aws / aws/amazon-ssm-agent

SSM Session Manager fails to set correct selinux context on user's pty

Open
#498 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

When connecting to a SELinux enforcing host via SSM, the user's pty does not get the correct SELinux context. This causes selinux confined commands (such as `chronyc`) to fail to write to the user's pty.

Connect to a RHEL7 host with SSM:

```
$ aws ssm start-session --target

Starting session with SessionId: myusername-014c36002c2d064c5
sh-4.2$ sudo -i

[root@ip-10-128-43-46 ~]# getenforce
Enforcing

[root@ip-10-128-43-46 ~]# ls -lZ $(tty)
crw--w----. root tty system_u:object_r:devpts_t:s0 /dev/pts/0
```

Observe system is in SELinux enforcing mode, and my pty device has an selinux context of `devpts_t`. When I attempt `chronyc tracking` I get no output from it:

```
[root@ip-10-128-43-46 ~]# chronyc tracking
```

If I disable SELinux then `chronyc` works:

```
[root@ip-10-128-43-46 ~]# setenforce 0

[root@ip-10-128-43-46 ~]# chronyc tracking
Reference ID : A9FEA97B (169.254.169.123)
Stratum : 4
Ref time (UTC) : Fri Apr 08 18:32:20 2022
System time : 0.000001437 seconds slow of NTP time
Last offset : -0.000000292 seconds
RMS offset : 0.000039443 seconds
Frequency : 2.625 ppm fast
Residual freq : -0.000 ppm
Skew : 0.044 ppm
Root delay : 0.000353114 seconds
Root dispersion : 0.000261603 seconds
Update interval : 16.3 seconds
Leap status : Normal
```

If I connect to this same host via SSH:

```
$ ssh ec2-user@18.207.214.91
sh-4.2$ sudo -i

[root@ip-10-128-43-46 ~]# ls -lZ $( tty )
crw--w----. ec2-user tty unconfined_u:object_r:user_devpts_t:s0 /dev/pts/0

[root@ip-10-128-43-46 ~]# chronyc tracking
Reference ID : A9FEA97B (169.254.169.123)
Stratum : 4
Ref time (UTC) : Fri Apr 08 18:26:24 2022
System time : 0.000001558 seconds fast of NTP time
Last offset : +0.000000718 seconds
RMS offset : 0.000119167 seconds
Frequency : 2.659 ppm fast
Residual freq : +0.001 ppm
Skew : 0.198 ppm
Root delay : 0.000357058 seconds
Root dispersion : 0.000272572 seconds
Update interval : 16.2 seconds
Leap status : Normal
```

First, observe that the pty has a different context - `user_devpts_t`. And `chronyc` works, even in SELinux enforcing mode.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing an SSM session on a RHEL7 host with SELinux enforcing, then compare the session pty from `ls -lZ $(tty)` with the SSH pty. Verify the fix by confirming the SSM pty receives the appropriate user context and that `chronyc tracking` produces output while enforcing mode remains enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.