diff -up openssh-5.2p1/contrib/ssh-copy-id.selabel openssh-5.2p1/contrib/ssh-copy-id

--- openssh-5.2p1/contrib/ssh-copy-id.selabel	2009-01-21 10:29:21.000000000 +0100

+++ openssh-5.2p1/contrib/ssh-copy-id	2009-07-08 14:28:27.000000000 +0200

@@ -38,7 +38,7 @@ if [ "$#" -lt 1 ] || [ "$1" = "-h" ] || 

   exit 1

 fi

-{ eval "$GET_ID" ; } | ssh $1 "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys" || exit 1

+{ eval "$GET_ID" ; } | ssh $1 "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys; test -x /sbin/restorecon && /sbin/restorecon .ssh .ssh/authorized_keys" || exit 1

 cat <

 Now try logging into the machine, with "ssh '$1'", and check in:

diff -up openssh-5.2p1/Makefile.in.selabel openssh-5.2p1/Makefile.in

--- openssh-5.2p1/Makefile.in.selabel	2009-07-08 14:28:25.000000000 +0200

+++ openssh-5.2p1/Makefile.in	2009-07-08 14:28:27.000000000 +0200

@@ -134,7 +134,7 @@ libssh.a: $(LIBSSH_OBJS)

 	$(RANLIB) $@

 ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)

-	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)

+	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck -lselinux $(LIBS)

 sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)

 	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) -lfipscheck $(LIBS)

diff -up openssh-5.2p1/ssh.c.selabel openssh-5.2p1/ssh.c

--- openssh-5.2p1/ssh.c.selabel	2009-07-08 14:28:27.000000000 +0200

+++ openssh-5.2p1/ssh.c	2009-07-08 14:34:00.000000000 +0200

@@ -74,6 +74,7 @@

 #include <openssl/err.h>

 #include <openssl/fips.h>

 #include <fipscheck.h>

+#include <selinux/selinux.h>

 #include "openbsd-compat/openssl-compat.h"

 #include "openbsd-compat/sys-queue.h"

@@ -791,10 +792,15 @@ main(int ac, char **av)

 	 */

 	r = snprintf(buf, sizeof buf, "%s%s%s", pw->pw_dir,

 	    strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);

-	if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0)

+	if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0) {

+		char *scon;

+

+		matchpathcon(buf, 0700, &scon);

+		setfscreatecon(scon);

 		if (mkdir(buf, 0700) < 0)

 			error("Could not create directory '%.200s'.", buf);

-

+		setfscreatecon(NULL);

+	}

 	/* load options.identity_files */

 	load_public_identity_files();