--- openssh-4.5p1/openbsd-compat/port-linux.c.mls	2007-01-16 22:08:06.000000000 +0100

+++ openssh-4.5p1/openbsd-compat/port-linux.c	2007-01-16 22:11:05.000000000 +0100

@@ -33,12 +33,22 @@

 #include "key.h"

 #include "hostfile.h"

 #include "auth.h"

+#include "xmalloc.h"

 #include <selinux/selinux.h>

 #include <selinux/flask.h>

+#include <selinux/context.h>

 #include <selinux/get_context_list.h>

+#include <selinux/av_permissions.h>

+

+#ifdef HAVE_LINUX_AUDIT

+#include <libaudit.h>

+#include <unistd.h>

+#endif

 extern Authctxt *the_authctxt;

+extern int inetd_flag;

+extern int rexeced_flag;

 /* Wrapper around is_selinux_enabled() to log its return value once only */

 static int

@@ -54,17 +64,107 @@

 	return (enabled);

 }

+/* Send audit message */

+static int

+send_audit_message(int success, security_context_t default_context,

+		       security_context_t selected_context)

+{

+	int rc=0;

+#ifdef HAVE_LINUX_AUDIT

+	char *msg = NULL;

+	int audit_fd = audit_open();

+	security_context_t default_raw=NULL;

+	security_context_t selected_raw=NULL;

+	rc = -1;

+	if (audit_fd < 0) {

+		if (errno == EINVAL || errno == EPROTONOSUPPORT ||

+                                        errno == EAFNOSUPPORT)

+                        return 0; /* No audit support in kernel */

+		error("Error connecting to audit system.");

+		return rc;

+	}

+	if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) {

+		error("Error translating default context.");

+		goto out;

+	}

+	if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) {

+		error("Error translating selected context.");

+		goto out;

+	}

+	if (asprintf(&msg, "sshd: default-context=%s selected-context=%s",

+		     default_context ? default_raw : "?",

+		     selected_context ? selected_raw : "?") < 0) {

+		error("Error allocating memory.");

+		goto out;

+	}

+	if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE,

+				   msg, NULL, NULL, NULL, success) <= 0) {

+		error("Error sending audit message.");

+		goto out;

+	}

+	rc = 0;

+      out:

+	free(msg);

+	freecon(default_raw);

+	freecon(selected_raw);

+	close(audit_fd);

+#endif

+	return rc;

+}

+

+static int

+mls_range_allowed(security_context_t src, security_context_t dst)

+{

+	struct av_decision avd;

+	int retval;

+	unsigned int bit = CONTEXT__CONTAINS;

+

+	retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd);

+	if (retval || ((bit & avd.allowed) != bit))

+		return 0;

+

+	return 1;

+}

+

+static int

+get_user_context(const char *sename, const char *role, const char *lvl,

+	security_context_t *sc) {

+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL

+		if (role != NULL && role[0])

+			return get_default_context_with_rolelevel(sename, role, lvl, NULL, sc);

+		else

+			return get_default_context_with_level(sename, lvl, NULL, sc);

+#else

+		if (role != NULL && role[0])

+			return get_default_context_with_role(sename, role, NULL, sc);

+		else

+			return get_default_context(sename, NULL, sc);

+#endif

+}

+

 /* Return the default security context for the given username */

 static security_context_t

 ssh_selinux_getctxbyname(char *pwname)

 {

 	security_context_t sc = NULL;

+	security_context_t defsc = NULL;

 	char *sename, *lvl;

+	const char *reqlvl = NULL;

 	char *role = NULL;

 	int r = 0;

+	context_t con = NULL;

+

+	if (the_authctxt) {

+		if (the_authctxt->role != NULL) {

+			char *slash;

+			role = xstrdup(the_authctxt->role);

+			if ((slash = strchr(role, '/')) != NULL) {

+				*slash = '\0';

+				reqlvl = slash + 1;

+			}

+		}

+	}

-	if (the_authctxt) 

-		role=the_authctxt->role;

 #ifdef HAVE_GETSEUSERBYNAME

 	if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {

 		sename = NULL;

@@ -72,23 +172,49 @@

 	}

 #else

 	sename = pwname;

-	lvl = NULL;

+	lvl = "";

