Handle SELinux authorisation roles

Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change.  In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795
Last-Update: 2020-02-21

Patch-Name: selinux-role.patch

1 files changed, 2 insertions, 2 deletions

diff --git a/platform.c b/platform.c
index 44ba71dc5..2defe9425 100644
--- a/platform.c
+++ b/platform.c
@@ -143,7 +143,7 @@ platform_setusercontext(struct passwd *pw)
  * called if sshd is running as root.
  */
 void
-platform_setusercontext_post_groups(struct passwd *pw)
+platform_setusercontext_post_groups(struct passwd *pw, const char *role)
 {
 #if !defined(HAVE_LOGIN_CAP) && defined(USE_PAM)
         /*
@@ -184,7 +184,7 @@ platform_setusercontext_post_groups(struct passwd *pw)
         }
 #endif /* HAVE_SETPCRED */
 #ifdef WITH_SELINUX
-        ssh_selinux_setup_exec_context(pw->pw_name);
+        ssh_selinux_setup_exec_context(pw->pw_name, role);
 #endif
 }