| 1 |
diff -up openssh-5.0p1/auth-pam.h.pam_selinux openssh-5.0p1/auth-pam.h
|
| 2 |
--- openssh-5.0p1/auth-pam.h.pam_selinux 2004-09-11 14:17:26.000000000 +0200
|
| 3 |
+++ openssh-5.0p1/auth-pam.h 2008-04-30 14:25:28.000000000 +0200
|
| 4 |
@@ -38,7 +38,7 @@ void do_pam_session(void);
|
| 5 |
void do_pam_set_tty(const char *);
|
| 6 |
void do_pam_setcred(int );
|
| 7 |
void do_pam_chauthtok(void);
|
| 8 |
-int do_pam_putenv(char *, char *);
|
| 9 |
+int do_pam_putenv(char *, const char *);
|
| 10 |
char ** fetch_pam_environment(void);
|
| 11 |
char ** fetch_pam_child_environment(void);
|
| 12 |
void free_pam_environment(char **);
|
| 13 |
diff -up openssh-5.0p1/auth-pam.c.pam_selinux openssh-5.0p1/auth-pam.c
|
| 14 |
--- openssh-5.0p1/auth-pam.c.pam_selinux 2008-03-11 12:58:25.000000000 +0100
|
| 15 |
+++ openssh-5.0p1/auth-pam.c 2008-04-30 14:25:21.000000000 +0200
|
| 16 |
@@ -1069,7 +1069,7 @@ is_pam_session_open(void)
|
| 17 |
* during the ssh authentication process.
|
| 18 |
*/
|
| 19 |
int
|
| 20 |
-do_pam_putenv(char *name, char *value)
|
| 21 |
+do_pam_putenv(char *name, const char *value)
|
| 22 |
{
|
| 23 |
int ret = 1;
|
| 24 |
#ifdef HAVE_PAM_PUTENV
|
| 25 |
diff -up openssh-5.0p1/openbsd-compat/port-linux.c.pam_selinux openssh-5.0p1/openbsd-compat/port-linux.c
|
| 26 |
--- openssh-5.0p1/openbsd-compat/port-linux.c.pam_selinux 2008-04-07 22:01:37.000000000 +0200
|
| 27 |
+++ openssh-5.0p1/openbsd-compat/port-linux.c 2008-04-30 14:26:17.000000000 +0200
|
| 28 |
@@ -34,6 +34,7 @@
|
| 29 |
#include "hostfile.h"
|
| 30 |
#include "auth.h"
|
| 31 |
#include "xmalloc.h"
|
| 32 |
+#include "servconf.h"
|
| 33 |
|
| 34 |
#include <selinux/selinux.h>
|
| 35 |
#include <selinux/flask.h>
|
| 36 |
@@ -47,6 +48,7 @@
|
| 37 |
#include <unistd.h>
|
| 38 |
#endif
|
| 39 |
|
| 40 |
+extern ServerOptions options;
|
| 41 |
extern Authctxt *the_authctxt;
|
| 42 |
extern int inetd_flag;
|
| 43 |
extern int rexeced_flag;
|
| 44 |
@@ -208,29 +210,38 @@ get_user_context(const char *sename, con
|
| 45 |
return -1;
|
| 46 |
}
|
| 47 |
|
| 48 |
+static void
|
| 49 |
+ssh_selinux_get_role_level(char **role, const char **level)
|
| 50 |
+{
|
| 51 |
+ *role = NULL;
|
| 52 |
+ *level = NULL;
|
| 53 |
+ if (the_authctxt) {
|
| 54 |
+ if (the_authctxt->role != NULL) {
|
| 55 |
+ char *slash;
|
| 56 |
+ *role = xstrdup(the_authctxt->role);
|
| 57 |
+ if ((slash = strchr(*role, '/')) != NULL) {
|
| 58 |
+ *slash = '\0';
|
| 59 |
+ *level = slash + 1;
|
| 60 |
+ }
|
| 61 |
+ }
|
| 62 |
+ }
|
| 63 |
+}
|
| 64 |
+
|
| 65 |
/* Return the default security context for the given username */
|
| 66 |
static int
|
| 67 |
ssh_selinux_getctxbyname(char *pwname,
|
| 68 |
security_context_t *default_sc, security_context_t *user_sc)
|
| 69 |
{
|
| 70 |
char *sename, *lvl;
|
| 71 |
