Backport SELinux build fix from CVS.

9 files changed, 277 insertions, 14 deletions

diff --git a/Makefile.in b/Makefile.in
index f51b86a27..415577112 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -48,6 +48,7 @@ LD=@LD@
 CFLAGS=@CFLAGS@
 CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
+SSHLIBS=@SSHLIBS@
 SSHDLIBS=@SSHDLIBS@
 LIBEDIT=@LIBEDIT@
 AR=@AR@
@@ -144,7 +145,7 @@ libssh.a: $(LIBSSH_OBJS)
         $(RANLIB) $@
 
 ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-        $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
+        $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
 
 sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
         $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
diff --git a/configure b/configure
index 6e05311aa..7eaffb08e 100755
--- a/configure
+++ b/configure
@@ -696,7 +696,6 @@ STARTUP_SCRIPT_SHELL
 LOGIN_PROGRAM_FALLBACK
 PATH_PASSWD_PROG
 LD
-SSHDLIBS
 PKGCONFIG
 LIBEDIT
 TEST_SSH_SHA256
@@ -721,6 +720,8 @@ PROG_UPTIME
 PROG_IPCS
 PROG_TAIL
 INSTALL_SSH_PRNG_CMDS
+SSHLIBS
+SSHDLIBS
 KRB5CONF
 PRIVSEP_PATH
 xauth_path
@@ -9047,7 +9048,6 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
                           SSHDLIBS="$SSHDLIBS -lcontract"
-
                           SPC_MSG="yes"
 fi
 
@@ -9126,7 +9126,6 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
                         SSHDLIBS="$SSHDLIBS -lproject"
-
                         SP_MSG="yes"
 fi
 
@@ -27806,6 +27805,7 @@ echo "$as_me: error: SELinux support requires libselinux library" >&2;}
    { (exit 1); exit 1; }; }
 fi
 
+                SSHLIBS="$SSHLIBS $LIBSELINUX"
                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
 
 
@@ -27908,6 +27908,8 @@ done
 fi
 
 
+
+
 # Check whether user wants Kerberos 5 support
 KRB5_MSG="no"
 
@@ -31416,7 +31418,6 @@ STARTUP_SCRIPT_SHELL!$STARTUP_SCRIPT_SHELL$ac_delim
 LOGIN_PROGRAM_FALLBACK!$LOGIN_PROGRAM_FALLBACK$ac_delim
 PATH_PASSWD_PROG!$PATH_PASSWD_PROG$ac_delim
 LD!$LD$ac_delim
-SSHDLIBS!$SSHDLIBS$ac_delim
 PKGCONFIG!$PKGCONFIG$ac_delim
 LIBEDIT!$LIBEDIT$ac_delim
 TEST_SSH_SHA256!$TEST_SSH_SHA256$ac_delim
@@ -31433,6 +31434,7 @@ PROG_PS!$PROG_PS$ac_delim
 PROG_SAR!$PROG_SAR$ac_delim
 PROG_W!$PROG_W$ac_delim
 PROG_WHO!$PROG_WHO$ac_delim
+PROG_LAST!$PROG_LAST$ac_delim
 _ACEOF
 
   if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
@@ -31474,7 +31476,6 @@ _ACEOF
 ac_delim='%!_!# '
 for ac_last_try in false false false false false :; do
   cat >conf$$subs.sed <<_ACEOF
-PROG_LAST!$PROG_LAST$ac_delim
 PROG_LASTLOG!$PROG_LASTLOG$ac_delim
 PROG_DF!$PROG_DF$ac_delim
 PROG_VMSTAT!$PROG_VMSTAT$ac_delim
@@ -31482,6 +31483,8 @@ PROG_UPTIME!$PROG_UPTIME$ac_delim
 PROG_IPCS!$PROG_IPCS$ac_delim
 PROG_TAIL!$PROG_TAIL$ac_delim
 INSTALL_SSH_PRNG_CMDS!$INSTALL_SSH_PRNG_CMDS$ac_delim
+SSHLIBS!$SSHLIBS$ac_delim
+SSHDLIBS!$SSHDLIBS$ac_delim
 KRB5CONF!$KRB5CONF$ac_delim
 PRIVSEP_PATH!$PRIVSEP_PATH$ac_delim
 xauth_path!$xauth_path$ac_delim
@@ -31496,7 +31499,7 @@ LIBOBJS!$LIBOBJS$ac_delim
 LTLIBOBJS!$LTLIBOBJS$ac_delim
 _ACEOF
 
