Bugzilla Bug 191665

After upgrading to openssh-4.7, login user/role assignment in selinux no longer
works, and non-root users registered with other selinux user mappings get
mapped to the default selinux user/role (normally user_u).

Reproducible: Always

Steps to Reproduce:
tree ~ # id -Z
root:sysadm_r:sysadm_t
tree ~ # rlpkg -a
[...]
tree ~ # sestatus -v | egrep '(login|ssh|newrole)'
/bin/login                      system_u:object_r:login_exec_t
/usr/sbin/sshd                  system_u:object_r:sshd_exec_t
/usr/bin/newrole                system_u:object_r:newrole_exec_t
tree ~ # sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        strict
tree ~ # semanage login -a -s staff_u arth
tree ~ # semanage login -l

Login Name                SELinux User

__default__               user_u
arth                      staff_u
root                      root
tree ~ # semanage user -l
SELinux User    SELinux Roles

root            sysadm_r staff_r
staff_u         sysadm_r staff_r
sysadm_u        sysadm_r
system_u        system_r
user_u          user_r
tree ~ # ssh arth@localhost
Password:
Last login: Sat Sep  8 04:20:31 2007 from localhost
arth@tree ~ $ 

Actual Results:  
arth@tree ~ $ id -Z
user_u:user_r:user_t
arth@tree ~ $ newrole -r sysadm_r
user_u:sysadm_r:sysadm_t is not a valid context


Expected Results:  
arth@tree ~ $ id -Z
staff_u:staff_r:staff_t
arth@tree ~ $ newrole -r sysadm_r
Authenticating arth
Password:
arth@tree ~ id -Z
staff_u:sysadm_r:sysadm_t


If downgrading to net-misc/openssh-4.6_p1-r3 and restarting sshd, problem
disappears.

Due to how selinux prevents privilege escalation, this problem means that users
without a console or other physical access to a box might be locked out from
using root, and thus correct the problem.

This is only a problem for strict profile, right?
with targeted you there is no need to change user role, or have I misunderstood
something?

Any progress? i'd like to fix it because of
 GLSA 200711-02: Synopsis: A flaw has been discovered in OpenSSH which could
allow a local attacker to bypass security restrictions. 
 Announced on: November 01, 2007
 Vulnerable:        <4.7
 Unaffected:        >=4.7

I've tried openssh-4.7_p1-r4, and openssh still break selinux role assignment
:-(

that is very problematic because of the new security bug in openssh:
http://bugs.gentoo.org/show_bug.cgi?id=214985

Xake:  It is a problem with targeted too.  (Targeted only limits selinux to
certain packages -- you still use roles for THOSE packages).

Yes, this is becoming unbearable.  Almost seven months now, and no indication
that this is even looked at.  selinux users still have to mask all newer
openssh versions and use an old version (4.6p1) with known vulnerabilities.

fixed in -r5