]> git.ipfire.org Git - people/stevee/ipfire-3.x.git/blame - openssh/patches/openssh-5.8p1-selinux-role.patch
projects / people / stevee / ipfire-3.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Move all packages to root.
[people/stevee/ipfire-3.x.git] / openssh / patches / openssh-5.8p1-selinux-role.patch
CommitLineData
852f4e06
SS		 1diff -up openssh-5.8p1/auth1.c.role openssh-5.8p1/auth1.c
2--- openssh-5.8p1/auth1.c.role 2010-08-31 14:36:39.000000000 +0200
3+++ openssh-5.8p1/auth1.c 2011-02-12 14:34:11.000000000 +0100
4@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt)
5 {
6 u_int ulen;
7 char *user, *style = NULL;
8+#ifdef WITH_SELINUX
9+ char *role=NULL;
10+#endif
11
12 /* Get the name of the user that we wish to log in as. */
13 packet_read_expect(SSH_CMSG_USER);
14@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt)
15 user = packet_get_cstring(&ulen);
16 packet_check_eom();
17
18+#ifdef WITH_SELINUX
19+ if ((role = strchr(user, '/')) != NULL)
20+ *role++ = '\0';
21+#endif
22+
23 if ((style = strchr(user, ':')) != NULL)
24 *style++ = '\0';
25+#ifdef WITH_SELINUX
26+ else
27+ if (role && (style = strchr(role, ':')) != NULL)
28+ *style++ = '\0';
29+#endif
30
31 authctxt->user = user;
32 authctxt->style = style;
33+#ifdef WITH_SELINUX
34+ authctxt->role = role;
35+#endif
36
37 /* Verify that the user is a valid user. */
38 if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
39diff -up openssh-5.8p1/auth2.c.role openssh-5.8p1/auth2.c
40--- openssh-5.8p1/auth2.c.role 2010-08-31 14:36:39.000000000 +0200
41+++ openssh-5.8p1/auth2.c 2011-02-12 14:34:11.000000000 +0100
42@@ -216,6 +216,9 @@ input_userauth_request(int type, u_int32
43 Authctxt *authctxt = ctxt;
44 Authmethod *m = NULL;
45 char *user, *service, *method, *style = NULL;
46+#ifdef WITH_SELINUX
47+ char *role = NULL;
48+#endif
49 int authenticated = 0;
50
51 if (authctxt == NULL)
52@@ -227,6 +230,11 @@ input_userauth_request(int type, u_int32
53 debug("userauth-request for user %s service %s method %s", user, service, method);
54 debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
55
56+#ifdef WITH_SELINUX
57+ if ((role = strchr(user, '/')) != NULL)
58+ *role++ = 0;
59+#endif
60+
61 if ((style = strchr(user, ':')) != NULL)
62 *style++ = 0;
63
64@@ -252,8 +260,15 @@ input_userauth_request(int type, u_int32
65 use_privsep ? " [net]" : "");
66 authctxt->service = xstrdup(service);
67 authctxt->style = style ? xstrdup(style) : NULL;
68- if (use_privsep)
69+#ifdef WITH_SELINUX
70+ authctxt->role = role ? xstrdup(role) : NULL;
71+#endif
72+ if (use_privsep) {
73 mm_inform_authserv(service, style);
74+#ifdef WITH_SELINUX
75+ mm_inform_authrole(role);
76+#endif
77+ }
78 userauth_banner();
79 } else if (strcmp(user, authctxt->user) != 0 ||
80 strcmp(service, authctxt->service) != 0) {
81diff -up openssh-5.8p1/auth2-gss.c.role openssh-5.8p1/auth2-gss.c
82--- openssh-5.8p1/auth2-gss.c.role 2007-12-02 12:59:45.000000000 +0100
83+++ openssh-5.8p1/auth2-gss.c 2011-02-12 14:34:11.000000000 +0100
84@@ -258,6 +258,7 @@ input_gssapi_mic(int type, u_int32_t ple
85 Authctxt *authctxt = ctxt;
86 Gssctxt *gssctxt;
87 int authenticated = 0;
88+ char *micuser;
89 Buffer b;
90 gss_buffer_desc mic, gssbuf;
91 u_int len;