- const char *reqlvl = NULL;
|
| 72 |
- char *role = NULL;
|
| 73 |
+ const char *reqlvl;
|
| 74 |
+ char *role;
|
| 75 |
int r = -1;
|
| 76 |
context_t con = NULL;
|
| 77 |
|
| 78 |
*default_sc = NULL;
|
| 79 |
*user_sc = NULL;
|
| 80 |
- if (the_authctxt) {
|
| 81 |
- if (the_authctxt->role != NULL) {
|
| 82 |
- char *slash;
|
| 83 |
- role = xstrdup(the_authctxt->role);
|
| 84 |
- if ((slash = strchr(role, '/')) != NULL) {
|
| 85 |
- *slash = '\0';
|
| 86 |
- reqlvl = slash + 1;
|
| 87 |
- }
|
| 88 |
- }
|
| 89 |
- }
|
| 90 |
+
|
| 91 |
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
| 92 |
|
| 93 |
#ifdef HAVE_GETSEUSERBYNAME
|
| 94 |
if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
|
| 95 |
@@ -311,6 +322,36 @@ ssh_selinux_getctxbyname(char *pwname,
|
| 96 |
return (r);
|
| 97 |
}
|
| 98 |
|
| 99 |
+/* Setup environment variables for pam_selinux */
|
| 100 |
+static int
|
| 101 |
+ssh_selinux_setup_pam_variables(void)
|
| 102 |
+{
|
| 103 |
+ const char *reqlvl;
|
| 104 |
+ char *role;
|
| 105 |
+ char *use_current;
|
| 106 |
+ int rv;
|
| 107 |
+
|
| 108 |
+ debug3("%s: setting execution context", __func__);
|
| 109 |
+
|
| 110 |
+ ssh_selinux_get_role_level(&role, &reqlvl);
|
| 111 |
+
|
| 112 |
+ rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
|
| 113 |
+
|
| 114 |
+ if (inetd_flag && !rexeced_flag) {
|
| 115 |
+ use_current = "1";
|
| 116 |
+ } else {
|
| 117 |
+ use_current = "";
|
| 118 |
+ rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
|
| 119 |
+ }
|
| 120 |
+
|
| 121 |
+ rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
|
| 122 |
+
|
| 123 |
+ if (role != NULL)
|
| 124 |
+ xfree(role);
|
| 125 |
+
|
| 126 |
+ return rv;
|
| 127 |
+}
|
| 128 |
+
|
| 129 |
/* Set the execution context to the default for the specified user */
|
| 130 |
void
|
| 131 |
ssh_selinux_setup_exec_context(char *pwname)
|
| 132 |
@@ -322,6 +363,24 @@ ssh_selinux_setup_exec_context(char *pwn
|
| 133 |
if (!ssh_selinux_enabled())
|
| 134 |
return;
|
| 135 |
|
| 136 |
+ if (options.use_pam) {
|
| 137 |
+ /* do not compute context, just setup environment for pam_selinux */
|
| 138 |
+ if (ssh_selinux_setup_pam_variables()) {
|
| 139 |
+ switch (security_getenforce()) {
|
| 140 |
+ case -1:
|
| 141 |
+ fatal("%s: security_getenforce() failed", __func__);
|
| 142 |
+ case 0:
|
| 143 |
+ error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.",
|
| 144 |
+ __func__);
|
| 145 |
+ break;
|
| 146 |
+ default:
|
| 147 |
+ fatal("%s: SELinux PAM variable setup failure. Aborting connection.",
|
| 148 |
+ __func__);
|
| 149 |
+ }
|
| 150 |
+ }
|
| 151 |
+ return;
|
| 152 |
+ }
|
| 153 |
+
|
| 154 |
debug3("%s: setting execution context", __func__);
|
| 155 |
|
| 156 |
r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx);
|
Parent Directory
| 
Revision Log