10 files changed, 247 insertions, 10 deletions

diff --git a/ChangeLog b/ChangeLog
index 5328aa9c4..92a2f25d6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,14 @@
+20060421
+ - (djm) [Makefile.in configure.ac session.c sshpty.c]
+   [contrib/redhat/sshd.init openbsd-compat/Makefile.in]
+   [openbsd-compat/openbsd-compat.h openbsd-compat/port-linux.c]
+   [openbsd-compat/port-linux.h] Add support for SELinux, setting 
+   the execution and TTY contexts. based on patch from Daniel Walsh,
+   bz #880; ok dtucker@
+
 20060418
- - (djm) Reorder IP options check so that it isn't broken by 
-   mapped addresses; bz #1179 reported by markw wtech-llc.com;
+ - (djm) [canohost.c] Reorder IP options check so that it isn't broken
+   by mapped addresses; bz #1179 reported by markw wtech-llc.com;
    ok dtucker@
 
 20060331
@@ -4500,4 +4508,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.4301 2006/04/18 05:13:16 djm Exp $
+$Id: ChangeLog,v 1.4302 2006/04/22 11:26:08 djm Exp $
diff --git a/Makefile.in b/Makefile.in
index 57475f003..9bc25e7a7 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.276 2006/03/15 02:09:18 djm Exp $
+# $Id: Makefile.in,v 1.277 2006/04/22 11:26:08 djm Exp $
 
 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -43,6 +43,7 @@ LD=@LD@
 CFLAGS=@CFLAGS@
 CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
+LIBSELINUX=@LIBSELINUX@
 LIBEDIT=@LIBEDIT@
 LIBPAM=@LIBPAM@
 LIBWRAP=@LIBWRAP@
@@ -136,7 +137,7 @@ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
         $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
 sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
-        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBS)
+        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBSELINUX) $(LIBS)
 
 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
         $(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
diff --git a/configure.ac b/configure.ac
index 9e037ab0e..093c17643 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.338 2006/03/15 21:14:34 dtucker Exp $
+# $Id: configure.ac,v 1.339 2006/04/22 11:26:08 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
-AC_REVISION($Revision: 1.338 $)
+AC_REVISION($Revision: 1.339 $)
 AC_CONFIG_SRCDIR([ssh.c])
 
 AC_CONFIG_HEADER(config.h)
@@ -3000,6 +3000,23 @@ int main()
                         [#include <arpa/nameser.h>])
         ])
 
+# Check whether user wants SELinux support
+SELINUX_MSG="no"
+LIBSELINUX=""
+AC_ARG_WITH(selinux,
+        [  --with-selinux   Enable SELinux support],
+        [ if test "x$withval" != "xno" ; then
+                AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
+                SELINUX_MSG="yes"
+                AC_CHECK_HEADER([selinux/selinux.h], ,
+                    AC_MSG_ERROR(SELinux support requires selinux.h header))
+                AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
+                    AC_MSG_ERROR(SELinux support requires libselinux library))
+                AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
+        fi ]
+)
+AC_SUBST(LIBSELINUX)
+
 # Check whether user wants Kerberos 5 support
 KRB5_MSG="no"
 AC_ARG_WITH(kerberos5,
@@ -3818,6 +3835,7 @@ fi
 echo "                    Manpage format: $MANTYPE"
 echo "                       PAM support: $PAM_MSG"
 echo "                 KerberosV support: $KRB5_MSG"
+echo "                   SELinux support: $SELINUX_MSG"
 echo "                 Smartcard support: $SCARD_MSG"
 echo "                     S/KEY support: $SKEY_MSG"
 echo "              TCP Wrappers support: $TCPW_MSG"
diff --git a/contrib/redhat/sshd.init b/contrib/redhat/sshd.init
index 4ee8630c3..e5d837cbc 100755
--- a/contrib/redhat/sshd.init
+++ b/contrib/redhat/sshd.init
@@ -35,6 +35,9 @@ do_rsa1_keygen() {
                 if $KEYGEN -q -t rsa1 -f $RSA1_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA1_KEY
                         chmod 644 $RSA1_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA1_KEY.pub
+                        fi
                         success $"RSA1 key generation"
                         echo
                 else
@@ -51,6 +54,9 @@ do_rsa_keygen() {
                 if $KEYGEN -q -t rsa -f $RSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $RSA_KEY
                         chmod 644 $RSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $RSA_KEY.pub
+                        fi
                         success $"RSA key generation"
                         echo
                 else
@@ -67,6 +73,9 @@ do_dsa_keygen() {
                 if $KEYGEN -q -t dsa -f $DSA_KEY -C '' -N '' >&/dev/null; then
                         chmod 600 $DSA_KEY
                         chmod 644 $DSA_KEY.pub
+                        if [ -x /sbin/restorecon ]; then
+                            /sbin/restorecon $DSA_KEY.pub
+                        fi
                         success $"DSA key generation"
                         echo
                 else
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
index f1a706241..67e521bfe 100644
--- a/openbsd-compat/Makefile.in
+++ b/openbsd-compat/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.38 2006/03/15 02:09:20 djm Exp $
+# $Id: Makefile.in,v 1.39 2006/04/22 11:26:08 djm Exp $
 