92@@ -270,7 +271,13 @@ input_gssapi_mic(int type, u_int32_t ple
93 mic.value = packet_get_string(&len);
94 mic.length = len;
95
96- ssh_gssapi_buildmic(&b, authctxt->user, authctxt->service,
97+#ifdef WITH_SELINUX
98+ if (authctxt->role && (strlen(authctxt->role) > 0))
99+ xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role);
100+ else
101+#endif
102+ micuser = authctxt->user;
103+ ssh_gssapi_buildmic(&b, micuser, authctxt->service,
104 "gssapi-with-mic");
105
106 gssbuf.value = buffer_ptr(&b);
107@@ -282,6 +289,8 @@ input_gssapi_mic(int type, u_int32_t ple
108 logit("GSSAPI MIC check failed");
109
110 buffer_free(&b);
111+ if (micuser != authctxt->user)
112+ xfree(micuser);
113 xfree(mic.value);
114
115 authctxt->postponed = 0;
116diff -up openssh-5.8p1/auth2-hostbased.c.role openssh-5.8p1/auth2-hostbased.c
117--- openssh-5.8p1/auth2-hostbased.c.role 2011-02-12 14:34:10.000000000 +0100
118+++ openssh-5.8p1/auth2-hostbased.c 2011-02-12 14:34:11.000000000 +0100
119@@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt)
120 buffer_put_string(&b, session_id2, session_id2_len);
121 /* reconstruct packet */
122 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
123- buffer_put_cstring(&b, authctxt->user);
124+#ifdef WITH_SELINUX
125+ if (authctxt->role) {
126+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
127+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
128+ buffer_put_char(&b, '/');
129+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
130+ } else
131+#endif
132+ buffer_put_cstring(&b, authctxt->user);
133 buffer_put_cstring(&b, service);
134 buffer_put_cstring(&b, "hostbased");
135 buffer_put_string(&b, pkalg, alen);
136diff -up openssh-5.8p1/auth2-pubkey.c.role openssh-5.8p1/auth2-pubkey.c
137--- openssh-5.8p1/auth2-pubkey.c.role 2011-02-12 14:34:11.000000000 +0100
138+++ openssh-5.8p1/auth2-pubkey.c 2011-02-12 14:34:11.000000000 +0100
139@@ -122,7 +122,15 @@ userauth_pubkey(Authctxt *authctxt)
140 }
141 /* reconstruct packet */
142 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
143- buffer_put_cstring(&b, authctxt->user);
144+#ifdef WITH_SELINUX
145+ if (authctxt->role) {
146+ buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1);
147+ buffer_append(&b, authctxt->user, strlen(authctxt->user));
148+ buffer_put_char(&b, '/');
149+ buffer_append(&b, authctxt->role, strlen(authctxt->role));
150+ } else
151+#endif
152+ buffer_put_cstring(&b, authctxt->user);
153 buffer_put_cstring(&b,
154 datafellows & SSH_BUG_PKSERVICE ?
155 "ssh-userauth" :
156diff -up openssh-5.8p1/auth.h.role openssh-5.8p1/auth.h
157--- openssh-5.8p1/auth.h.role 2011-02-12 14:34:10.000000000 +0100
158+++ openssh-5.8p1/auth.h 2011-02-12 14:34:11.000000000 +0100
159@@ -58,6 +58,9 @@ struct Authctxt {
160 char *service;
161 struct passwd *pw; /* set if 'valid' */
162 char *style;
163+#ifdef WITH_SELINUX
164+ char *role;
165+#endif
166 void *kbdintctxt;
167 void *jpake_ctx;
168 #ifdef BSD_AUTH
169diff -up openssh-5.8p1/auth-pam.c.role openssh-5.8p1/auth-pam.c
170--- openssh-5.8p1/auth-pam.c.role 2009-07-12 14:07:21.000000000 +0200
171+++ openssh-5.8p1/auth-pam.c 2011-02-12 14:34:11.000000000 +0100
172@@ -1069,7 +1069,7 @@ is_pam_session_open(void)
173 * during the ssh authentication process.
