diff -up openssh-5.2p1/auth1.c.selinux openssh-5.2p1/auth1.c --- openssh-5.2p1/auth1.c.selinux 2009-03-10 03:51:54.813223420 +0100 +++ openssh-5.2p1/auth1.c 2009-03-10 03:51:55.045214236 +0100 @@ -391,7 +391,7 @@ void do_authentication(Authctxt *authctxt) { u_int ulen; - char *user, *style = NULL; + char *user, *style = NULL, *role=NULL; /* Get the name of the user that we wish to log in as. */ packet_read_expect(SSH_CMSG_USER); @@ -400,11 +400,19 @@ do_authentication(Authctxt *authctxt) user = packet_get_string(&ulen); packet_check_eom(); + if ((role = strchr(user, '/')) != NULL) + *role++ = '\0'; + if ((style = strchr(user, ':')) != NULL) *style++ = '\0'; + else + if (role && (style = strchr(role, ':')) != NULL) + *style++ = '\0'; + authctxt->user = user; authctxt->style = style; + authctxt->role = role; /* Verify that the user is a valid user. */ if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) diff -up openssh-5.2p1/auth2.c.selinux openssh-5.2p1/auth2.c --- openssh-5.2p1/auth2.c.selinux 2008-11-05 06:20:46.000000000 +0100 +++ openssh-5.2p1/auth2.c 2009-03-10 03:51:55.071216534 +0100 @@ -215,7 +215,7 @@ input_userauth_request(int type, u_int32 { Authctxt *authctxt = ctxt; Authmethod *m = NULL; - char *user, *service, *method, *style = NULL; + char *user, *service, *method, *style = NULL, *role = NULL; int authenticated = 0; if (authctxt == NULL) @@ -227,6 +227,9 @@ input_userauth_request(int type, u_int32 debug("userauth-request for user %s service %s method %s", user, service, method); debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); + if ((role = strchr(user, '/')) != NULL) + *role++ = 0; + if ((style = strchr(user, ':')) != NULL) *style++ = 0; @@ -252,8 +255,11 @@ input_userauth_request(int type, u_int32 use_privsep ? " [net]" : ""); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; - if (use_privsep) + authctxt->role = role ? xstrdup(role) : NULL; + if (use_privsep) { mm_inform_authserv(service, style); + mm_inform_authrole(role); + } userauth_banner(); } else if (strcmp(user, authctxt->user) != 0 || strcmp(service, authctxt->service) != 0) { diff -up openssh-5.2p1/auth2-hostbased.c.selinux openssh-5.2p1/auth2-hostbased.c --- openssh-5.2p1/auth2-hostbased.c.selinux 2008-07-17 10:57:19.000000000 +0200 +++ openssh-5.2p1/auth2-hostbased.c 2009-03-10 03:51:55.052265447 +0100 @@ -106,7 +106,14 @@ userauth_hostbased(Authctxt *authctxt) buffer_put_string(&b, session_id2, session_id2_len); /* reconstruct packet */ buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); - buffer_put_cstring(&b, authctxt->user); + if (authctxt->role) { + buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); + buffer_append(&b, authctxt->user, strlen(authctxt->user)); + buffer_put_char(&b, '/'); + buffer_append(&b, authctxt->role, strlen(authctxt->role)); + } else { + buffer_put_cstring(&b, authctxt->user); + } buffer_put_cstring(&b, service); buffer_put_cstring(&b, "hostbased"); buffer_put_string(&b, pkalg, alen); diff -up openssh-5.2p1/auth2-pubkey.c.selinux openssh-5.2p1/auth2-pubkey.c --- openssh-5.2p1/auth2-pubkey.c.selinux 2008-07-04 04:54:25.000000000 +0200 +++ openssh-5.2p1/auth2-pubkey.c 2009-03-10 03:51:56.174214480 +0100 @@ -33,6 +33,7 @@ #include #include #include +#include #include "xmalloc.h" #include "ssh.h" @@ -117,7 +118,14 @@ userauth_pubkey(Authctxt *authctxt) } /* reconstruct packet */ buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); - buffer_put_cstring(&b, authctxt->user); + if (authctxt->role) { + buffer_put_int(&b, strlen(authctxt->user)+strlen(authctxt->role)+1); + buffer_append(&b, authctxt->user, strlen(authctxt->user)); + buffer_put_char(&b, '/'); + buffer_append(&b, authctxt->role, strlen(authctxt->role)); + } else { + buffer_put_cstring(&b, authctxt->user); + } buffer_put_cstring(&b, datafellows & SSH_BUG_PKSERVICE ? "ssh-userauth" : @@ -236,7 +244,7 @@ user_key_allowed2(struct passwd *pw, Key found_key = 1; debug("matching key found: file %s, line %lu", file, linenum); - fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); + fp = key_fingerprint(found, FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5, SSH_FP_HEX); verbose("Found matching %s key: %s", key_type(found), fp); xfree(fp); diff -up openssh-5.2p1/auth.h.selinux openssh-5.2p1/auth.h --- openssh-5.2p1/auth.h.selinux 2008-11-05 06:20:46.000000000 +0100 +++ openssh-5.2p1/auth.h 2009-03-10 03:51:55.069276014 +0100 @@ -58,6 +58,7 @@ struct Authctxt { char *service; struct passwd *pw; /* set if 'valid' */ char *style; + char *role; void *kbdintctxt; void *jpake_ctx; #ifdef BSD_AUTH diff -up openssh-5.2p1/configure.ac.selinux openssh-5.2p1/configure.ac --- openssh-5.2p1/configure.ac.selinux 2009-03-10 03:51:54.901396765 +0100 +++ openssh-5.2p1/configure.ac 2009-03-10 03:51:55.850215090 +0100 @@ -3335,11 +3335,25 @@ AC_ARG_WITH(selinux, AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ], AC_MSG_ERROR(SELinux support requires libselinux library)) SSHDLIBS="$SSHDLIBS $LIBSELINUX" + LIBS="$LIBS $LIBSELINUX" AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level) + AC_CHECK_FUNCS(setkeycreatecon) LIBS="$save_LIBS" fi ] ) +# Check whether user wants Linux audit support +LINUX_AUDIT_MSG="no" +AC_ARG_WITH(linux-audit, + [ --with-linux-audit Enable Linux audit support], + [ if test "x$withval" != "xno" ; then + AC_DEFINE(HAVE_LINUX_AUDIT,1,[Define if you want Linux audit support.]) + LINUX_AUDIT_MSG="yes" + AC_CHECK_HEADERS(libaudit.h) + SSHDLIBS="$SSHDLIBS -laudit" + fi ] +) + # Check whether user wants Kerberos 5 support KRB5_MSG="no" AC_ARG_WITH(kerberos5, @@ -3448,6 +3462,20 @@ AC_ARG_WITH(kerberos5, ] ) +# Check whether user wants NSS support +LIBNSS_MSG="no" +AC_ARG_WITH(nss, + [ --with-nss Enable NSS support], + [ if test "x$withval" != "xno" ; then + AC_DEFINE(HAVE_LIBNSS,1,[Define if you want NSS support.]) + LIBNSS_MSG="yes" + CPPFLAGS="$CPPFLAGS -I/usr/include/nss3 -I/usr/include/nspr4" + AC_CHECK_HEADERS(pk11pub.h) + LIBS="$LIBS -lnss3" + fi + ]) +AC_SUBST(LIBNSS) + # Looking for programs, paths and files PRIVSEP_PATH=/var/empty @@ -4168,12 +4196,14 @@ echo " PAM support echo " OSF SIA support: $SIA_MSG" echo " KerberosV support: $KRB5_MSG" echo " SELinux support: $SELINUX_MSG" +echo " Linux audit support: $LINUX_AUDIT_MSG" echo " Smartcard support: $SCARD_MSG" echo " S/KEY support: $SKEY_MSG" echo " TCP Wrappers support: $TCPW_MSG" echo " MD5 password support: $MD5_MSG" echo " libedit support: $LIBEDIT_MSG" echo " Solaris process contract support: $SPC_MSG" +echo " NSS support: $LIBNSS_MSG" echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" echo " BSD Auth support: $BSD_AUTH_MSG" diff -up openssh-5.2p1/monitor.c.selinux openssh-5.2p1/monitor.c --- openssh-5.2p1/monitor.c.selinux 2009-02-14 06:33:31.000000000 +0100 +++ openssh-5.2p1/monitor.c 2009-03-10 03:51:55.099559692 +0100 @@ -135,6 +135,7 @@ int mm_answer_sign(int, Buffer *); int mm_answer_pwnamallow(int, Buffer *); int mm_answer_auth2_read_banner(int, Buffer *); int mm_answer_authserv(int, Buffer *); +int mm_answer_authrole(int, Buffer *); int mm_answer_authpassword(int, Buffer *); int mm_answer_bsdauthquery(int, Buffer *); int mm_answer_bsdauthrespond(int, Buffer *); @@ -211,6 +212,7 @@ struct mon_table