Petr Šabata 81d24c
diff --git a/openbsd-compat/port-linux-sshd.c b/openbsd-compat/port-linux-sshd.c
Petr Šabata 81d24c
index 8f32464..18a2ca4 100644
Petr Šabata 81d24c
--- a/openbsd-compat/port-linux-sshd.c
Petr Šabata 81d24c
+++ b/openbsd-compat/port-linux-sshd.c
Petr Šabata 81d24c
@@ -32,6 +32,7 @@
Petr Šabata 81d24c
 #include "misc.h"      /* servconf.h needs misc.h for struct ForwardOptions */
Petr Šabata 81d24c
 #include "servconf.h"
Petr Šabata 81d24c
 #include "port-linux.h"
Petr Šabata 81d24c
+#include "misc.h"
Petr Šabata 81d24c
 #include "sshkey.h"
Petr Šabata 81d24c
 #include "hostfile.h"
Petr Šabata 81d24c
 #include "auth.h"
Petr Šabata 81d24c
@@ -445,7 +446,7 @@ sshd_selinux_setup_exec_context(char *pwname)
Petr Šabata 81d24c
 void
Petr Šabata 81d24c
 sshd_selinux_copy_context(void)
Petr Šabata 81d24c
 {
Petr Šabata 81d24c
-	security_context_t *ctx;
Petr Šabata 81d24c
+	char *ctx;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	if (!sshd_selinux_enabled())
Petr Šabata 81d24c
 		return;
Petr Šabata 81d24c
@@ -461,6 +462,72 @@ sshd_selinux_copy_context(void)
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+void
Petr Šabata 81d24c
+sshd_selinux_change_privsep_preauth_context(void)
Petr Šabata 81d24c
+{
Petr Šabata 81d24c
+	int len;
Petr Šabata 81d24c
+	char line[1024], *preauth_context = NULL, *cp, *arg;
Petr Šabata 81d24c
+	const char *contexts_path;
Petr Šabata 81d24c
+	FILE *contexts_file;
Petr Šabata 81d24c
+	struct stat sb;
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	contexts_path = selinux_openssh_contexts_path();
Petr Šabata 81d24c
+	if (contexts_path == NULL) {
DistroBaker d029bb
+		debug3_f("Failed to get the path to SELinux context");
Petr Šabata 81d24c
+		return;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if ((contexts_file = fopen(contexts_path, "r")) == NULL) {
DistroBaker d029bb
+		debug_f("Failed to open SELinux context file");
Petr Šabata 81d24c
+		return;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if (fstat(fileno(contexts_file), &sb) != 0 ||
Petr Šabata 81d24c
+	    sb.st_uid != 0 || (sb.st_mode & 022) != 0) {
DistroBaker d029bb
+		logit_f("SELinux context file needs to be owned by root"
DistroBaker d029bb
+		    " and not writable by anyone else");
Petr Šabata 81d24c
+		fclose(contexts_file);
Petr Šabata 81d24c
+		return;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	while (fgets(line, sizeof(line), contexts_file)) {
Petr Šabata 81d24c
+		/* Strip trailing whitespace */
Petr Šabata 81d24c
+		for (len = strlen(line) - 1; len > 0; len--) {
Petr Šabata 81d24c
+			if (strchr(" \t\r\n", line[len]) == NULL)
Petr Šabata 81d24c
+				break;
Petr Šabata 81d24c
+			line[len] = '\0';
Petr Šabata 81d24c
+		}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+		if (line[0] == '\0')
Petr Šabata 81d24c
+			continue;
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+		cp = line;
Petr Šabata 81d24c
+		arg = strdelim(&cp;;
Petr Šabata 81d24c
+		if (arg && *arg == '\0')
Petr Šabata 81d24c
+			arg = strdelim(&cp;;
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+		if (arg && strcmp(arg, "privsep_preauth") == 0) {
Petr Šabata 81d24c
+			arg = strdelim(&cp;;
Petr Šabata 81d24c
+			if (!arg || *arg == '\0') {
DistroBaker d029bb
+				debug_f("privsep_preauth is empty");
Petr Šabata 81d24c
+				fclose(contexts_file);
Petr Šabata 81d24c
+				return;
Petr Šabata 81d24c
+			}
Petr Šabata 81d24c
+			preauth_context = xstrdup(arg);
Petr Šabata 81d24c
+		}
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+	fclose(contexts_file);
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if (preauth_context == NULL) {
DistroBaker d029bb
+		debug_f("Unable to find 'privsep_preauth' option in"
DistroBaker d029bb
+		    " SELinux context file");
Petr Šabata 81d24c
+		return;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	ssh_selinux_change_context(preauth_context);
Petr Šabata 81d24c
+	free(preauth_context);
Petr Šabata 81d24c
+}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 #endif
Petr Šabata 81d24c
 #endif
Petr Šabata 81d24c
 
Petr Šabata 81d24c
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
Petr Šabata 81d24c
index 22ea8ef..1fc963d 100644
Petr Šabata 81d24c
--- a/openbsd-compat/port-linux.c
Petr Šabata 81d24c
+++ b/openbsd-compat/port-linux.c
Petr Šabata 81d24c
@@ -179,7 +179,7 @@ ssh_selinux_change_context(const char *newname)
Petr Šabata 81d24c
 	strlcpy(newctx + len, newname, newlen - len);
Petr Šabata 81d24c
 	if ((cx = index(cx + 1, ':')))
Petr Šabata 81d24c
 		strlcat(newctx, cx, newlen);
Petr Šabata 81d24c
-	debug3("%s: setting context from '%s' to '%s'", __func__,
DistroBaker d029bb
+	debug_f("setting context from '%s' to '%s'",
Petr Šabata 81d24c
 	    oldctx, newctx);
Petr Šabata 81d24c
 	if (setcon(newctx) < 0)
DistroBaker d029bb
 		do_log2(log_level, "%s: setcon %s from %s failed with %s",
DistroBaker d029bb
		    __func__, newctx, oldctx, strerror(errno));
Petr Šabata 81d24c
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
Petr Šabata 81d24c
index cb51f99..8b7cda2 100644
Petr Šabata 81d24c
--- a/openbsd-compat/port-linux.h
Petr Šabata 81d24c
+++ b/openbsd-compat/port-linux.h
Petr Šabata 81d24c
@@ -29,6 +29,7 @@ int sshd_selinux_enabled(void);
Petr Šabata 81d24c
 void sshd_selinux_copy_context(void);
Petr Šabata 81d24c
 void sshd_selinux_setup_exec_context(char *);
Petr Šabata 81d24c
 int sshd_selinux_setup_env_variables(void);
Petr Šabata 81d24c
+void sshd_selinux_change_privsep_preauth_context(void);
Petr Šabata 81d24c
 #endif
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 #ifdef LINUX_OOM_ADJUST
Petr Šabata 81d24c
diff --git a/sshd.c b/sshd.c
Petr Šabata 81d24c
index 2871fe9..39b9c08 100644
Petr Šabata 81d24c
--- a/sshd.c
Petr Šabata 81d24c
+++ b/sshd.c
Petr Šabata 81d24c
@@ -629,7 +629,7 @@ privsep_preauth_child(void)
Petr Šabata 81d24c
 	demote_sensitive_data();
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 #ifdef WITH_SELINUX
Petr Šabata 81d24c
-	ssh_selinux_change_context("sshd_net_t");
Petr Šabata 81d24c
+	sshd_selinux_change_privsep_preauth_context();
Petr Šabata 81d24c
 #endif
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* Demote the child */