174 */
175 int
176-do_pam_putenv(char *name, char *value)
177+do_pam_putenv(char *name, const char *value)
178 {
179 int ret = 1;
180 #ifdef HAVE_PAM_PUTENV
181diff -up openssh-5.8p1/auth-pam.h.role openssh-5.8p1/auth-pam.h
182--- openssh-5.8p1/auth-pam.h.role 2004-09-11 14:17:26.000000000 +0200
183+++ openssh-5.8p1/auth-pam.h 2011-02-12 14:34:11.000000000 +0100
184@@ -38,7 +38,7 @@ void do_pam_session(void);
185 void do_pam_set_tty(const char *);
186 void do_pam_setcred(int );
187 void do_pam_chauthtok(void);
188-int do_pam_putenv(char *, char *);
189+int do_pam_putenv(char *, const char *);
190 char ** fetch_pam_environment(void);
191 char ** fetch_pam_child_environment(void);
192 void free_pam_environment(char **);
193diff -up openssh-5.8p1/monitor.c.role openssh-5.8p1/monitor.c
194--- openssh-5.8p1/monitor.c.role 2011-02-12 14:34:11.000000000 +0100
195+++ openssh-5.8p1/monitor.c 2011-02-12 14:34:11.000000000 +0100
196@@ -138,6 +138,9 @@ int mm_answer_sign(int, Buffer *);
197 int mm_answer_pwnamallow(int, Buffer *);
198 int mm_answer_auth2_read_banner(int, Buffer *);
199 int mm_answer_authserv(int, Buffer *);
200+#ifdef WITH_SELINUX
201+int mm_answer_authrole(int, Buffer *);
202+#endif
203 int mm_answer_authpassword(int, Buffer *);
204 int mm_answer_bsdauthquery(int, Buffer *);
205 int mm_answer_bsdauthrespond(int, Buffer *);
206@@ -218,6 +221,9 @@ struct mon_table mon_dispatch_proto20[]
207 {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
208 {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
209 {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
210+#ifdef WITH_SELINUX
211+ {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole},
212+#endif
213 {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
214 {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
215 #ifdef USE_PAM
216@@ -703,6 +709,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
217 else {
218 /* Allow service/style information on the auth context */
219 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
220+#ifdef WITH_SELINUX
221+ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1);
222+#endif
223 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
224 }
225
226@@ -747,6 +756,25 @@ mm_answer_authserv(int sock, Buffer *m)
227 return (0);
228 }
229
230+#ifdef WITH_SELINUX
231+int
232+mm_answer_authrole(int sock, Buffer *m)
233+{
234+ monitor_permit_authentications(1);
235+
236+ authctxt->role = buffer_get_string(m, NULL);
237+ debug3("%s: role=%s",
238+ __func__, authctxt->role);
239+
240+ if (strlen(authctxt->role) == 0) {
241+ xfree(authctxt->role);
242+ authctxt->role = NULL;
243+ }
244+
245+ return (0);
246+}
247+#endif
248+
249 int
250 mm_answer_authpassword(int sock, Buffer *m)
251 {
252@@ -1112,7 +1140,7 @@ static int
253 monitor_valid_userblob(u_char *data, u_int datalen)
254 {
255 Buffer b;
256- char *p;
257+ char *p, *r;
258 u_int len;
259 int fail = 0;
260
261@@ -1138,6 +1166,8 @@ monitor_valid_userblob(u_char *data, u_i
262 if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
263 fail++;
264 p = buffer_get_string(&b, NULL);
265+ if ((r = strchr(p, '/')) != NULL)
266+ *r = '\0';
267 if (strcmp(authctxt->user, p) != 0) {
268 logit("wrong user name passed to monitor: expected %s != %.100s",
269 authctxt->user, p);
270@@ -1169,7 +1199,7 @@ monitor_valid_hostbasedblob(u_char *data
271 char *chost)
272 {
273 Buffer b;
274- char *p;
275+ char *p, *r;
276 u_int len;