mon_dispatch_proto20[] {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, + {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, #ifdef USE_PAM @@ -680,6 +682,7 @@ mm_answer_pwnamallow(int sock, Buffer *m else { /* Allow service/style information on the auth context */ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); + monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); } @@ -725,6 +728,23 @@ mm_answer_authserv(int sock, Buffer *m) } int +mm_answer_authrole(int sock, Buffer *m) +{ + monitor_permit_authentications(1); + + authctxt->role = buffer_get_string(m, NULL); + debug3("%s: role=%s", + __func__, authctxt->role); + + if (strlen(authctxt->role) == 0) { + xfree(authctxt->role); + authctxt->role = NULL; + } + + return (0); +} + +int mm_answer_authpassword(int sock, Buffer *m) { static int call_count; @@ -1102,7 +1122,7 @@ static int monitor_valid_userblob(u_char *data, u_int datalen) { Buffer b; - char *p; + char *p, *r; u_int len; int fail = 0; @@ -1128,6 +1148,8 @@ monitor_valid_userblob(u_char *data, u_i if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) fail++; p = buffer_get_string(&b, NULL); + if ((r = strchr(p, '/')) != NULL) + *r = '\0'; if (strcmp(authctxt->user, p) != 0) { logit("wrong user name passed to monitor: expected %s != %.100s", authctxt->user, p); @@ -1159,7 +1181,7 @@ monitor_valid_hostbasedblob(u_char *data char *chost) { Buffer b; - char *p; + char *p, *r; u_int len; int fail = 0; @@ -1176,6 +1198,8 @@ monitor_valid_hostbasedblob(u_char *data if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) fail++; p = buffer_get_string(&b, NULL); + if ((r = strchr(p, '/')) != NULL) + *r = '\0'; if (strcmp(authctxt->user, p) != 0) { logit("wrong user name passed to monitor: expected %s != %.100s", authctxt->user, p); diff -up openssh-5.2p1/monitor.h.selinux openssh-5.2p1/monitor.h --- openssh-5.2p1/monitor.h.selinux 2008-11-05 06:20:46.000000000 +0100 +++ openssh-5.2p1/monitor.h 2009-03-10 03:51:55.050519421 +0100 @@ -30,7 +30,7 @@ enum monitor_reqtype { MONITOR_REQ_MODULI, MONITOR_ANS_MODULI, - MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, + MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,MONITOR_REQ_AUTHROLE, MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, diff -up openssh-5.2p1/monitor_wrap.c.selinux openssh-5.2p1/monitor_wrap.c --- openssh-5.2p1/monitor_wrap.c.selinux 2008-11-05 06:20:47.000000000 +0100 +++ openssh-5.2p1/monitor_wrap.c 2009-03-10 03:51:55.066210099 +0100 @@ -297,6 +297,23 @@ mm_inform_authserv(char *service, char * buffer_free(&m); } +/* Inform the privileged process about role */ + +void +mm_inform_authrole(char *role) +{ + Buffer m; + + debug3("%s entering", __func__); + + buffer_init(&m); + buffer_put_cstring(&m, role ? role : ""); + + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, &m); + + buffer_free(&m); +} + /* Do the password authentication */ int mm_auth_password(Authctxt *authctxt, char *password) diff -up openssh-5.2p1/monitor_wrap.h.selinux openssh-5.2p1/monitor_wrap.h --- openssh-5.2p1/monitor_wrap.h.selinux 2008-11-05 06:20:47.000000000 +0100 +++ openssh-5.2p1/monitor_wrap.h 2009-03-10 03:51:55.048731957 +0100 @@ -41,6 +41,7 @@ int mm_is_monitor(void); DH *mm_choose_dh(int, int, int); int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); void mm_inform_authserv(char *, char *); +void mm_inform_authrole(char *); struct passwd *mm_getpwnamallow(const char *); char *mm_auth2_read_banner(void); int mm_auth_password(struct Authctxt *, char *); diff -up openssh-5.2p1/openbsd-compat/port-linux.c.selinux openssh-5.2p1/openbsd-compat/port-linux.c --- openssh-5.2p1/openbsd-compat/port-linux.c.selinux 