|
 |
ce94dae |
diff -up openssh-5.2p1/openbsd-compat/port-linux.c.sesftp openssh-5.2p1/openbsd-compat/port-linux.c
|
|
|
ce94dae |
--- openssh-5.2p1/openbsd-compat/port-linux.c.sesftp 2009-08-12 00:29:37.712368892 +0200
|
|
|
ce94dae |
+++ openssh-5.2p1/openbsd-compat/port-linux.c 2009-08-12 00:29:37.732544890 +0200
|
|
|
ce94dae |
@@ -469,4 +469,36 @@ ssh_selinux_setup_pty(char *pwname, cons
|
|
|
ce94dae |
freecon(user_ctx);
|
|
|
ce94dae |
debug3("%s: done", __func__);
|
|
|
ce94dae |
}
|
|
|
ce94dae |
+
|
|
|
ce94dae |
+void
|
|
|
ce94dae |
+ssh_selinux_change_context(const char *newname)
|
|
|
ce94dae |
+{
|
|
|
ce94dae |
+ int len, newlen;
|
|
|
ce94dae |
+ char *oldctx, *newctx, *cx;
|
|
|
ce94dae |
+
|
|
|
ce94dae |
+ if (!ssh_selinux_enabled())
|
|
|
ce94dae |
+ return;
|
|
|
ce94dae |
+
|
|
|
ce94dae |
+ if (getcon((security_context_t *)&oldctx) < 0) {
|
|
|
ce94dae |
+ logit("%s: getcon failed with %s", __func__, strerror (errno));
|
|
|
ce94dae |
+ return;
|
|
|
ce94dae |
+ }
|
|
|
ce94dae |
+ if ((cx = index(oldctx, ':')) == NULL || (cx = index(cx + 1, ':')) == NULL) {
|
|
|
ce94dae |
+ logit ("%s: unparseable context %s", __func__, oldctx);
|
|
|
ce94dae |
+ return;
|
|
|
ce94dae |
+ }
|
|
|
ce94dae |
+
|
|
|
ce94dae |
+ newlen = strlen(oldctx) + strlen(newname) + 1;
|
|
|
ce94dae |
+ newctx = xmalloc(newlen);
|
|
|
ce94dae |
+ len = cx - oldctx + 1;
|
|
|
ce94dae |
+ memcpy(newctx, oldctx, len);
|
|
|
ce94dae |
+ strlcpy(newctx + len, newname, newlen - len);
|
|
|
ce94dae |
+ if ((cx = index(cx + 1, ':')))
|
|
|
ce94dae |
+ strlcat(newctx, cx, newlen);
|
|
|
ce94dae |
+ debug3("%s: setting context from '%s' to '%s'", __func__, oldctx, newctx);
|
|
|
ce94dae |
+ if (setcon(newctx) < 0)
|
|
|
ce94dae |
+ logit("%s: setcon failed with %s", __func__, strerror (errno));
|
|
|
ce94dae |
+ xfree(oldctx);
|
|
|
ce94dae |
+ xfree(newctx);
|
|
|
ce94dae |
+}
|
|
|
ce94dae |
#endif /* WITH_SELINUX */
|
|
|
ce94dae |
diff -up openssh-5.2p1/openbsd-compat/port-linux.h.sesftp openssh-5.2p1/openbsd-compat/port-linux.h
|
|
|
ce94dae |
--- openssh-5.2p1/openbsd-compat/port-linux.h.sesftp 2008-03-26 21:27:21.000000000 +0100
|
|
|
ce94dae |
+++ openssh-5.2p1/openbsd-compat/port-linux.h 2009-08-12 00:29:37.733388083 +0200
|
|
|
ce94dae |
@@ -23,6 +23,7 @@
|
|
|
ce94dae |
int ssh_selinux_enabled(void);
|
|
|
ce94dae |
void ssh_selinux_setup_pty(char *, const char *);
|
|
|
ce94dae |
void ssh_selinux_setup_exec_context(char *);
|
|
|
ce94dae |
+void ssh_selinux_change_context(const char *);
|
|
|
ce94dae |
#endif
|
|
|
3d6b00a |
|
|
|
ce94dae |
#endif /* ! _PORT_LINUX_H */
|
|
|
ce94dae |
diff -up openssh-5.2p1/session.c.sesftp openssh-5.2p1/session.c
|
|
|
ce94dae |
--- openssh-5.2p1/session.c.sesftp 2009-08-12 00:29:37.659250161 +0200
|
|
|
ce94dae |
+++ openssh-5.2p1/session.c 2009-08-12 00:29:37.729578695 +0200
|
|
|
ce94dae |
@@ -1798,6 +1798,9 @@ do_child(Session *s, const char *command
|
|
|
3d6b00a |
argv[i] = NULL;
|
|
|
3d6b00a |
optind = optreset = 1;
|
|
|
3d6b00a |
__progname = argv[0];
|
|
|
56bb420 |
+#ifdef WITH_SELINUX
|
|
|
ce94dae |
+ ssh_selinux_change_context("sftpd_t");
|
|
|
56bb420 |
+#endif
|
|
|
3d6b00a |
exit(sftp_server_main(i, argv, s->pw));
|
|
|
3d6b00a |
}
|
|
|
3d6b00a |
|