|
|
1961bc1 |
diff -up openssh-5.0p1/auth-pam.h.pam_selinux openssh-5.0p1/auth-pam.h
|
|
|
1961bc1 |
--- openssh-5.0p1/auth-pam.h.pam_selinux 2004-09-11 14:17:26.000000000 +0200
|
|
|
1961bc1 |
+++ openssh-5.0p1/auth-pam.h 2008-04-30 14:25:28.000000000 +0200
|
|
|
1961bc1 |
@@ -38,7 +38,7 @@ void do_pam_session(void);
|
|
|
1961bc1 |
void do_pam_set_tty(const char *);
|
|
|
1961bc1 |
void do_pam_setcred(int );
|
|
|
1961bc1 |
void do_pam_chauthtok(void);
|
|
|
1961bc1 |
-int do_pam_putenv(char *, char *);
|
|
|
1961bc1 |
+int do_pam_putenv(char *, const char *);
|
|
|
1961bc1 |
char ** fetch_pam_environment(void);
|
|
|
1961bc1 |
char ** fetch_pam_child_environment(void);
|
|
|
1961bc1 |
void free_pam_environment(char **);
|
|
|
1961bc1 |
diff -up openssh-5.0p1/auth-pam.c.pam_selinux openssh-5.0p1/auth-pam.c
|
|
|
1961bc1 |
--- openssh-5.0p1/auth-pam.c.pam_selinux 2008-03-11 12:58:25.000000000 +0100
|
|
|
1961bc1 |
+++ openssh-5.0p1/auth-pam.c 2008-04-30 14:25:21.000000000 +0200
|
|
|
1961bc1 |
@@ -1069,7 +1069,7 @@ is_pam_session_open(void)
|
|
|
1961bc1 |
* during the ssh authentication process.
|
|
|
1961bc1 |
*/
|
|
|
1961bc1 |
int
|
|
|
1961bc1 |
-do_pam_putenv(char *name, char *value)
|
|
|
1961bc1 |
+do_pam_putenv(char *name, const char *value)
|
|
|
1961bc1 |
{
|
|
|
1961bc1 |
int ret = 1;
|
|
|
1961bc1 |
#ifdef HAVE_PAM_PUTENV
|
|
|
1961bc1 |
diff -up openssh-5.0p1/openbsd-compat/port-linux.c.pam_selinux openssh-5.0p1/openbsd-compat/port-linux.c
|
|
|
1961bc1 |
--- openssh-5.0p1/openbsd-compat/port-linux.c.pam_selinux 2008-04-07 22:01:37.000000000 +0200
|
|
|
1961bc1 |
+++ openssh-5.0p1/openbsd-compat/port-linux.c 2008-04-30 14:26:17.000000000 +0200
|
|
|
1961bc1 |
@@ -34,6 +34,7 @@
|
|
|
1961bc1 |
#include "hostfile.h"
|
|
|
1961bc1 |
#include "auth.h"
|
|
|
1961bc1 |
#include "xmalloc.h"
|
|
|
1961bc1 |
+#include "servconf.h"
|
|
|
1961bc1 |
|
|
|
1961bc1 |
#include <selinux/selinux.h>
|
|
|
1961bc1 |
#include <selinux/flask.h>
|
|
|
1961bc1 |
@@ -47,6 +48,7 @@
|
|
|
1961bc1 |
#include <unistd.h>
|
|
|
1961bc1 |
#endif
|
|
|
1961bc1 |
|
|
|
1961bc1 |
+extern ServerOptions options;
|
|
|
1961bc1 |
extern Authctxt *the_authctxt;
|
|
|
1961bc1 |
extern int inetd_flag;
|
|
|
1961bc1 |
extern int rexeced_flag;
|
|
|
1961bc1 |
@@ -208,29 +210,38 @@ get_user_context(const char *sename, con
|
|
|
1961bc1 |
return -1;
|
|
|
1961bc1 |
}
|
|
|
1961bc1 |
|
|
|
1961bc1 |
+static void
|
|
|
1961bc1 |
+ssh_selinux_get_role_level(char **role, const char **level)
|
|
|
1961bc1 |
+{
|
|
|
1961bc1 |
+ *role = NULL;
|
|
|
1961bc1 |
+ *level = NULL;
|
|
|
1961bc1 |
+ if (the_authctxt) {
|
|
|
1961bc1 |
+ if (the_authctxt->role != NULL) {
|
|
|
1961bc1 |
+ char *slash;
|
|
|
1961bc1 |
+ *role = xstrdup(the_authctxt->role);
|
|
|
1961bc1 |
+ if ((slash = strchr(*role, '/')) != NULL) {
|
|
|
1961bc1 |
+ *slash = '\0';
|
|
|
1961bc1 |
+ *level = slash + 1;
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+}
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
/* Return the default security context for the given username */
|
|
|
1961bc1 |
static int
|
|
|
1961bc1 |
ssh_selinux_getctxbyname(char *pwname,
|
|
|