2008-03-26 21:27:21.000000000 +0100 +++ openssh-5.2p1/openbsd-compat/port-linux.c 2009-03-10 03:51:55.407292576 +0100 @@ -30,10 +30,28 @@ #ifdef WITH_SELINUX #include "log.h" #include "port-linux.h" +#include "key.h" +#include "hostfile.h" +#include "auth.h" +#include "xmalloc.h" +#include "servconf.h" #include #include +#include #include +#include +#include + +#ifdef HAVE_LINUX_AUDIT +#include +#include +#endif + +extern ServerOptions options; +extern Authctxt *the_authctxt; +extern int inetd_flag; +extern int rexeced_flag; /* Wrapper around is_selinux_enabled() to log its return value once only */ int @@ -49,42 +67,245 @@ ssh_selinux_enabled(void) return (enabled); } +/* Send audit message */ +static int +send_audit_message(int success, security_context_t default_context, + security_context_t selected_context) +{ + int rc=0; +#ifdef HAVE_LINUX_AUDIT + char *msg = NULL; + int audit_fd = audit_open(); + security_context_t default_raw=NULL; + security_context_t selected_raw=NULL; + rc = -1; + if (audit_fd < 0) { + if (errno == EINVAL || errno == EPROTONOSUPPORT || + errno == EAFNOSUPPORT) + return 0; /* No audit support in kernel */ + error("Error connecting to audit system."); + return rc; + } + if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) { + error("Error translating default context."); + default_raw = NULL; + } + if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) { + error("Error translating selected context."); + selected_raw = NULL; + } + if (asprintf(&msg, "sshd: default-context=%s selected-context=%s", + default_raw ? default_raw : (default_context ? default_context: "?"), + selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) { + error("Error allocating memory."); + goto out; + } + if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, + msg, NULL, NULL, NULL, success) <= 0) { + error("Error sending audit message."); + goto out; + } + rc = 0; + out: + free(msg); + freecon(default_raw); + freecon(selected_raw); + close(audit_fd); +#endif + return rc; +} + +static int +mls_range_allowed(security_context_t src, security_context_t dst) +{ + struct av_decision avd; + int retval; + unsigned int bit = CONTEXT__CONTAINS; + + debug("%s: src:%s dst:%s", __func__, src, dst); + retval = security_compute_av(src, dst, SECCLASS_CONTEXT, bit, &avd); + if (retval || ((bit & avd.allowed) != bit)) + return 0; + + return 1; +} + +static int +get_user_context(const char *sename, const char *role, const char *lvl, + security_context_t *sc) { +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) { + /* User may have requested a level completely outside of his + allowed range. We get a context just for auditing as the + range check below will certainly fail for default context. */ +#endif + if (get_default_context(sename, NULL, sc) != 0) { + *sc = NULL; + return -1; + } +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + } +#endif + if (role != NULL && role[0]) { + context_t con; + char *type=NULL; + if (get_default_type(role, &type) != 0) { + error("get_default_type: failed to get default type for '%s'", + role); + goto out; + } + con = context_new(*sc); + if (!con) { + goto out; + } + context_role_set(con, role); + context_type_set(con, type); + freecon(*sc); + *sc = strdup(context_str(con)); + context_free(con); + if (!