diff options
Diffstat (limited to 'openbsd-compat/port-linux.c')
-rw-r--r-- | openbsd-compat/port-linux.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index 2f697e7d9..485929133 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c | |||
@@ -28,13 +28,21 @@ | |||
28 | #include <string.h> | 28 | #include <string.h> |
29 | 29 | ||
30 | #ifdef WITH_SELINUX | 30 | #ifdef WITH_SELINUX |
31 | #include "key.h" | ||
32 | #include "hostfile.h" | ||
33 | #include "auth.h" | ||
31 | #include "log.h" | 34 | #include "log.h" |
35 | #ifdef HAVE_GETSEUSERBYNAME | ||
36 | #include "xmalloc.h" | ||
37 | #endif | ||
32 | #include "port-linux.h" | 38 | #include "port-linux.h" |
33 | 39 | ||
34 | #include <selinux/selinux.h> | 40 | #include <selinux/selinux.h> |
35 | #include <selinux/flask.h> | 41 | #include <selinux/flask.h> |
36 | #include <selinux/get_context_list.h> | 42 | #include <selinux/get_context_list.h> |
37 | 43 | ||
44 | extern Authctxt *the_authctxt; | ||
45 | |||
38 | /* Wrapper around is_selinux_enabled() to log its return value once only */ | 46 | /* Wrapper around is_selinux_enabled() to log its return value once only */ |
39 | static int | 47 | static int |
40 | ssh_selinux_enabled(void) | 48 | ssh_selinux_enabled(void) |
@@ -54,7 +62,7 @@ static security_context_t | |||
54 | ssh_selinux_getctxbyname(char *pwname) | 62 | ssh_selinux_getctxbyname(char *pwname) |
55 | { | 63 | { |
56 | security_context_t sc; | 64 | security_context_t sc; |
57 | char *sename = NULL, *lvl = NULL; | 65 | char *sename = NULL, *role = NULL, *lvl = NULL; |
58 | int r; | 66 | int r; |
59 | 67 | ||
60 | #ifdef HAVE_GETSEUSERBYNAME | 68 | #ifdef HAVE_GETSEUSERBYNAME |
@@ -64,11 +72,20 @@ ssh_selinux_getctxbyname(char *pwname) | |||
64 | sename = pwname; | 72 | sename = pwname; |
65 | lvl = NULL; | 73 | lvl = NULL; |
66 | #endif | 74 | #endif |
75 | if (the_authctxt) | ||
76 | role = the_authctxt->role; | ||
67 | 77 | ||
68 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL | 78 | #ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL |
69 | r = get_default_context_with_level(sename, lvl, NULL, &sc); | 79 | if (role != NULL && role[0]) |
80 | r = get_default_context_with_rolelevel(sename, role, lvl, NULL, | ||
81 | &sc); | ||
82 | else | ||
83 | r = get_default_context_with_level(sename, lvl, NULL, &sc); | ||
70 | #else | 84 | #else |
71 | r = get_default_context(sename, NULL, &sc); | 85 | if (role != NULL && role[0]) |
86 | r = get_default_context_with_role(sename, role, NULL, &sc); | ||
87 | else | ||
88 | r = get_default_context(sename, NULL, &sc); | ||
72 | #endif | 89 | #endif |
73 | 90 | ||
74 | if (r != 0) { | 91 | if (r != 0) { |