diff options
author | Manoj Srivastava <srivasta@debian.org> | 2014-02-09 16:09:49 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2017-03-29 01:38:38 +0100 |
commit | e5d3ea2ca423a54b1d53d45252cb7173a15600eb (patch) | |
tree | f62cc47e5d58909724339ee922845c3c2b881cd6 /monitor.c | |
parent | 9d91ede3c03c99b6584038aa07d095d7c277ad3a (diff) |
Handle SELinux authorisation roles
Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change. In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795
Last-Update: 2015-08-19
Patch-Name: selinux-role.patch
Diffstat (limited to 'monitor.c')
-rw-r--r-- | monitor.c | 32 |
1 files changed, 29 insertions, 3 deletions
@@ -127,6 +127,7 @@ int mm_answer_sign(int, Buffer *); | |||
127 | int mm_answer_pwnamallow(int, Buffer *); | 127 | int mm_answer_pwnamallow(int, Buffer *); |
128 | int mm_answer_auth2_read_banner(int, Buffer *); | 128 | int mm_answer_auth2_read_banner(int, Buffer *); |
129 | int mm_answer_authserv(int, Buffer *); | 129 | int mm_answer_authserv(int, Buffer *); |
130 | int mm_answer_authrole(int, Buffer *); | ||
130 | int mm_answer_authpassword(int, Buffer *); | 131 | int mm_answer_authpassword(int, Buffer *); |
131 | int mm_answer_bsdauthquery(int, Buffer *); | 132 | int mm_answer_bsdauthquery(int, Buffer *); |
132 | int mm_answer_bsdauthrespond(int, Buffer *); | 133 | int mm_answer_bsdauthrespond(int, Buffer *); |
@@ -204,6 +205,7 @@ struct mon_table mon_dispatch_proto20[] = { | |||
204 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, | 205 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, |
205 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, | 206 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, |
206 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, | 207 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, |
208 | {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, | ||
207 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, | 209 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, |
208 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, | 210 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, |
209 | #ifdef USE_PAM | 211 | #ifdef USE_PAM |
@@ -791,6 +793,7 @@ mm_answer_pwnamallow(int sock, Buffer *m) | |||
791 | 793 | ||
792 | /* Allow service/style information on the auth context */ | 794 | /* Allow service/style information on the auth context */ |
793 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); | 795 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); |
796 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); | ||
794 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); | 797 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); |
795 | 798 | ||
796 | #ifdef USE_PAM | 799 | #ifdef USE_PAM |
@@ -821,14 +824,37 @@ mm_answer_authserv(int sock, Buffer *m) | |||
821 | 824 | ||
822 | authctxt->service = buffer_get_string(m, NULL); | 825 | authctxt->service = buffer_get_string(m, NULL); |
823 | authctxt->style = buffer_get_string(m, NULL); | 826 | authctxt->style = buffer_get_string(m, NULL); |
824 | debug3("%s: service=%s, style=%s", | 827 | authctxt->role = buffer_get_string(m, NULL); |
825 | __func__, authctxt->service, authctxt->style); | 828 | debug3("%s: service=%s, style=%s, role=%s", |
829 | __func__, authctxt->service, authctxt->style, authctxt->role); | ||
826 | 830 | ||
827 | if (strlen(authctxt->style) == 0) { | 831 | if (strlen(authctxt->style) == 0) { |
828 | free(authctxt->style); | 832 | free(authctxt->style); |
829 | authctxt->style = NULL; | 833 | authctxt->style = NULL; |
830 | } | 834 | } |
831 | 835 | ||
836 | if (strlen(authctxt->role) == 0) { | ||
837 | free(authctxt->role); | ||
838 | authctxt->role = NULL; | ||
839 | } | ||
840 | |||
841 | return (0); | ||
842 | } | ||
843 | |||
844 | int | ||
845 | mm_answer_authrole(int sock, Buffer *m) | ||
846 | { | ||
847 | monitor_permit_authentications(1); | ||
848 | |||
849 | authctxt->role = buffer_get_string(m, NULL); | ||
850 | debug3("%s: role=%s", | ||
851 | __func__, authctxt->role); | ||
852 | |||
853 | if (strlen(authctxt->role) == 0) { | ||
854 | free(authctxt->role); | ||
855 | authctxt->role = NULL; | ||
856 | } | ||
857 | |||
832 | return (0); | 858 | return (0); |
833 | } | 859 | } |
834 | 860 | ||
@@ -1463,7 +1489,7 @@ mm_answer_pty(int sock, Buffer *m) | |||
1463 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); | 1489 | res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)); |
1464 | if (res == 0) | 1490 | if (res == 0) |
1465 | goto error; | 1491 | goto error; |
1466 | pty_setowner(authctxt->pw, s->tty); | 1492 | pty_setowner(authctxt->pw, s->tty, authctxt->role); |
1467 | 1493 | ||
1468 | buffer_put_int(m, 1); | 1494 | buffer_put_int(m, 1); |
1469 | buffer_put_cstring(m, s->tty); | 1495 | buffer_put_cstring(m, s->tty); |