 #endif

 	if (r == 0) {

-#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL

-		if (role != NULL && role[0])

-			r = get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc);

-		else

-			r = get_default_context_with_level(sename, lvl, NULL, &sc);

-#else

-		if (role != NULL && role[0])

-			r = get_default_context_with_role(sename, role, NULL, &sc);

-		else

-			r = get_default_context(sename, NULL, &sc);

-#endif

+		r = get_user_context(sename, role, lvl, &defsc);

 	}

+	if (r == 0) {

+		/* If launched from xinetd, we must use current level */

+		if (inetd_flag && !rexeced_flag) {

+			security_context_t sshdsc=NULL;

+

+			if (getcon(&sshdsc) < 0)

+				fatal("failed to allocate security context");

+

+			if ((con=context_new(sshdsc)) == NULL)

+				fatal("failed to allocate selinux context");

+			reqlvl = context_range_get(con);

+			freecon(sshdsc);

+

+			debug("%s: current connection level '%s'", __func__, reqlvl);

+		}

+		

+		if (reqlvl != NULL && reqlvl[0]) {

+			r = get_user_context(sename, role, reqlvl, &sc);

+		

+			if (r == 0) {

+				if (mls_range_allowed(defsc, sc)) {

+					send_audit_message(1, defsc, sc);

+					logit("permit MLS level %s (user range %s)", reqlvl, lvl);

+				} else {

+					send_audit_message(0, defsc, sc);

+					if (security_getenforce() > 0) 

+						fatal("deny MLS level %s (user range %s)", reqlvl, lvl);

+					else 

+						error("deny MLS level %s (user range %s). Continuing in permissive mode", reqlvl, lvl);

+				}

+			}

+			freecon(defsc);

+		} else {

+			sc = defsc;

+		}

+	}

 	if (r != 0) {

 		switch (security_getenforce()) {

 		case -1:

@@ -110,6 +236,10 @@

 	if (lvl != NULL)

 		xfree(lvl);

 #endif

+	if (role != NULL)

+		xfree(role);

+	if (con)

+		context_free(con);

 	return (sc);

 }

@@ -157,7 +287,10 @@

 	debug3("%s: setting TTY context on %s", __func__, tty);

-	user_ctx = ssh_selinux_getctxbyname(pwname);

+	if (getexeccon(&user_ctx) < 0) {

+		error("%s: getexeccon: %s", __func__, strerror(errno));

+		goto out;

+	}

 	/* XXX: should these calls fatal() upon failure in enforcing mode? */

--- openssh-4.5p1/sshd.c.mls	2007-01-16 21:43:11.000000000 +0100

+++ openssh-4.5p1/sshd.c	2007-01-16 21:48:37.000000000 +0100

@@ -1833,6 +1833,9 @@

 		restore_uid();

 	}

 #endif

+#ifdef WITH_SELINUX

+	ssh_selinux_setup_exec_context(authctxt->pw->pw_name);

+#endif

 #ifdef USE_PAM

 	if (options.use_pam) {

 		do_pam_setcred(1);

--- openssh-4.5p1/misc.c.mls	2006-08-05 04:39:40.000000000 +0200

+++ openssh-4.5p1/misc.c	2007-01-16 21:56:40.000000000 +0100

@@ -418,6 +418,7 @@

 colon(char *cp)

 {

 	int flag = 0;

+	int start = 1;

 	if (*cp == ':')		/* Leading colon is part of file name. */

 		return (0);

@@ -431,8 +432,13 @@

 			return (cp+1);

 		if (*cp == ':' && !flag)

 			return (cp);

-		if (*cp == '/')

-			return (0);

+		if (start) {

+		/* Slash on beginning or after dots only denotes file name. */

+			if (*cp == '/')

+				return (0);

+			if (*cp != '.')

+				start = 0;

+		}

 	}

 	return (0);

 }

--- openssh-4.5p1/session.c.mls	2007-01-16 21:43:11.000000000 +0100

+++ openssh-4.5p1/session.c	2007-01-16 21:46:35.000000000 +0100

@@ -1347,10 +1347,6 @@

 #endif

 	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)

 		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);

-

-#ifdef WITH_SELINUX

-	ssh_selinux_setup_exec_context(pw->pw_name);

-#endif

 }

 static void