6 files changed, 27 insertions, 2 deletions

diff --git a/debian/changelog b/debian/changelog
index 671a44922..aae858b96 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,17 @@ openssh (1:4.1p1-4) UNRELEASED; urgency=low
 
   * openssh-client and openssh-server conflict with ssh-krb5, as ssh-krb5
     only conflicts with ssh (closes: #312475).
+  * Manoj Srivastava:
+    - Added SELinux capability, and turned it on be default. Added
+      restorecon calls in preinst and postinst (should not matter if the
+      machine is not SELinux aware). By and large, the changes made should
+      have no effect unless the rules file calls --with-selinux; and even
+      then there should be no performance hit for machines not actively
+      running SELinux.
+    - Modified the preinst and postinst to call restorecon to set the
+      security context for the generated public key files.
+    - Added a comment to /etc/pam.d/ssh to indicate that an SELinux system
+      may want to also include pam_selinux.so.
   * debconf template translations:
     - Update German (thanks, Jens Seidel; closes: #313949).
 
diff --git a/debian/control b/debian/control
index 4e7cfd1b1..de945cf9c 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: openssh
 Section: net
 Priority: standard
 Maintainer: Matthew Vernon <matthew@debian.org>
-Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev | libz-dev, libssl-dev, libpam0g-dev | libpam-dev, libgnomeui-dev (>= 2.0.0) [!hurd-i386] | libgnome-dev [!hurd-i386], libedit-dev, groff, debhelper (>= 2), sharutils [!hurd-i386]
+Build-Depends: libwrap0-dev | libwrap-dev, zlib1g-dev | libz-dev, libssl-dev, libpam0g-dev | libpam-dev, libgnomeui-dev (>= 2.0.0) [!hurd-i386] | libgnome-dev [!hurd-i386], libedit-dev, groff, debhelper (>= 2), sharutils [!hurd-i386], libselinux1-dev [alpha amd64 arm hppa i386 ia64 m68k mips mipsel powerpc s390 sparc]
 Standards-Version: 3.6.1
 Uploaders: Colin Watson <cjwatson@debian.org>
 
diff --git a/debian/openssh-server.postinst b/debian/openssh-server.postinst
index 9beb373b7..e6fe65ffa 100644
--- a/debian/openssh-server.postinst
+++ b/debian/openssh-server.postinst
@@ -94,6 +94,9 @@ create_key() {
                 echo -n $msg
                 ssh-keygen -q -f "$file" -N '' "$@"
                 echo
+                if type restorecon >/dev/null 2>&1; then
+                        restorecon "$file.pub"
+                fi
         fi
 }
 
diff --git a/debian/openssh-server.preinst b/debian/openssh-server.preinst
index 320d4df2a..1ae85c7e8 100644
--- a/debian/openssh-server.preinst
+++ b/debian/openssh-server.preinst
@@ -72,6 +72,9 @@ EOF
       # case the key is encrypted, which we need to fix
       chmod 600 $key
       ssh-keygen -u -f $key >/dev/null
+      if type restorecon >/dev/null 2>&1; then
+        restorecon "$key.pub"
+      fi
     }
   fi
 fi
diff --git a/debian/openssh-server.ssh.pam b/debian/openssh-server.ssh.pam
index 1332a267e..ce33b9347 100644
--- a/debian/openssh-server.ssh.pam
+++ b/debian/openssh-server.ssh.pam
@@ -22,5 +22,8 @@ session    optional     pam_mail.so standard noenv # [1]
 # Set up user limits from /etc/security/limits.conf.
 session    required     pam_limits.so
 
+# Set up SELinux capabilities (need modified pam)
+# session  required     pam_selinux.so multiple
+
 # Standard Un*x password updating.
 @include common-password
diff --git a/debian/rules b/debian/rules
index 452b7fdbf..772d08f84 100755
--- a/debian/rules
+++ b/debian/rules
@@ -57,6 +57,11 @@ ifeq ($(DEB_HOST_ARCH_OS),hurd)
 FORCE_LIBS := LIBS=-lcrypt
 endif
 
+# SELinux support?
+ifeq ($(DEB_HOST_ARCH_OS),linux)
+SELINUX := --with-selinux
+endif
+
 # Change the version string to include the Debian version
 SSH_EXTRAVERSION := Debian-$(shell dpkg-parsechangelog | sed -n -e '/^Version:/s/Version: //p' | sed -e 's/[^-]*-//')
 
@@ -66,7 +71,7 @@ build-deb: build-deb-stamp
 build-deb-stamp:
         dh_testdir
         mkdir -p build-deb
-        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit
+        cd build-deb && $(FORCE_LIBS) ../configure --prefix=/usr --sysconfdir=/etc/ssh --libexecdir=/usr/lib/openssh --mandir=/usr/share/man --with-tcp-wrappers --with-xauth=/usr/bin/X11/xauth --with-default-path=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin --with-superuser-path=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin --with-pam --with-4in6 --with-privsep-path=/var/run/sshd --without-rand-helper --with-libedit $(SELINUX)
 
 ifeq ($(DEB_HOST_ARCH_OS),linux)
         # Some 2.2 kernels have trouble with setres[ug]id() (bug #239999).