diff -up openssh-5.8p1/auth2-pubkey.c.keycat2 openssh-5.8p1/auth2-pubkey.c

--- openssh-5.8p1/auth2-pubkey.c.keycat2	2011-03-01 06:57:03.000000000 +0100

+++ openssh-5.8p1/auth2-pubkey.c	2011-03-01 07:25:04.000000000 +0100

@@ -579,6 +579,14 @@ user_key_via_command_allowed2(struct pas

 			close(i);

 		}

+#ifdef WITH_SELINUX

+		if (ssh_selinux_setup_env_variables() < 0) {

+			error ("failed to copy environment:  %s",

+			    strerror(errno));

+			_exit(127);

+		}

+#endif

+

 		execl(options.authorized_keys_command, options.authorized_keys_command, pw->pw_name, NULL);

 		/* if we got here, it didn't work */

diff -up openssh-5.8p1/openbsd-compat/port-linux.c.keycat2 openssh-5.8p1/openbsd-compat/port-linux.c

--- openssh-5.8p1/openbsd-compat/port-linux.c.keycat2	2011-03-01 07:00:32.000000000 +0100

+++ openssh-5.8p1/openbsd-compat/port-linux.c	2011-03-01 07:23:13.000000000 +0100

@@ -309,7 +309,7 @@ ssh_selinux_getctxbyname(char *pwname,

 /* Setup environment variables for pam_selinux */

 static int

-ssh_selinux_setup_pam_variables(void)

+ssh_selinux_setup_variables(int(*set_it)(const char *, const char *))

 {

 	const char *reqlvl;

 	char *role;

@@ -320,16 +320,16 @@ ssh_selinux_setup_pam_variables(void)

 	ssh_selinux_get_role_level(&role, &reqlvl);

-	rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");

+	rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : "");

 	if (inetd_flag && !rexeced_flag) {

 		use_current = "1";

 	} else {

 		use_current = "";

-		rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");

+		rv = rv || set_it("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");

 	}

-	rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);

+	rv = rv || set_it("SELINUX_USE_CURRENT_RANGE", use_current);

 	if (role != NULL)

 		xfree(role);

@@ -337,6 +337,24 @@ ssh_selinux_setup_pam_variables(void)

 	return rv;

 }

+static int

+ssh_selinux_setup_pam_variables(void)

+{

+	return ssh_selinux_setup_variables(do_pam_putenv);

+}

+

+static int

+do_setenv(char *name, char *value)

+{

+	return setenv(name, value, 1);

+}

+

+int

+ssh_selinux_setup_env_variables(void)

+{

+	return ssh_selinux_setup_variables(do_setenv);

+}

+

 /* Set the execution context to the default for the specified user */

 void

 ssh_selinux_setup_exec_context(char *pwname)

diff -up openssh-5.8p1/ssh-keycat.c.keycat2 openssh-5.8p1/ssh-keycat.c

--- openssh-5.8p1/ssh-keycat.c.keycat2	2011-03-01 06:56:02.000000000 +0100

+++ openssh-5.8p1/ssh-keycat.c	2011-03-01 06:56:02.000000000 +0100

@@ -65,6 +65,7 @@

 #define ERR_FDOPEN 10

 #define ERR_STAT 11

 #define ERR_WRITE 12

+#define ERR_PAM_PUTENV 13

 #define BUFLEN 4096

 /* Just ignore the messages in the conversation function */

@@ -166,6 +167,34 @@ fail:

 	return rv;

 }

+static const char *env_names[] = { "SELINUX_ROLE_REQUESTED",

+	"SELINUX_LEVEL_REQUESTED",

+	"SELINUX_USE_CURRENT_RANGE"

+};

+

+extern char **environ;

+

+int

+set_pam_environment(pam_handle_t *pamh)

+{

+	int i;

+	size_t j;

+

+	for (j = 0; j < sizeof(env_names)/sizeof(env_names[0]); ++j) {

+		int len = strlen(env_names[j]);

+

+		for (i = 0; environ[i] != NULL; ++i) {

+			if (strncmp(env_names[j], environ[i], len) == 0 &&

+			    environ[i][len] == '=') {

+				if (pam_putenv(pamh, environ[i]) != PAM_SUCCESS)

+					return ERR_PAM_PUTENV;

+			}

+		}

+	}

+

+	return 0;

+}

+

 int

 main(int argc, char *argv[])

 {

@@ -183,6 +212,10 @@ main(int argc, char *argv[])

 		return ERR_PAM_START;

 	}

+	ev = set_pam_environment(pamh);

+	if (ev != 0)

+		goto finish;

+

 	retval = pam_open_session(pamh, PAM_SILENT);

 	if (retval != PAM_SUCCESS) {

 		ev = ERR_OPEN_SESSION;