|
 |
9070b3 |
diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
|
|
|
9070b3 |
index 8f32464..18a2ca4 100644
|
|
|
9070b3 |
--- a/openbsd-compat/port-linux-sshd.c
|
|
|
9070b3 |
+++ b/openbsd-compat/port-linux-sshd.c
|
|
|
9070b3 |
@@ -32,6 +32,7 @@
|
|
|
9070b3 |
#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */
|
|
|
9070b3 |
#include "servconf.h"
|
|
|
9070b3 |
#include "port-linux.h"
|
|
|
9070b3 |
+#include "misc.h"
|
|
|
9070b3 |
#include "sshkey.h"
|
|
|
9070b3 |
#include "hostfile.h"
|
|
|
9070b3 |
#include "auth.h"
|
|
|
9070b3 |
@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
|
|
|
9070b3 |
void
|
|
|
9070b3 |
sshd_selinux_copy_context(void)
|
|
|
9070b3 |
{
|
|
|
9070b3 |
- security_context_t *ctx;
|
|
|
9070b3 |
+ char *ctx;
|
|
|
9070b3 |
|
|
|
9070b3 |
if (!sshd_selinux_enabled())
|
|
|
9070b3 |
return;
|
|
|
9070b3 |
@@ -461,6 +462,72 @@ sshd_selinux_copy_context(void)
|
|
|
9070b3 |
}
|
|
|
9070b3 |
}
|
|
|
9070b3 |
|
|
|
9070b3 |
+void
|
|
|
9070b3 |
+sshd_selinux_change_privsep_preauth_context(void)
|
|
|
9070b3 |
+{
|
|
|
9070b3 |
+ int len;
|
|
|
9070b3 |
+ char line[1024], *preauth_context = NULL, *cp, *arg;
|
|
|
9070b3 |
+ const char *contexts_path;
|
|
|
9070b3 |
+ FILE *contexts_file;
|
|
|
9070b3 |
+ struct stat sb;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ contexts_path = selinux_openssh_contexts_path();
|
|
|
9070b3 |
+ if (contexts_path == NULL) {
|
|
|
9070b3 |
+ debug3_f("Failed to get the path to SELinux context");
|
|
|
9070b3 |
+ return;
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ if ((contexts_file = fopen(contexts_path, "r")) == NULL) {
|
|
|
9070b3 |
+ debug_f("Failed to open SELinux context file");
|
|
|
9070b3 |
+ return;
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ if (fstat(fileno(contexts_file), &sb) != 0 ||
|
|
|
9070b3 |
+ sb.st_uid != 0 || (sb.st_mode & 022) != 0) {
|
|
|
9070b3 |
+ logit_f("SELinux context file needs to be owned by root"
|
|
|
9070b3 |
+ " and not writable by anyone else");
|
|
|
9070b3 |
+ fclose(contexts_file);
|
|
|
9070b3 |
+ return;
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ while (fgets(line, sizeof(line), contexts_file)) {
|
|
|
9070b3 |
+ /* Strip trailing whitespace */
|
|
|
9070b3 |
+ for (len = strlen(line) - 1; len > 0; len--) {
|
|
|
9070b3 |
+ if (strchr(" \t\r\n", line[len]) == NULL)
|
|
|
9070b3 |
+ break;
|
|
|
9070b3 |
+ line[len] = '\0';
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ if (line[0] == '\0')
|
|
|
9070b3 |
+ continue;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ cp = line;
|
|
|
9070b3 |
+ arg = strdelim(&cp;;
|
|
|
9070b3 |
+ if (arg && *arg == '\0')
|
|
|
9070b3 |
+ arg = strdelim(&cp;;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ if (arg && strcmp(arg, "privsep_preauth") == 0) {
|
|
|
9070b3 |
+ arg = strdelim(&cp;;
|
|
|
9070b3 |
+ if (!arg || *arg == '\0') {
|
|
|
9070b3 |
+ debug_f("privsep_preauth is empty");
|
|
|
9070b3 |
+ fclose(contexts_file);
|
|
|
9070b3 |
+ return;
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ preauth_context = xstrdup(arg);
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ fclose(contexts_file);
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ if (preauth_context == NULL) {
|
|
|
9070b3 |
+ debug_f("Unable to find 'privsep_preauth' option in"
|
|
|
9070b3 |
+ " SELinux context file");
|
|
|
9070b3 |
+ return;
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+
|
|
|
9070b3 |
+ ssh_selinux_change_context(preauth_context);
|
|
|
9070b3 |
+ free(preauth_context);
|
|
|
9070b3 |
+}
|
|
|
9070b3 |
+
|
|
|
9070b3 |
#endif
|
|
|
9070b3 |
#endif
|
|
|
9070b3 |
|
|
|
9070b3 |
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
|
|
|
9070b3 |
index 22ea8ef..1fc963d 100644
|
|
|
9070b3 |
--- a/openbsd-compat/port-linux.c
|
|
|
9070b3 |
+++ b/openbsd-compat/port-linux.c
|
|
|
9070b3 |
@@ -179,7 +179,7 @@ ssh_selinux_change_context(const char *newname)
|
|
|
9070b3 |
strlcpy(newctx + len, newname, newlen - len);
|
|
|
9070b3 |
if ((cx = index(cx + 1, ':')))
|
|
|
9070b3 |
strlcat(newctx, cx, newlen);
|
|
|
9070b3 |
- debug3("%s: setting context from '%s' to '%s'", __func__,
|
|
|
9070b3 |
+ debug_f("setting context from '%s' to '%s'",
|
|
|
9070b3 |
oldctx, newctx);
|
|
|
9070b3 |
if (setcon(newctx) < 0)
|
|
|
9070b3 |
do_log2(log_level, "%s: setcon %s from %s failed with %s",
|
|
|
9070b3 |
__func__, newctx, oldctx, strerror(errno));
|
|
|
9070b3 |
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
|
|
|
9070b3 |
index cb51f99..8b7cda2 100644
|
|
|
9070b3 |
--- a/openbsd-compat/port-linux.h
|
|
|
9070b3 |
+++ b/openbsd-compat/port-linux.h
|
|
|
9070b3 |
@@ -29,6 +29,7 @@ int sshd_selinux_enabled(void);
|
|
|
9070b3 |
void sshd_selinux_copy_context(void);
|
|
|
9070b3 |
void sshd_selinux_setup_exec_context(char *);
|
|
|
9070b3 |
int sshd_selinux_setup_env_variables(void);
|
|
|
9070b3 |
+void sshd_selinux_change_privsep_preauth_context(void);
|
|
|
9070b3 |
#endif
|
|
|
9070b3 |
|
|
|
9070b3 |
#ifdef LINUX_OOM_ADJUST
|
|
|
9070b3 |
diff --git a/sshd.c b/sshd.c
|
|
|
9070b3 |
index 2871fe9..39b9c08 100644
|
|
|
9070b3 |
--- a/sshd.c
|
|
|
9070b3 |
+++ b/sshd.c
|
|
|
9070b3 |
@@ -629,7 +629,7 @@ privsep_preauth_child(void)
|
|
|
9070b3 |
demote_sensitive_data();
|
|
|
9070b3 |
|
|
|
9070b3 |
#ifdef WITH_SELINUX
|
|
|
9070b3 |
- ssh_selinux_change_context("sshd_net_t");
|
|
|
9070b3 |
+ sshd_selinux_change_privsep_preauth_context();
|
|
|
9070b3 |
#endif
|
|
|
9070b3 |
|
|
|
9070b3 |
/* Demote the child */
|