1961bc1 |
security_context_t *default_sc, security_context_t *user_sc)
|
|
|
1961bc1 |
{
|
|
|
1961bc1 |
char *sename, *lvl;
|
|
|
1961bc1 |
- const char *reqlvl = NULL;
|
|
|
1961bc1 |
- char *role = NULL;
|
|
|
1961bc1 |
+ const char *reqlvl;
|
|
|
1961bc1 |
+ char *role;
|
|
|
1961bc1 |
int r = -1;
|
|
|
1961bc1 |
context_t con = NULL;
|
|
|
1961bc1 |
|
|
|
1961bc1 |
*default_sc = NULL;
|
|
|
1961bc1 |
*user_sc = NULL;
|
|
|
1961bc1 |
- if (the_authctxt) {
|
|
|
1961bc1 |
- if (the_authctxt->role != NULL) {
|
|
|
1961bc1 |
- char *slash;
|
|
|
1961bc1 |
- role = xstrdup(the_authctxt->role);
|
|
|
1961bc1 |
- if ((slash = strchr(role, '/')) != NULL) {
|
|
|
1961bc1 |
- *slash = '\0';
|
|
|
1961bc1 |
- reqlvl = slash + 1;
|
|
|
1961bc1 |
- }
|
|
|
1961bc1 |
- }
|
|
|
1961bc1 |
- }
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
|
|
1961bc1 |
|
|
|
1961bc1 |
#ifdef HAVE_GETSEUSERBYNAME
|
|
|
1961bc1 |
if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
|
|
1961bc1 |
@@ -311,6 +322,36 @@ ssh_selinux_getctxbyname(char *pwname,
|
|
|
1961bc1 |
return (r);
|
|
|
1961bc1 |
}
|
|
|
1961bc1 |
|
|
|
1961bc1 |
+/* Setup environment variables for pam_selinux */
|
|
|
1961bc1 |
+static int
|
|
|
1961bc1 |
+ssh_selinux_setup_pam_variables(void)
|
|
|
1961bc1 |
+{
|
|
|
1961bc1 |
+ const char *reqlvl;
|
|
|
1961bc1 |
+ char *role;
|
|
|
1961bc1 |
+ char *use_current;
|
|
|
1961bc1 |
+ int rv;
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ debug3("%s: setting execution context", __func__);
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ if (inetd_flag && !rexeced_flag) {
|
|
|
1961bc1 |
+ use_current = "1";
|
|
|
1961bc1 |
+ } else {
|
|
|
1961bc1 |
+ use_current = "";
|
|
|
1961bc1 |
+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ if (role != NULL)
|
|
|
1961bc1 |
+ xfree(role);
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
+ return rv;
|
|
|
1961bc1 |
+}
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
/* Set the execution context to the default for the specified user */
|
|
|
1961bc1 |
void
|
|
|
1961bc1 |
ssh_selinux_setup_exec_context(char *pwname)
|
|
|
1961bc1 |
@@ -322,6 +363,24 @@ ssh_selinux_setup_exec_context(char *pwn
|
|
|
1961bc1 |
if (!ssh_selinux_enabled())
|
|
|
1961bc1 |
return;
|
|
|
1961bc1 |
|
|
|
1961bc1 |
+ if (options.use_pam) {
|
|
|
1961bc1 |
+ /* do not compute context, just setup environment for pam_selinux */
|
|
|
1961bc1 |
+ if (ssh_selinux_setup_pam_variables()) {
|
|
|
1961bc1 |
+ switch (security_getenforce()) {
|
|
|
1961bc1 |
+ case -1:
|
|
|
1961bc1 |
+ fatal("%s: security_getenforce() failed", __func__);
|
|
|
1961bc1 |
+ case 0:
|
|
|
1961bc1 |
+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.",
|
|
|
1961bc1 |
+ __func__);
|
|
|
1961bc1 |
+ break;
|
|
|
1961bc1 |
+ default:
|
|
|
1961bc1 |
+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.",
|
|
|
1961bc1 |
+ __func__);
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+ return;
|
|
|
1961bc1 |
+ }
|
|
|
1961bc1 |
+
|
|
|
1961bc1 |
debug3("%s: setting execution context", __func__);
|
|
|
1961bc1 |
|
|
|
1961bc1 |
r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
|