-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 20; then
+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 21; then
     break
   elif $ac_last_try; then
     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
@@ -31993,6 +31996,9 @@ echo "         Libraries: ${LIBS}"
 if test ! -z "${SSHDLIBS}"; then
 echo "         +for sshd: ${SSHDLIBS}"
 fi
+if test ! -z "${SSHLIBS}"; then
+echo "          +for ssh: ${SSHLIBS}"
+fi
 
 echo ""
 
diff --git a/configure.ac b/configure.ac
index d7d1a988d..f15518b78 100644
--- a/configure.ac
+++ b/configure.ac
@@ -761,7 +761,6 @@ mips-sony-bsd|mips-sony-newsos4)
                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
                                 [Define if you have Solaris process contracts])
                           SSHDLIBS="$SSHDLIBS -lcontract"
-                          AC_SUBST(SSHDLIBS)
                           SPC_MSG="yes" ], )
                 ],
         )
@@ -772,7 +771,6 @@ mips-sony-bsd|mips-sony-newsos4)
                         [ AC_DEFINE(USE_SOLARIS_PROJECTS, 1,
                                 [Define if you have Solaris projects])
                         SSHDLIBS="$SSHDLIBS -lproject"
-                        AC_SUBST(SSHDLIBS)
                         SP_MSG="yes" ], )
                 ],
         )
@@ -3539,11 +3537,14 @@ AC_ARG_WITH(selinux,
                           LIBS="$LIBS -lselinux"
                         ],
                         AC_MSG_ERROR(SELinux support requires libselinux library))
+                SSHLIBS="$SSHLIBS $LIBSELINUX"
                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
                 LIBS="$save_LIBS"
         fi ]
 )
+AC_SUBST(SSHLIBS)
+AC_SUBST(SSHDLIBS)
 
 # Check whether user wants Kerberos 5 support
 KRB5_MSG="no"
@@ -4365,6 +4366,9 @@ echo "         Libraries: ${LIBS}"
 if test ! -z "${SSHDLIBS}"; then
 echo "         +for sshd: ${SSHDLIBS}"
 fi
+if test ! -z "${SSHLIBS}"; then
+echo "          +for ssh: ${SSHLIBS}"
+fi
 
 echo ""
 
diff --git a/debian/changelog b/debian/changelog
index e7f334fe8..b063f0fac 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -26,6 +26,7 @@ openssh (1:5.7p1-1) UNRELEASED; urgency=low
     installations or if you manually add 'HostKey
     /etc/ssh/ssh_host_ecdsa_key' to /etc/ssh/sshd_config.
   * Build-depend on libssl-dev (>= 0.9.8g) to ensure sufficient ECC support.
+  * Backport SELinux build fix from CVS.
 
