Bracket our session stack with calls to pam_selinux close/open (thanks,

Laurent Bigonville; closes: #679458).

1 files changed, 10 insertions, 3 deletions

diff --git a/debian/openssh-server.sshd.pam b/debian/openssh-server.sshd.pam
index e61d67777..5f7ab2f60 100644
--- a/debian/openssh-server.sshd.pam
+++ b/debian/openssh-server.sshd.pam
@@ -13,6 +13,11 @@ account    required     pam_nologin.so
 # Standard Un*x authorization.
 @include common-account
 
+# SELinux needs to be the first session rule.  This ensures that any
+# lingering context has been cleared.  Without this it is possible that a
+# module could execute code in the wrong domain.
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
+
 # Set the loginuid process attribute.
 session    required     pam_loginuid.so
 
@@ -31,9 +36,6 @@ session    optional     pam_mail.so standard noenv # [1]
 # Set up user limits from /etc/security/limits.conf.
 session    required     pam_limits.so
 
-# Set up SELinux capabilities (need modified pam)
-# session  required     pam_selinux.so multiple
-
 # Read environment variables from /etc/environment and
 # /etc/security/pam_env.conf.
 session    required     pam_env.so # [1]
@@ -41,5 +43,10 @@ session    required     pam_env.so # [1]
 # /etc/default/locale, so read that as well.
 session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
 
+# SELinux needs to intervene at login time to ensure that the process starts
+# in the proper default security context.  Only sessions which are intended
+# to run in the user's context should be run after this.
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
+
 # Standard Un*x password updating.
 @include common-password