 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgroupl
 
 COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
 
-PORTS=port-irix.o port-aix.o port-uw.o port-tun.o
+PORTS=port-irix.o port-linux.o port-aix.o port-uw.o port-tun.o
 
 .c.o:
         $(CC) $(CFLAGS) $(CPPFLAGS) -c $<
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h
index 432b183e7..eda9c49eb 100644
--- a/openbsd-compat/openbsd-compat.h
+++ b/openbsd-compat/openbsd-compat.h
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.35 2006/03/15 11:25:55 dtucker Exp $ */
+/* $Id: openbsd-compat.h,v 1.36 2006/04/22 11:26:08 djm Exp $ */
 
 /*
  * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -185,6 +185,7 @@ char *shadow_pw(struct passwd *pw);
 #include "bsd-cray.h"
 #include "bsd-cygwin_util.h"
 #include "port-irix.h"
+#include "port-linux.h"
 #include "port-aix.h"
 #include "port-uw.h"
 #include "port-tun.h"
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
new file mode 100644
index 000000000..54ec2910e
--- /dev/null
+++ b/openbsd-compat/port-linux.c
@@ -0,0 +1,165 @@
+/* $Id: port-linux.c,v 1.1 2006/04/22 11:26:08 djm Exp $ */
+
+/*
+ * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
+ * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Linux-specific portability code - just SELinux support at present
+ */
+
+#include "includes.h"
+
+#ifdef WITH_SELINUX
+#include "log.h"
+#include "port-linux.h"
+
+#include <selinux/selinux.h>
+#include <selinux/flask.h>
+#include <selinux/get_context_list.h>
+
+/* Wrapper around is_selinux_enabled() to log its return value once only */
+static int
+ssh_selinux_enabled(void)
+{
+        static int enabled = -1;
+
+        if (enabled == -1) {
+                enabled = is_selinux_enabled();
+                debug("SELinux support %s", enabled ? "enabled" : "disabled");
+        }
+
+        return (enabled);
+}
+
+/* Return the default security context for the given username */
+static security_context_t
+ssh_selinux_getctxbyname(char *pwname)
+{
+        security_context_t sc;
+        char *sename = NULL, *lvl = NULL;
+        int r;
+
+#ifdef HAVE_GETSEUSERBYNAME
+        if (getseuserbyname(pwname, &sename, &lvl) != 0)
+                return NULL;
+#else
+        sename = pwname;
+        lvl = NULL;
+#endif
+
+#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL
+        r = get_default_context_with_level(sename, lvl, NULL, &sc);
+#else
+        r = get_default_context(sename, NULL, &sc);
+#endif
+
+        if (r != 0) {
+                switch (security_getenforce()) {
+                case -1:
+                        fatal("%s: ssh_selinux_getctxbyname: "
+                            "security_getenforce() failed", __func__);
+                case 0:
+                        error("%s: Failed to get default SELinux security "
+                            "context for %s", __func__, pwname);
+                default:
+                        fatal("%s: Failed to get default SELinux security "
+                            "context for %s (in enforcing mode)",
+                            __func__, pwname);
+                }
+        }
+
+#ifdef HAVE_GETSEUSERBYNAME
+        if (sename != NULL)
+                xfree(sename);
+        if (lvl != NULL)
+                xfree(lvl);
+#endif
+
+        return (sc);
+}
+
+/* Set the execution context to the default for the specified user */
+void
+ssh_selinux_setup_exec_context(char *pwname)
+{
+        security_context_t user_ctx = NULL;
+
+        if (!ssh_selinux_enabled())
+                return;
+
