Manoj Srivastava:

- Added SELinux capability, and turned it on be default. Added
  restorecon calls in preinst and postinst (should not matter if the
  machine is not SELinux aware). By and large, the changes made should
  have no effect unless the rules file calls --with-selinux; and even
  then there should be no performance hit for machines not actively
  running SELinux.
- Modified the preinst and postinst to call restorecon to set the
  security context for the generated public key files.
- Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
  may want to also include pam_selinux.so.

1 files changed, 6 insertions, 1 deletions

diff --git a/debian/rules b/debian/rules
index 452b7fdbf..772d08f84 100755
--- a/debian/rules
+++ b/debian/rules
@@ -57,6 +57,11 @@ ifeq ($(DEB_HOST_ARCH_OS),hurd)
 FORCE_LIBS := LIBS=-lcrypt
 endif
 
+# SELinux support?
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+SELINUX := --with-selinux
+endif
+
 # Change the version string to include the Debian version
 SSH_EXTRAVERSION := Debian-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//')
 
@@ -66,7 +71,7 @@ build-deb: build-deb-stamp
 build-deb-stamp:
         dh_testdir
         mkdir -p build-deb
-        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit
+        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit $(SELINUX)
 
 ifeq ($(DEB_HOST_ARCH_OS),linux)
         # Some 2.2 kernels have trouble with setres[ug]id() (bug #239999).