277 int fail = 0;
278
279@@ -1186,6 +1216,8 @@ monitor_valid_hostbasedblob(u_char *data
280 if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
281 fail++;
282 p = buffer_get_string(&b, NULL);
283+ if ((r = strchr(p, '/')) != NULL)
284+ *r = '\0';
285 if (strcmp(authctxt->user, p) != 0) {
286 logit("wrong user name passed to monitor: expected %s != %.100s",
287 authctxt->user, p);
288diff -up openssh-5.8p1/monitor.h.role openssh-5.8p1/monitor.h
289--- openssh-5.8p1/monitor.h.role 2011-02-12 14:34:11.000000000 +0100
290+++ openssh-5.8p1/monitor.h 2011-02-12 14:34:11.000000000 +0100
291@@ -31,6 +31,9 @@
292 enum monitor_reqtype {
293 MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
294 MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
295+#ifdef WITH_SELINUX
296+ MONITOR_REQ_AUTHROLE,
297+#endif
298 MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
299 MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
300 MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
301diff -up openssh-5.8p1/monitor_wrap.c.role openssh-5.8p1/monitor_wrap.c
302--- openssh-5.8p1/monitor_wrap.c.role 2011-02-12 14:34:11.000000000 +0100
303+++ openssh-5.8p1/monitor_wrap.c 2011-02-12 14:34:11.000000000 +0100
304@@ -298,6 +298,25 @@ mm_inform_authserv(char *service, char *
305 buffer_free(&m);
306 }
307
308+/* Inform the privileged process about role */
309+
310+#ifdef WITH_SELINUX
311+void
312+mm_inform_authrole(char *role)
313+{
314+ Buffer m;
315+
316+ debug3("%s entering", __func__);
317+
318+ buffer_init(&m);
319+ buffer_put_cstring(&m, role ? role : "");
320+
321+ mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m);
322+
323+ buffer_free(&m);
324+}
325+#endif
326+
327 /* Do the password authentication */
328 int
329 mm_auth_password(Authctxt *authctxt, char *password)
330diff -up openssh-5.8p1/monitor_wrap.h.role openssh-5.8p1/monitor_wrap.h
331--- openssh-5.8p1/monitor_wrap.h.role 2011-02-12 14:34:11.000000000 +0100
332+++ openssh-5.8p1/monitor_wrap.h 2011-02-12 14:34:11.000000000 +0100
333@@ -41,6 +41,9 @@ int mm_is_monitor(void);
334 DH *mm_choose_dh(int, int, int);
335 int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
336 void mm_inform_authserv(char *, char *);
337+#ifdef WITH_SELINUX
338+void mm_inform_authrole(char *);
339+#endif
340 struct passwd *mm_getpwnamallow(const char *);
341 char *mm_auth2_read_banner(void);
342 int mm_auth_password(struct Authctxt *, char *);
343diff -up openssh-5.8p1/openbsd-compat/Makefile.in.role openssh-5.8p1/openbsd-compat/Makefile.in
344--- openssh-5.8p1/openbsd-compat/Makefile.in.role 2010-10-07 13:19:24.000000000 +0200
345+++ openssh-5.8p1/openbsd-compat/Makefile.in 2011-02-12 14:34:11.000000000 +0100
346@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
347
348 COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
349
350-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
351+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
352
353 .c.o:
354 $(CC) $(CFLAGS) $(CPPFLAGS) -c $<
355diff -up openssh-5.8p1/openbsd-compat/port-linux.c.role openssh-5.8p1/openbsd-compat/port-linux.c
356--- openssh-5.8p1/openbsd-compat/port-linux.c.role 2011-02-12 14:34:11.000000000 +0100
357+++ openssh-5.8p1/openbsd-compat/port-linux.c 2011-02-12 14:37:31.000000000 +0100
358@@ -31,48 +31,73 @@
359
360 #include "log.h"
361 #include "xmalloc.h"
362+#include "servconf.h"
363 #include "port-linux.h"
364+#include "key.h"
365+#include "hostfile.h"
