Manoj Srivastava:

- Added SELinux capability, and turned it on be default. Added
  restorecon calls in preinst and postinst (should not matter if the
  machine is not SELinux aware). By and large, the changes made should
  have no effect unless the rules file calls --with-selinux; and even
  then there should be no performance hit for machines not actively
  running SELinux.
- Modified the preinst and postinst to call restorecon to set the
  security context for the generated public key files.
- Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
  may want to also include pam_selinux.so.

6 files changed, 27 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 671a44922..aae858b96 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,17 @@ openssh (1:4.1p1-4) UNRELEASED; urgency=low
 
   * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5
     only conflicts with ssh (closes: #312475).
+  * Manoj Srivastava:
+    - Added SELinux capability, and turned it on be default. Added
+      restorecon calls in preinst and postinst (should not matter if the
+      machine is not SELinux aware). By and large, the changes made should
+      have no effect unless the rules file calls --with-selinux; and even
+      then there should be no performance hit for machines not actively
+      running SELinux.
+    - Modified the preinst and postinst to call restorecon to set the
+      security context for the generated public key files.
+    - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
+      may want to also include pam_selinux.so.
   * debconf template translations:
     - Update German (thanks, Jens Seidel; closes: #313949).
 
diff --git a/debian/control b/debian/control
index 4e7cfd1b1..de945cf9c 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: openssh
 Section: net
 Priority: standard
 Maintainer: Matthew Vernon <matthew@debian.org>
-Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev | libz-dev, libssl-dev, libpam0g-dev | libpam-dev, libgnomeui-dev (>= 2.0.0) [!hurd-i386] | libgnome-dev [!hurd-i386], libedit-dev, groff, debhelper (>= 2), sharutils [!hurd-i386]
+Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev | libz-dev, libssl-dev, libpam0g-dev | libpam-dev, libgnomeui-dev (>= 2.0.0) [!hurd-i386] | libgnome-dev [!hurd-i386], libedit-dev, groff, debhelper (>= 2), sharutils [!hurd-i386], libselinux1-dev [alpha amd64 arm hppa i386 ia64 m68k mips mipsel powerpc s390 sparc]
 Standards-Version: 3.6.1
 Uploaders: Colin Watson <cjwatson@debian.org>
 
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 9beb373b7..e6fe65ffa 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -94,6 +94,9 @@ create_key() {
                 echo -n $msg
                 ssh-keygen -q -f "$file" -N '' "$@"
                 echo
+                if type restorecon >/dev/null 2>&1; then
+                        restorecon "$file.pub"
+                fi
         fi
 }
 
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst
index 320d4df2a..1ae85c7e8 100644
--- a/debian/openssh-server.preinst
+++ b/debian/openssh-server.preinst
@@ -72,6 +72,9 @@ EOF
       # case the key is encrypted, which we need to fix
       chmod 600 $key
       ssh-keygen -u -f $key >/dev/null
+      if type restorecon >/dev/null 2>&1; then
+        restorecon "$key.pub"
+      fi
     }
   fi
 fi
diff --git a/debian/openssh-server.ssh.pam b/debian/openssh-server.ssh.pam
index 1332a267e..ce33b9347 100644
--- a/debian/openssh-server.ssh.pam
+++ b/debian/openssh-server.ssh.pam
@@ -22,5 +22,8 @@ session    optional     pam_mail.so standard noenv # [1]
 # Set up user limits from /etc/security/limits.conf.
 session    required     pam_limits.so
 
+# Set up SELinux capabilities (need modified pam)
+# session  required     pam_selinux.so multiple
+
 # Standard Un*x password updating.
 @include common-password
diff --git a/debian/rules b/debian/rules
index 452b7fdbf..772d08f84 100755
--- a/debian/rules
+++ b/debian/rules
@@ -57,6 +57,11 @@ ifeq ($(DEB_HOST_ARCH_OS),hurd)
 FORCE_LIBS := LIBS=-lcrypt
 endif
 
+# SELinux support?
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+SELINUX := --with-selinux
+endif
+
 # Change the version string to include the Debian version
 SSH_EXTRAVERSION := Debian-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//')
 
@@ -66,7 +71,7 @@ build-deb: build-deb-stamp
 build-deb-stamp:
         dh_testdir
         mkdir -p build-deb
-        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit
+        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit $(SELINUX)
 
 ifeq ($(DEB_HOST_ARCH_OS),linux)
         # Some 2.2 kernels have trouble with setres[ug]id() (bug #239999).