rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity

- fix some forward porting typos

Browse Source
This commit is contained in:
Tomáš Mráz 2007-01-16 21:20:04 +00:00
parent c2b35d09c0
commit 73a8557dfd
2 changed files with 17 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
openssh-4.5p1-mls.patch
View File

@ -1,5 +1,5 @@
--- openssh-4.5p1/openbsd-compat/port-linux.c.mls 2007-01-16 21:43:11.000000000 +0100 --- openssh-4.5p1/openbsd-compat/port-linux.c.mls 2007-01-16 22:08:06.000000000 +0100
+++ openssh-4.5p1/openbsd-compat/port-linux.c 2007-01-16 21:40:13.000000000 +0100 +++ openssh-4.5p1/openbsd-compat/port-linux.c 2007-01-16 22:11:05.000000000 +0100
@@ -33,12 +33,22 @@ @@ -33,12 +33,22 @@
#include "key.h" #include "key.h"
#include "hostfile.h" #include "hostfile.h"
@ -14,7 +14,7 @@
+ +
+#ifdef HAVE_LINUX_AUDIT +#ifdef HAVE_LINUX_AUDIT
+#include <libaudit.h> +#include <libaudit.h>
+#include <sys/select.h> +#include <unistd.h>
+#endif +#endif
extern Authctxt *the_authctxt; extern Authctxt *the_authctxt;
@ -94,14 +94,14 @@
+ security_context_t *sc) { + security_context_t *sc) {
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
+ if (role != NULL && role[0]) + if (role != NULL && role[0])
+ return get_default_context_with_rolelevel(sename, role, lvl, NULL, &sc); + return get_default_context_with_rolelevel(sename, role, lvl, NULL, sc);
+ else + else
+ return get_default_context_with_level(sename, lvl, NULL, &sc); + return get_default_context_with_level(sename, lvl, NULL, sc);
+#else +#else
+ if (role != NULL && role[0]) + if (role != NULL && role[0])
+ return get_default_context_with_role(sename, role, NULL, &sc); + return get_default_context_with_role(sename, role, NULL, sc);
+ else + else
+ return get_default_context(sename, NULL, &sc); + return get_default_context(sename, NULL, sc);
+#endif +#endif
+} +}
+ +
@ -109,11 +109,10 @@
static security_context_t static security_context_t
ssh_selinux_getctxbyname(char *pwname) ssh_selinux_getctxbyname(char *pwname)
{ {
- security_context_t sc = NULL; security_context_t sc = NULL;
+ security_context_t usersc = NULL;
+ security_context_t defsc = NULL; + security_context_t defsc = NULL;
char *sename, *lvl; char *sename, *lvl;
+ const char *reqlvl; + const char *reqlvl = NULL;
char *role = NULL; char *role = NULL;
int r = 0; int r = 0;
+ context_t con = NULL; + context_t con = NULL;
@ -132,7 +131,7 @@
- if (the_authctxt) - if (the_authctxt)
- role=the_authctxt->role; - role=the_authctxt->role;
#ifdef HAVE_GETSEUSERBYNAME #ifdef HAVE_GETSEUSERBYNAME
if (r=getseuserbyname(pwname, &sename, &lvl) != 0) { if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
sename = NULL; sename = NULL;
@@ -72,23 +172,49 @@ @@ -72,23 +172,49 @@
} }
@ -174,14 +173,14 @@
+ } + }
+ +
+ if (reqlvl != NULL && reqlvl[0]) { + if (reqlvl != NULL && reqlvl[0]) {
+ r = get_user_context(sename, role, reqlvl, &usersc); + r = get_user_context(sename, role, reqlvl, &sc);
+ +
+ if (r == 0) { + if (r == 0) {
+ if (mls_range_allowed(defsc, usersc)) { + if (mls_range_allowed(defsc, sc)) {
+ send_audit_message(1, defsc, usersc); + send_audit_message(1, defsc, sc);
+ logit("permit MLS level %s (user range %s)", reqlvl, lvl); + logit("permit MLS level %s (user range %s)", reqlvl, lvl);
+ } else { + } else {
+ send_audit_message(0, defsc, usersc); + send_audit_message(0, defsc, sc);
+ if (security_getenforce() > 0) + if (security_getenforce() > 0)
+ fatal("deny MLS level %s (user range %s)", reqlvl, lvl); + fatal("deny MLS level %s (user range %s)", reqlvl, lvl);
+ else + else
@ -190,7 +189,7 @@
+ } + }
+ freecon(defsc); + freecon(defsc);
+ } else { + } else {
+ usersc = defsc; + sc = defsc;
+ } + }
+ } + }
if (r != 0) { if (r != 0) {
@ -212,7 +211,7 @@
debug3("%s: setting TTY context on %s", __func__, tty); debug3("%s: setting TTY context on %s", __func__, tty);
- user_ctx = ssh_selinux_getctxbyname(pwname); - user_ctx = ssh_selinux_getctxbyname(pwname);
+ if (getexeccon(&user_context) < 0) { + if (getexeccon(&user_ctx) < 0) {
+ error("%s: getexeccon: %s", __func__, strerror(errno)); + error("%s: getexeccon: %s", __func__, strerror(errno));
+ goto out; + goto out;
+ } + }

2
openssh-4.5p1-selinux.patch
View File

@ -125,7 +125,7 @@
#ifdef HAVE_GETSEUSERBYNAME #ifdef HAVE_GETSEUSERBYNAME
- if (getseuserbyname(pwname, &sename, &lvl) != 0) - if (getseuserbyname(pwname, &sename, &lvl) != 0)
- return NULL; - return NULL;
+ if (r=getseuserbyname(pwname, &sename, &lvl) != 0) { + if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) {
+ sename = NULL; + sename = NULL;
+ lvl = NULL; + lvl = NULL;
+ } + }