  -- Colin Watson <cjwatson@debian.org>  Mon, 24 Jan 2011 12:07:24 +0000
 
diff --git a/debian/patches/selinux-build-failure.patch b/debian/patches/selinux-build-failure.patch
new file mode 100644
index 000000000..47c953009
--- /dev/null
+++ b/debian/patches/selinux-build-failure.patch
@@ -0,0 +1,236 @@
+Description: Fix SELinux build failure
+Origin: backport, http://bazaar.launchpad.net/~vcs-imports/openssh/main/revision/6317
+Author: Damien Miller <djm@mindrot.org>
+Last-Update: 2011-01-25
+
+Index: b/Makefile.in
+===================================================================
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -48,6 +48,7 @@
+ CFLAGS=@CFLAGS@
+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
+ LIBS=@LIBS@
++SSHLIBS=@SSHLIBS@
+ SSHDLIBS=@SSHDLIBS@
+ LIBEDIT=@LIBEDIT@
+ AR=@AR@
+@@ -144,7 +145,7 @@
+        $(RANLIB) $@
+ 
+ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
+-       $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
++       $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
+ 
+ sshd$(EXEEXT): libssh.a        $(LIBCOMPAT) $(SSHDOBJS)
+        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
+Index: b/configure.ac
+===================================================================
+--- a/configure.ac
++++ b/configure.ac
+@@ -761,7 +761,6 @@
+                        [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
+                                [Define if you have Solaris process contracts])
+                          SSHDLIBS="$SSHDLIBS -lcontract"
+-                         AC_SUBST(SSHDLIBS)
+                          SPC_MSG="yes" ], )
+                ],
+        )
+@@ -772,7 +771,6 @@
+                        [ AC_DEFINE(USE_SOLARIS_PROJECTS, 1,
+                                [Define if you have Solaris projects])
+                        SSHDLIBS="$SSHDLIBS -lproject"
+-                       AC_SUBST(SSHDLIBS)
+                        SP_MSG="yes" ], )
+                ],
+        )
+@@ -3539,11 +3537,14 @@
+                          LIBS="$LIBS -lselinux"
+                        ],
+                        AC_MSG_ERROR(SELinux support requires libselinux library))
++               SSHLIBS="$SSHLIBS $LIBSELINUX"
+                SSHDLIBS="$SSHDLIBS $LIBSELINUX"
+                AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
+                LIBS="$save_LIBS"
+        fi ]
+ )
++AC_SUBST(SSHLIBS)
++AC_SUBST(SSHDLIBS)
+ 
+ # Check whether user wants Kerberos 5 support
+ KRB5_MSG="no"
+@@ -4365,6 +4366,9 @@
+ if test ! -z "${SSHDLIBS}"; then
+ echo "         +for sshd: ${SSHDLIBS}"
+ fi
++if test ! -z "${SSHLIBS}"; then
++echo "          +for ssh: ${SSHLIBS}"
++fi
+ 
+ echo ""
+ 
+Index: b/configure
+===================================================================
+--- a/configure
++++ b/configure
+@@ -696,7 +696,6 @@
+ LOGIN_PROGRAM_FALLBACK
+ PATH_PASSWD_PROG
+ LD
+-SSHDLIBS
+ PKGCONFIG
+ LIBEDIT
+ TEST_SSH_SHA256
+@@ -721,6 +720,8 @@
+ PROG_IPCS
+ PROG_TAIL
+ INSTALL_SSH_PRNG_CMDS
++SSHLIBS
++SSHDLIBS
+ KRB5CONF
+ PRIVSEP_PATH
+ xauth_path
+@@ -9047,7 +9159,6 @@
+ _ACEOF
+ 
+                          SSHDLIBS="$SSHDLIBS -lcontract"
+-
+                          SPC_MSG="yes"
+ fi
+ 
+@@ -9126,7 +9237,6 @@
+ _ACEOF
+ 
+                        SSHDLIBS="$SSHDLIBS -lproject"
+-
+                        SP_MSG="yes"
+ fi
+ 
+@@ -27806,6 +27916,7 @@
+    { (exit 1); exit 1; }; }
+ fi
+ 
++               SSHLIBS="$SSHLIBS $LIBSELINUX"
+                SSHDLIBS="$SSHDLIBS $LIBSELINUX"
+ 
+ 
+@@ -27908,6 +28019,8 @@
+ fi
+ 
+ 
++
++
+ # Check whether user wants Kerberos 5 support
+ KRB5_MSG="no"
+ 
+@@ -31416,7 +31529,6 @@
+ LOGIN_PROGRAM_FALLBACK!$LOGIN_PROGRAM_FALLBACK$ac_delim
+ PATH_PASSWD_PROG!$PATH_PASSWD_PROG$ac_delim
+ LD!$LD$ac_delim
+-SSHDLIBS!$SSHDLIBS$ac_delim
+ PKGCONFIG!$PKGCONFIG$ac_delim
+ LIBEDIT!$LIBEDIT$ac_delim
+ TEST_SSH_SHA256!$TEST_SSH_SHA256$ac_delim
+@@ -31433,6 +31545,7 @@
+ PROG_SAR!$PROG_SAR$ac_delim
+ PROG_W!$PROG_W$ac_delim
+ PROG_WHO!$PROG_WHO$ac_delim
++PROG_LAST!$PROG_LAST$ac_delim
+ _ACEOF
+ 
+   if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
+@@ -31474,7 +31587,6 @@
+ ac_delim='%!_!# '
+ for ac_last_try in false false false false false :; do
+   cat >conf$$subs.sed <<_ACEOF
+-PROG_LAST!$PROG_LAST$ac_delim
+ PROG_LASTLOG!$PROG_LASTLOG$ac_delim
+ PROG_DF!$PROG_DF$ac_delim
+ PROG_VMSTAT!$PROG_VMSTAT$ac_delim
+@@ -31482,6 +31594,8 @@
+ PROG_IPCS!$PROG_IPCS$ac_delim
+ PROG_TAIL!$PROG_TAIL$ac_delim
+ INSTALL_SSH_PRNG_CMDS!$INSTALL_SSH_PRNG_CMDS$ac_delim
++SSHLIBS!$SSHLIBS$ac_delim
++SSHDLIBS!$SSHDLIBS$ac_delim
+ KRB5CONF!$KRB5CONF$ac_delim
+ PRIVSEP_PATH!$PRIVSEP_PATH$ac_delim
+ xauth_path!$xauth_path$ac_delim
+@@ -31496,7 +31610,7 @@
+ LTLIBOBJS!$LTLIBOBJS$ac_delim
+ _ACEOF
+ 
+-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 20; then
++  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 21; then
+     break
+   elif $ac_last_try; then
+     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
+@@ -31993,6 +32107,9 @@
+ if test ! -z "${SSHDLIBS}"; then
+ echo "         +for sshd: ${SSHDLIBS}"
+ fi
++if test ! -z "${SSHLIBS}"; then
++echo "          +for ssh: ${SSHLIBS}"
++fi
+ 
+ echo ""
+ 
+Index: b/openbsd-compat/port-linux.c
+===================================================================
+--- a/openbsd-compat/port-linux.c
++++ b/openbsd-compat/port-linux.c
+@@ -222,6 +222,20 @@
+        xfree(oldctx);
+        xfree(newctx);
+ }
++
++void
++ssh_selinux_setfscreatecon(const char *path)
++{
++               security_context_t context;
++
++               if (path == NULL) {
++                       setfscreatecon(NULL);
++                       return;
++               }
++               matchpathcon(path, 0700, &context);
++               setfscreatecon(context);
++}
++
+ #endif /* WITH_SELINUX */
+ 
+ #ifdef LINUX_OOM_ADJUST
+Index: b/openbsd-compat/port-linux.h
+===================================================================
+--- a/openbsd-compat/port-linux.h
++++ b/openbsd-compat/port-linux.h
+@@ -24,6 +24,7 @@
+ void ssh_selinux_setup_pty(char *, const char *);
+ void ssh_selinux_setup_exec_context(char *);
+ void ssh_selinux_change_context(const char *);
++void ssh_selinux_setfscreatecon(const char *);
+ #endif
+ 
+ #ifdef LINUX_OOM_ADJUST
+Index: b/ssh.c
+===================================================================
+--- a/ssh.c
++++ b/ssh.c
+@@ -852,15 +852,12 @@
+            strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
+        if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0) {
+ #ifdef WITH_SELINUX
+-               char *scon;
+-
+-               matchpathcon(buf, 0700, &scon);
+-               setfscreatecon(scon);
++               ssh_selinux_setfscreatecon(buf);
+ #endif
+                if (mkdir(buf, 0700) < 0)
+                        error("Could not create directory '%.200s'.", buf);
+ #ifdef WITH_SELINUX
+-               setfscreatecon(NULL);
++               ssh_selinux_setfscreatecon(NULL);
+ #endif
+        }
+        /* load options.identity_files */
diff --git a/debian/patches/series b/debian/patches/series
index 751a9868c..a3431201e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -36,6 +36,9 @@ openbsd-docs.patch
 ssh-argv0.patch
 doc-hash-tab-completion.patch
 
