Handle SELinux authorisation roles

Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change.  In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795
Last-Update: 2020-02-21

Patch-Name: selinux-role.patch

1 files changed, 24 insertions, 3 deletions

diff --git a/monitor_wrap.c b/monitor_wrap.c
index 6edb509a3..b49c268d3 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -364,10 +364,10 @@ mm_auth2_read_banner(void)
         return (banner);
 }
 
-/* Inform the privileged process about service and style */
+/* Inform the privileged process about service, style, and role */
 
 void
-mm_inform_authserv(char *service, char *style)
+mm_inform_authserv(char *service, char *style, char *role)
 {
         struct sshbuf *m;
         int r;
@@ -377,7 +377,8 @@ mm_inform_authserv(char *service, char *style)
         if ((m = sshbuf_new()) == NULL)
                 fatal("%s: sshbuf_new failed", __func__);
         if ((r = sshbuf_put_cstring(m, service)) != 0 ||
-            (r = sshbuf_put_cstring(m, style ? style : "")) != 0)
+            (r = sshbuf_put_cstring(m, style ? style : "")) != 0 ||
+            (r = sshbuf_put_cstring(m, role ? role : "")) != 0)
                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHSERV, m);
@@ -385,6 +386,26 @@ mm_inform_authserv(char *service, char *style)
         sshbuf_free(m);
 }
 
+/* Inform the privileged process about role */
+
+void
+mm_inform_authrole(char *role)
+{
+        struct sshbuf *m;
+        int r;
+
+        debug3("%s entering", __func__);
+
+        if ((m = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_cstring(m, role ? role : "")) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+
+        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, m);
+
+        sshbuf_free(m);
+}
+
 /* Do the password authentication */
 int
 mm_auth_password(struct ssh *ssh, char *password)