*sc) + return -1; + } +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + if (lvl != NULL && lvl[0]) { + /* verify that the requested range is obtained */ + context_t con; + security_context_t obtained_raw; + security_context_t requested_raw; + con = context_new(*sc); + if (!con) { + goto out; + } + context_range_set(con, lvl); + if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) { + context_free(con); + goto out; + } + if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) { + freecon(obtained_raw); + context_free(con); + goto out; + } + + debug("get_user_context: obtained context '%s' requested context '%s'", + obtained_raw, requested_raw); + if (strcmp(obtained_raw, requested_raw)) { + /* set the context to the real requested one but fail */ + freecon(requested_raw); + freecon(obtained_raw); + freecon(*sc); + *sc = strdup(context_str(con)); + context_free(con); + return -1; + } + freecon(requested_raw); + freecon(obtained_raw); + context_free(con); + } +#endif + return 0; + out: + freecon(*sc); + *sc = NULL; + return -1; +} + +static void +ssh_selinux_get_role_level(char **role, const char **level) +{ + *role = NULL; + *level = NULL; + if (the_authctxt) { + if (the_authctxt->role != NULL) { + char *slash; + *role = xstrdup(the_authctxt->role); + if ((slash = strchr(*role, '/')) != NULL) { + *slash = '\0'; + *level = slash + 1; + } + } + } +} + /* Return the default security context for the given username */ -static security_context_t -ssh_selinux_getctxbyname(char *pwname) +static int +ssh_selinux_getctxbyname(char *pwname, + security_context_t *default_sc, security_context_t *user_sc) { - security_context_t sc; - char *sename = NULL, *lvl = NULL; - int r; + char *sename, *lvl; + const char *reqlvl; + char *role; + int r = -1; + context_t con = NULL; + + *default_sc = NULL; + *user_sc = NULL; + + ssh_selinux_get_role_level(&role, &reqlvl); #ifdef HAVE_GETSEUSERBYNAME - if (getseuserbyname(pwname, &sename, &lvl) != 0) - return NULL; + if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) { + sename = NULL; + lvl = NULL; + } #else sename = pwname; - lvl = NULL; + lvl = ""; #endif + if (r == 0) { #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL - r = get_default_context_with_level(sename, lvl, NULL, &sc); + r = get_default_context_with_level(sename, lvl, NULL, default_sc); #else - r = get_default_context(sename, NULL, &sc); + r = get_default_context(sename, NULL, default_sc); #endif + } - if (r != 0) { - switch (security_getenforce()) { - case -1: - fatal("%s: ssh_selinux_getctxbyname: " - "security_getenforce() failed", __func__); - case 0: - error("%s: Failed to get default SELinux security " - "context for %s", __func__, pwname); - break; - default: - fatal("%s: Failed to get default SELinux security " - "context for %s (in enforcing mode)", - __func__, pwname); + if (r == 0) { + /* If launched from xinetd, we must use current level */ + if (inetd_flag && !rexeced_flag) { + security_context_t sshdsc=NULL; + + if (getcon_raw(&sshdsc) < 0) + fatal("failed to allocate security context"); + + if ((con=context_new(sshdsc)) == NULL) + fatal("failed to allocate selinux context"); + reqlvl = context_range_get(con); + freecon(sshdsc); + if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0) + /* we actually don't change level */ + reqlvl = ""; + + debug("%s: current connection level '%s'", __func__, reqlvl); } + + if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) { + r = get_user_context(sename, role, reqlvl, user_sc); + + if (r == 0 && reqlvl != NULL && reqlvl[0]) { + security_context_t default_level_sc = *default_sc; + if (role != NULL && role[0]) { + if (get_user_context(sename, role, lvl, &default_level_sc) < 0) + default_level_sc = *default_sc; + } + /* verify that the requested range is contained in the user range */ + if (mls_range_allowed(default_level_sc, *user_sc)) { + logit("permit MLS level %s (user range %s)", reqlvl, lvl); + } else { + r = -1; + error("deny MLS level %s (user range %s)", reqlvl, lvl); + } + if (default_level_sc != *default_sc) + freecon(default_level_sc); + } + } else { + *user_sc = *default_sc; + } + } + if (r != 0) { + error("%s: Failed to get default SELinux security " + "context for %s", __func__, pwname); } #ifdef HAVE_GETSEUSERBYNAME @@ -93,37 +314,114 @@ ssh_selinux_getctxbyname(char *pwname) if (lvl != NULL) xfree(lvl); #endif + if (role != NULL) + xfree(role); + if (con) + context_free(con); - return (sc); + return (r); +} + +/* Setup environment variables for pam_selinux */ +static int +ssh_selinux_setup_pam_variables(void) +{ + const char *reqlvl; + char *role; + char *use_current; + int rv; + + debug3("%s: setting execution context", __func__); + + ssh_selinux_get_role_level(&role, &reqlvl); + + rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : ""); + + if (inetd_flag && !rexeced_flag) { + use_current = "1"; + } else { + use_current = ""; + rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); + } + + rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current); + + if (role != NULL) + xfree(role); + + return rv; } /* Set the execution context to the default for the specified user */ void ssh_selinux_setup_exec_context(char *pwname) { + int r = 0; + security_context_t default_ctx = NULL; security_context_t user_ctx = NULL; if (!ssh_selinux_enabled()) return; + if (options.use_pam) { + /* do not compute context, just setup environment for pam_selinux */ + if (ssh_selinux_setup_pam_variables()) { + switch (security_getenforce()) { + case -1: + fatal("%s: security_getenforce() failed", __func__); + case 0: + error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.", + __func__); + break; + default: + fatal("%s: SELinux PAM variable setup failure. Aborting connection.", + __func__); + } + } + return; + } + debug3("%s: setting execution context", __func__); - user_ctx = ssh_selinux_getctxbyname(pwname); - if (setexeccon(user_ctx) != 0) { + r = ssh_selinux_getctxbyname(pwname, &default_ctx, &user_ctx); + if (r >= 0) { + r = setexeccon(user_ctx); + if (r < 0) { + error("%s: Failed to set SELinux execution context %s for %s", + __func__, user_ctx, pwname); + } +#ifdef HAVE_SETKEYCREATECON + else if (setkeycreatecon(user_ctx) < 0) { + error("%s: Failed to set SELinux keyring creation context %s for %s", + __func__, user_ctx, pwname); + } +#endif + } + if (user_ctx == NULL) { + user_ctx = default_ctx; + } + if (r < 0 || user_ctx != default_ctx) { + /* audit just the case when user changed a role or there was + a failure */ + send_audit_message(r >= 0, default_ctx, user_ctx); + } + if (r < 0) { switch (security_getenforce()) { case -1: fatal("%s: security_getenforce() failed", __func__); case 0: - error("%s: Failed to set SELinux execution " - "context for %s", __func__, pwname); + error("%s: SELinux failure. Continuing in permissive mode.", + __func__); break; default: - fatal("%s: Failed to set SELinux execution context " - "for %s (in enforcing mode)", __func__, pwname); + fatal("%s: SELinux failure. Aborting connection.", + __func__); } } - if (user_ctx != NULL) + if (user_ctx != NULL && user_ctx != default_ctx) freecon(user_ctx); + if (default_ctx != NULL) + freecon(default_ctx); debug3("%s: done", __func__); } @@ -141,7 +439,10 @@ ssh_selinux_setup_pty(char *pwname, cons debug3("%s: setting TTY context on %s", __func__, tty); - user_ctx = ssh_selinux_getctxbyname(pwname); + if (getexeccon(&user_ctx) < 0) { + error("%s: getexeccon: %s", __func__, strerror(errno)); + goto out; + } /* XXX: should these calls fatal() upon failure in enforcing mode? */