366+#include "auth.h"
367
368 #ifdef WITH_SELINUX
369 #include <selinux/selinux.h>
370 #include <selinux/flask.h>
371 #include <selinux/get_context_list.h>
372
373-/* Wrapper around is_selinux_enabled() to log its return value once only */
374-int
375-ssh_selinux_enabled(void)
376-{
377- static int enabled = -1;
378+extern ServerOptions options;
379+extern Authctxt *the_authctxt;
380+extern int inetd_flag;
381+extern int rexeced_flag;
382
383- if (enabled == -1) {
384- enabled = (is_selinux_enabled() == 1);
385- debug("SELinux support %s", enabled ? "enabled" : "disabled");
386+static void
387+ssh_selinux_get_role_level(char **role, const char **level)
388+{
389+ *role = NULL;
390+ *level = NULL;
391+ if (the_authctxt) {
392+ if (the_authctxt->role != NULL) {
393+ char *slash;
394+ *role = xstrdup(the_authctxt->role);
395+ if ((slash = strchr(*role, '/')) != NULL) {
396+ *slash = '\0';
397+ *level = slash + 1;
398+ }
399+ }
400 }
401-
402- return (enabled);
403 }
404
405 /* Return the default security context for the given username */
406 static security_context_t
407 ssh_selinux_getctxbyname(char *pwname)
408 {
409- security_context_t sc;
410- char *sename = NULL, *lvl = NULL;
411- int r;
412+ security_context_t sc = NULL;
413+ char *sename, *lvl;
414+ char *role;
415+ const char *reqlvl;
416+ int r = 0;
417
418+ ssh_selinux_get_role_level(&role, &reqlvl);
419 #ifdef HAVE_GETSEUSERBYNAME
420- if (getseuserbyname(pwname, &sename, &lvl) != 0)
421- return NULL;
422+ if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
423+ sename = NULL;
424+ lvl = NULL;
425+ }
426 #else
427 sename = pwname;
428 lvl = NULL;
429 #endif
430
431+ if (r == 0) {
432 #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
433- r = get_default_context_with_level(sename, lvl, NULL, &sc);
434+ if (role != NULL && role[0])
435+ r = get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc);
436+ else
437+ r = get_default_context_with_level(sename, lvl, NULL, &sc);
438 #else
439- r = get_default_context(sename, NULL, &sc);
440+ if (role != NULL && role[0])
441+ r = get_default_context_with_role(sename, role, NULL, &sc);
442+ else
443+ r = get_default_context(sename, NULL, &sc);
444 #endif
445+ }
446
447 if (r != 0) {
448 switch (security_getenforce()) {
449@@ -100,6 +125,36 @@ ssh_selinux_getctxbyname(char *pwname)
450 return (sc);
451 }
452
453+/* Setup environment variables for pam_selinux */
454+static int
455+ssh_selinux_setup_pam_variables(void)
456+{
457+ const char *reqlvl;
458+ char *role;
459+ char *use_current;
460+ int rv;
461+
462+ debug3("%s: setting execution context", __func__);
463+
464+ ssh_selinux_get_role_level(&role, &reqlvl);
465+
466+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
467+
468+ if (inetd_flag && !rexeced_flag) {
469+ use_current = "1";
470+ } else {
471+ use_current = "";
472+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
473+ }
474+
475+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
476+
477+ if (role != NULL)
478+ xfree(role);
479+
480+ return rv;
481+}
482+
483 /* Set the execution context to the default for the specified user */
484 void
485 ssh_selinux_setup_exec_context(char *pwname)
486@@ -109,6 +164,24 @@ ssh_selinux_setup_exec_context(char *pwn
487 if (!ssh_selinux_enabled())
488 return;
489
490+ if (options.use_pam) {
491+ /* do not compute context, just setup environment for pam_selinux */
492+ if (ssh_selinux_setup_pam_variables()) {