+        debug3("%s: setting execution context", __func__);
+
+        user_ctx = ssh_selinux_getctxbyname(pwname);
+        if (setexeccon(user_ctx) != 0) {
+                switch (security_getenforce()) {
+                case -1:
+                        fatal("%s: security_getenforce() failed", __func__);
+                case 0:
+                        error("%s: Failed to set SELinux execution "
+                            "context for %s", __func__, pwname);
+                default:
+                        fatal("%s: Failed to set SELinux execution context "
+                            "for %s (in enforcing mode)", __func__, pwname);
+                }
+        }
+        if (user_ctx != NULL)
+                freecon(user_ctx);
+
+        debug3("%s: done", __func__);
+}
+
+/* Set the TTY context for the specified user */
+void
+ssh_selinux_setup_pty(char *pwname, const char *tty)
+{
+        security_context_t new_tty_ctx = NULL;
+        security_context_t user_ctx = NULL;
+        security_context_t old_tty_ctx = NULL;
+
+        if (!ssh_selinux_enabled())
+                return;
+
+        debug3("%s: setting TTY context on %s", __func__, tty);
+
+        user_ctx = ssh_selinux_getctxbyname(pwname);
+
+        /* XXX: should these calls fatal() upon failure in enforcing mode? */
+
+        if (getfilecon(tty, &old_tty_ctx) == -1) {
+                error("%s: getfilecon: %s", __func__, strerror(errno));
+                goto out;
+        }
+
+        if (security_compute_relabel(user_ctx, old_tty_ctx,
+            SECCLASS_CHR_FILE, &new_tty_ctx) != 0) {
+                error("%s: security_compute_relabel: %s",
+                    __func__, strerror(errno));
+                goto out;
+        }
+
+        if (setfilecon(tty, new_tty_ctx) != 0)
+                error("%s: setfilecon: %s", __func__, strerror(errno));
+ out:
+        if (new_tty_ctx != NULL)
+                freecon(new_tty_ctx);
+        if (old_tty_ctx != NULL)
+                freecon(old_tty_ctx);
+        if (user_ctx != NULL)
+                freecon(user_ctx);
+        debug3("%s: done", __func__);
+}
+#endif /* WITH_SELINUX */
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
new file mode 100644
index 000000000..05e520e1c
--- /dev/null
+++ b/openbsd-compat/port-linux.h
@@ -0,0 +1,27 @@
+/* $Id: port-linux.h,v 1.1 2006/04/22 11:26:08 djm Exp $ */
+
+/*
+ * Copyright (c) 2006 Damien Miller <djm@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PORT_LINUX_H
+#define _PORT_LINUX_H
+
+#ifdef WITH_SELINUX
+void ssh_selinux_setup_pty(char *, const char *);
+void ssh_selinux_setup_exec_context(char *);
+#endif
+
+#endif /* ! _PORT_LINUX_H */
diff --git a/session.c b/session.c
index 8b837d07d..bba3fa21f 100644
--- a/session.c
+++ b/session.c
@@ -1352,6 +1352,10 @@ do_setusercontext(struct passwd *pw)
 #endif
         if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
                 fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
+
+#ifdef WITH_SELINUX
+        ssh_selinux_setup_exec_context(pw->pw_name);
+#endif
 }
 
 static void
diff --git a/sshpty.c b/sshpty.c
index a15df0414..0e49e9a16 100644
--- a/sshpty.c
+++ b/sshpty.c
@@ -210,6 +210,10 @@ pty_setowner(struct passwd *pw, const char *tty)
                 fatal("stat(%.100s) failed: %.100s", tty,
                     strerror(errno));
 
+#ifdef WITH_SELINUX
+        ssh_selinux_setup_pty(pw->pw_name, tty);
+#endif
+
         if (st.st_uid != pw->pw_uid || st.st_gid != gid) {
                 if (chown(tty, pw->pw_uid, gid) < 0) {
                         if (errno == EROFS &&