2 files changed, 11 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index f735d03f5..d898d8181 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20110520
+ - (djm) [session.c] call setexeccon() before executing passwd for pw
+   changes; bz#1891 reported by jchadima AT redhat.com; ok dtucker@
+
 20110515
  - (djm) OpenBSD CVS Sync
    - djm@cvs.openbsd.org 2011/05/05 05:12:08
diff --git a/session.c b/session.c
index fff31b02e..6a7040078 100644
--- a/session.c
+++ b/session.c
@@ -96,6 +96,10 @@
 #include <kafs.h>
 #endif
 
+#ifdef WITH_SELINUX
+#include <selinux/selinux.h>
+#endif
+
 #define IS_INTERNAL_SFTP(c) \
         (!strncmp(c, INTERNAL_SFTP_NAME, sizeof(INTERNAL_SFTP_NAME) - 1) && \
          (c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\0' || \
@@ -1531,6 +1535,9 @@ do_pwchange(Session *s)
         if (s->ttyfd != -1) {
                 fprintf(stderr,
                     "You must change your password now and login again!\n");
+#ifdef WITH_SELINUX
+                setexeccon(NULL);
+#endif
 #ifdef PASSWD_NEEDS_USERNAME
                 execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
                     (char *)NULL);