Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:

#556644).

2 files changed, 6 insertions, 4 deletions

diff --git a/debian/changelog b/debian/changelog
index e0bc80ef2..0b688f8ca 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -33,6 +33,8 @@ openssh (1:5.2p1-1) UNRELEASED; urgency=low
   * Use x11.pc when compiling/linking gnome-ssh-askpass2 (closes: #555951).
   * Moved to bzr.debian.org; add Vcs-Bzr and Vcs-Browser control fields.
   * Add debian/README.source with instructions on bzr handling.
+  * Make ChrootDirectory work with SELinux (thanks, Russell Coker; closes:
+    #556644).
 
  -- Colin Watson <cjwatson@debian.org>  Thu, 12 Nov 2009 21:31:44 +0000
 
diff --git a/session.c b/session.c
index f2549e0cd..f296e9f10 100644
--- a/session.c
+++ b/session.c
@@ -1529,6 +1529,10 @@ do_setusercontext(struct passwd *pw)
 # endif /* USE_LIBIAF */
 #endif
 
+#ifdef WITH_SELINUX
+                ssh_selinux_setup_exec_context(pw->pw_name);
+#endif
+
                 if (options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
                         tmp = tilde_expand_filename(options.chroot_directory,
@@ -1556,10 +1560,6 @@ do_setusercontext(struct passwd *pw)
 #endif
         if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
                 fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
-
-#ifdef WITH_SELINUX
-        ssh_selinux_setup_exec_context(pw->pw_name);
-#endif
 }
 
 static void