Handle SELinux authorisation roles

Rejected upstream due to discomfort with magic usernames; a better approach
will need an SSH protocol change.  In the meantime, this came from Debian's
SELinux maintainer, so we'll keep it until we have something better.

Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
Bug-Debian: http://bugs.debian.org/394795
Last-Update: 2017-10-04

Patch-Name: selinux-role.patch

1 files changed, 5 insertions, 5 deletions

diff --git a/session.c b/session.c
index 4bccb62d1..d40afe4f7 100644
--- a/session.c
+++ b/session.c
@@ -1312,7 +1312,7 @@ safely_chroot(const char *path, uid_t uid)
 
 /* Set login name, uid, gid, and groups. */
 void
-do_setusercontext(struct passwd *pw)
+do_setusercontext(struct passwd *pw, const char *role)
 {
         char *chroot_path, *tmp;
 
@@ -1340,7 +1340,7 @@ do_setusercontext(struct passwd *pw)
                 endgrent();
 #endif
 
-                platform_setusercontext_post_groups(pw);
+                platform_setusercontext_post_groups(pw, role);
 
                 if (!in_chroot && options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
@@ -1477,7 +1477,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
 
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
-                do_setusercontext(pw);
+                do_setusercontext(pw, s->authctxt->role);
                 child_close_fds(ssh);
                 do_pwchange(s);
                 exit(1);
@@ -1499,7 +1499,7 @@ do_child(struct ssh *ssh, Session *s, const char *command)
         /* When PAM is enabled we rely on it to do the nologin check */
         if (!options.use_pam)
                 do_nologin(pw);
-        do_setusercontext(pw);
+        do_setusercontext(pw, s->authctxt->role);
         /*
          * PAM session modules in do_setusercontext may have
          * generated messages, so if this in an interactive
@@ -1891,7 +1891,7 @@ session_pty_req(struct ssh *ssh, Session *s)
         tty_parse_modes(s->ttyfd, &n_bytes);
 
         if (!use_privsep)
-                pty_setowner(s->pw, s->tty);
+                pty_setowner(s->pw, s->tty, s->authctxt->role);
 
         /* Set window size from the packet. */
         pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);