diff options
author | Colin Watson <cjwatson@debian.org> | 2007-06-12 16:16:35 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2007-06-12 16:16:35 +0000 |
commit | b7e40fa9da0b5491534a429dadb321eab5a77558 (patch) | |
tree | bed1da11e9f829925797aa093e379fc0b5868ecd /selinux.c | |
parent | 4f84beedf1005e44ff33c854abd6b711ffc0adb7 (diff) | |
parent | 086ea76990b1e6287c24b6db74adffd4605eb3b0 (diff) |
* New upstream release (closes: #395507, #397961, #420035). Important
changes not previously backported to 4.3p2:
- 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
+ On portable OpenSSH, fix a GSSAPI authentication abort that could be
used to determine the validity of usernames on some platforms.
+ Implemented conditional configuration in sshd_config(5) using the
"Match" directive. This allows some configuration options to be
selectively overridden if specific criteria (based on user, group,
hostname and/or address) are met. So far a useful subset of
post-authentication options are supported and more are expected to
be added in future releases.
+ Add support for Diffie-Hellman group exchange key agreement with a
final hash of SHA256.
+ Added a "ForceCommand" directive to sshd_config(5). Similar to the
command="..." option accepted in ~/.ssh/authorized_keys, this forces
the execution of the specified command regardless of what the user
requested. This is very useful in conjunction with the new "Match"
option.
+ Add a "PermitOpen" directive to sshd_config(5). This mirrors the
permitopen="..." authorized_keys option, allowing fine-grained
control over the port-forwardings that a user is allowed to
establish.
+ Add optional logging of transactions to sftp-server(8).
+ ssh(1) will now record port numbers for hosts stored in
~/.ssh/known_hosts when a non-standard port has been requested
(closes: #50612).
+ Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
non-zero exit code) when requested port forwardings could not be
established.
+ Extend sshd_config(5) "SubSystem" declarations to allow the
specification of command-line arguments.
+ Replacement of all integer overflow susceptible invocations of
malloc(3) and realloc(3) with overflow-checking equivalents.
+ Many manpage fixes and improvements.
+ Add optional support for OpenSSL hardware accelerators (engines),
enabled using the --with-ssl-engine configure option.
+ Tokens in configuration files may be double-quoted in order to
contain spaces (closes: #319639).
+ Move a debug() call out of a SIGCHLD handler, fixing a hang when the
session exits very quickly (closes: #307890).
+ Fix some incorrect buffer allocation calculations (closes: #410599).
+ ssh-add doesn't ask for a passphrase if key file permissions are too
liberal (closes: #103677).
+ Likewise, ssh doesn't ask either (closes: #99675).
- 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
+ sshd now allows the enabling and disabling of authentication methods
on a per user, group, host and network basis via the Match directive
in sshd_config.
+ Fixed an inconsistent check for a terminal when displaying scp
progress meter (closes: #257524).
+ Fix "hang on exit" when background processes are running at the time
of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
install ChangeLog.gssapi.
Diffstat (limited to 'selinux.c')
-rw-r--r-- | selinux.c | 95 |
1 files changed, 0 insertions, 95 deletions
diff --git a/selinux.c b/selinux.c deleted file mode 100644 index 2811a9b80..000000000 --- a/selinux.c +++ /dev/null | |||
@@ -1,95 +0,0 @@ | |||
1 | #include "includes.h" | ||
2 | #include "auth.h" | ||
3 | #include "log.h" | ||
4 | |||
5 | #ifdef WITH_SELINUX | ||
6 | #include <selinux/selinux.h> | ||
7 | #include <selinux/flask.h> | ||
8 | #include <selinux/context.h> | ||
9 | #include <selinux/get_context_list.h> | ||
10 | #include <selinux/get_default_type.h> | ||
11 | |||
12 | extern Authctxt *the_authctxt; | ||
13 | |||
14 | static const security_context_t | ||
15 | selinux_get_user_context(const char *name) | ||
16 | { | ||
17 | security_context_t user_context=NULL; | ||
18 | char *role=NULL; | ||
19 | int ret = -1; | ||
20 | char *seuser=NULL; | ||
21 | char *level=NULL; | ||
22 | |||
23 | if (the_authctxt) | ||
24 | role=the_authctxt->role; | ||
25 | if (getseuserbyname(name, &seuser, &level)==0) { | ||
26 | if (role != NULL && role[0]) | ||
27 | ret=get_default_context_with_rolelevel(seuser, role, level,NULL, | ||
28 | &user_context); | ||
29 | else | ||
30 | ret=get_default_context_with_level(seuser, level, NULL,&user_context); | ||
31 | } | ||
32 | if ( ret < 0 ) { | ||
33 | if (security_getenforce() > 0) | ||
34 | fatal("Failed to get default security context for %s.", | ||
35 | name); | ||
36 | else | ||
37 | error("Failed to get default security context for %s." | ||
38 | "Continuing in permissive mode", | ||
39 | name); | ||
40 | } | ||
41 | return user_context; | ||
42 | } | ||
43 | |||
44 | void | ||
45 | setup_selinux_pty(const char *name, const char *tty) | ||
46 | { | ||
47 | if (is_selinux_enabled() > 0) { | ||
48 | security_context_t new_tty_context=NULL, user_context=NULL, old_tty_context=NULL; | ||
49 | |||
50 | user_context=selinux_get_user_context(name); | ||
51 | |||
52 | if (getfilecon(tty, &old_tty_context) < 0) { | ||
53 | error("getfilecon(%.100s) failed: %.100s", | ||
54 | tty, strerror(errno)); | ||
55 | } else { | ||
56 | if (security_compute_relabel(user_context,old_tty_context, | ||
57 | SECCLASS_CHR_FILE, &new_tty_context) != 0) { | ||
58 | error("security_compute_relabel(%.100s) failed: " | ||
59 | "%.100s", tty, strerror(errno)); | ||
60 | } else { | ||
61 | if (setfilecon (tty, new_tty_context) != 0) | ||
62 | error("setfilecon(%.100s, %s) failed: %.100s", | ||
63 | tty, new_tty_context, strerror(errno)); | ||
64 | freecon(new_tty_context); | ||
65 | } | ||
66 | freecon(old_tty_context); | ||
67 | } | ||
68 | if (user_context) { | ||
69 | freecon(user_context); | ||
70 | } | ||
71 | } | ||
72 | } | ||
73 | |||
74 | void | ||
75 | setup_selinux_exec_context(char *name) | ||
76 | { | ||
77 | |||
78 | if (is_selinux_enabled() > 0) { | ||
79 | security_context_t user_context=selinux_get_user_context(name); | ||
80 | if (setexeccon(user_context)) { | ||
81 | if (security_getenforce() > 0) | ||
82 | fatal("Failed to set exec security context %s for %s.", | ||
83 | user_context, name); | ||
84 | else | ||
85 | error("Failed to set exec security context %s for %s. " | ||
86 | "Continuing in permissive mode", | ||
87 | user_context, name); | ||
88 | } | ||
89 | if (user_context) { | ||
90 | freecon(user_context); | ||
91 | } | ||
92 | } | ||
93 | } | ||
94 | |||
95 | #endif /* WITH_SELINUX */ | ||