+# Upstream backports
+selinux-build-failure.patch
+
 # Debian-specific configuration
 gnome-ssh-askpass2-icon.patch
 debian-config.patch
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
index 86a7146a6..744a404c8 100644
--- a/openbsd-compat/port-linux.c
+++ b/openbsd-compat/port-linux.c
@@ -222,6 +222,20 @@ ssh_selinux_change_context(const char *newname)
         xfree(oldctx);
         xfree(newctx);
 }
+
+void
+ssh_selinux_setfscreatecon(const char *path)
+{
+                security_context_t context;
+
+                if (path == NULL) {
+                        setfscreatecon(NULL);
+                        return;
+                }
+                matchpathcon(path, 0700, &context);
+                setfscreatecon(context);
+}
+
 #endif /* WITH_SELINUX */
 
 #ifdef LINUX_OOM_ADJUST
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
index 209d9a7a2..884482bf5 100644
--- a/openbsd-compat/port-linux.h
+++ b/openbsd-compat/port-linux.h
@@ -24,6 +24,7 @@ int ssh_selinux_enabled(void);
 void ssh_selinux_setup_pty(char *, const char *);
 void ssh_selinux_setup_exec_context(char *);
 void ssh_selinux_change_context(const char *);
+void ssh_selinux_setfscreatecon(const char *);
 #endif
 
 #ifdef LINUX_OOM_ADJUST
diff --git a/ssh.c b/ssh.c
index 77dbde058..aa2ad4a2f 100644
--- a/ssh.c
+++ b/ssh.c
@@ -852,15 +852,12 @@ main(int ac, char **av)
             strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
         if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0) {
 #ifdef WITH_SELINUX
-                char *scon;
-
-                matchpathcon(buf, 0700, &scon);
-                setfscreatecon(scon);
+                ssh_selinux_setfscreatecon(buf);
 #endif
                 if (mkdir(buf, 0700) < 0)
                         error("Could not create directory '%.200s'.", buf);
 #ifdef WITH_SELINUX
-                setfscreatecon(NULL);
+                ssh_selinux_setfscreatecon(NULL);
 #endif
         }
         /* load options.identity_files */