]

It would be good if someone could keep an eye on this and let me know when it's available in a release.

[aclonegeek]

@thestinger

If I'm not mistaken, it looks like it's available in OpenSSH 8.1.

See:
Release notes
Commit tagged to V_8_1_P1

[thestinger]

Thanks.

[adrelanos]

OpenSSH feature request: test compatibility with hardened memory allocator Hardened Malloc

[adrelanos]

openssh/openssh-portable@b744914