493+ switch (security_getenforce()) {
494+ case -1:
495+ fatal("%s: security_getenforce() failed", __func__);
496+ case 0:
497+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.",
498+ __func__);
499+ break;
500+ default:
501+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.",
502+ __func__);
503+ }
504+ }
505+ return;
506+ }
507+
508 debug3("%s: setting execution context", __func__);
509
510 user_ctx = ssh_selinux_getctxbyname(pwname);
511@@ -206,21 +279,6 @@ ssh_selinux_change_context(const char *n
512 xfree(newctx);
513 }
514
515-void
516-ssh_selinux_setfscreatecon(const char *path)
517-{
518- security_context_t context;
519-
520- if (!ssh_selinux_enabled())
521- return;
522- if (path == NULL) {
523- setfscreatecon(NULL);
524- return;
525- }
526- if (matchpathcon(path, 0700, &context) == 0)
527- setfscreatecon(context);
528-}
529-
530 #endif /* WITH_SELINUX */
531
532 #ifdef LINUX_OOM_ADJUST
533diff -up openssh-5.8p1/openbsd-compat/port-linux_part_2.c.role openssh-5.8p1/openbsd-compat/port-linux_part_2.c
534--- openssh-5.8p1/openbsd-compat/port-linux_part_2.c.role 2011-02-12 14:34:11.000000000 +0100
535+++ openssh-5.8p1/openbsd-compat/port-linux_part_2.c 2011-02-12 14:34:11.000000000 +0100
536@@ -0,0 +1,75 @@
537+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
538+
539+/*
540+ * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
541+ * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
542+ *
543+ * Permission to use, copy, modify, and distribute this software for any
544+ * purpose with or without fee is hereby granted, provided that the above
545+ * copyright notice and this permission notice appear in all copies.
546+ *
547+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
548+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
549+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
550+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
551+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
552+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
553+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
554+ */
555+
556+/*
557+ * Linux-specific portability code - just SELinux support at present
558+ */
559+
560+#include "includes.h"
561+
562+#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST)
563+#include <errno.h>
564+#include <stdarg.h>
565+#include <string.h>
566+#include <stdio.h>
567+
568+#include "log.h"
569+#include "xmalloc.h"
570+#include "port-linux.h"
571+#include "key.h"
572+#include "hostfile.h"
573+#include "auth.h"
574+
575+#ifdef WITH_SELINUX
576+#include <selinux/selinux.h>
577+#include <selinux/flask.h>
578+#include <selinux/get_context_list.h>
579+
580+/* Wrapper around is_selinux_enabled() to log its return value once only */
581+int
582+ssh_selinux_enabled(void)
583+{
584+ static int enabled = -1;
585+
586+ if (enabled == -1) {
587+ enabled = (is_selinux_enabled() == 1);
588+ debug("SELinux support %s", enabled ? "enabled" : "disabled");
589+ }
590+
591+ return (enabled);
592+}
593+
594+void
595+ssh_selinux_setfscreatecon(const char *path)
596+{
597+ security_context_t context;
598+
599+ if (!ssh_selinux_enabled())
600+ return;
601+ if (path == NULL) {
602+ setfscreatecon(NULL);
603+ return;
604+ }
605+ if (matchpathcon(path, 0700, &context) == 0)
606+ setfscreatecon(context);
607+}
608+
609+#endif /* WITH_SELINUX */
610+
611+#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
Stefan's tree of IPFire 3.x.