3cd489
diff -up openssh/auth.c.keycat openssh/misc.c
3cd489
--- openssh/auth.c.keycat	2015-06-24 10:57:50.158849606 +0200
3cd489
+++ openssh/auth.c	2015-06-24 11:04:23.989868638 +0200
3cd489
@@ -966,6 +966,14 @@ subprocess(const char *tag, struct passw
535d34
 			_exit(1);
535d34
 		}
535d34
 
535d34
+#ifdef WITH_SELINUX
535d34
+		if (sshd_selinux_setup_env_variables() < 0) {
535d34
+			error ("failed to copy environment:  %s",
535d34
+			    strerror(errno));
535d34
+			_exit(127);
535d34
+		}
535d34
+#endif
535d34
+
535d34
 		execve(av[0], av, child_env);
535d34
 		error("%s exec \"%s\": %s", tag, command, strerror(errno));
535d34
 		_exit(127);
535d34
diff -up openssh/HOWTO.ssh-keycat.keycat openssh/HOWTO.ssh-keycat
535d34
--- openssh/HOWTO.ssh-keycat.keycat	2015-06-24 10:57:50.157849608 +0200
535d34
+++ openssh/HOWTO.ssh-keycat	2015-06-24 10:57:50.157849608 +0200
Jan F. Chadima 69dd72
@@ -0,0 +1,12 @@
Jan F. Chadima 69dd72
+The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
Jan F. Chadima 69dd72
+of an user in any environment. This includes environments with
Jan F. Chadima 69dd72
+polyinstantiation of home directories and SELinux MLS policy enabled.
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+To use ssh-keycat, set these options in /etc/ssh/sshd_config file:
Jan F. Chadima 69dd72
+        AuthorizedKeysCommand /usr/libexec/openssh/ssh-keycat
8f439b
+        AuthorizedKeysCommandUser root
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+Do not forget to enable public key authentication:
Jan F. Chadima 69dd72
+        PubkeyAuthentication yes
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+
535d34
diff -up openssh/Makefile.in.keycat openssh/Makefile.in
535d34
--- openssh/Makefile.in.keycat	2015-06-24 10:57:50.152849621 +0200
535d34
+++ openssh/Makefile.in	2015-06-24 10:57:50.157849608 +0200
Jan F. Chadima 69dd72
@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
Jan F. Chadima 69dd72
 SSH_KEYSIGN=$(libexecdir)/ssh-keysign
Jan F. Chadima 69dd72
 SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
Jan F. Chadima 69dd72
 SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
Jan F. Chadima 69dd72
+SSH_KEYCAT=$(libexecdir)/ssh-keycat
Jan F. Chadima 69dd72
 SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
Jan F. Chadima 69dd72
 PRIVSEP_PATH=@PRIVSEP_PATH@
Jan F. Chadima 69dd72
 SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
334feb
@@ -52,6 +52,7 @@ K5LIBS=@K5LIBS@
334feb
 GSSLIBS=@GSSLIBS@
334feb
 SSHLIBS=@SSHLIBS@
334feb
 SSHDLIBS=@SSHDLIBS@
334feb
+KEYCATLIBS=@KEYCATLIBS@
334feb
 LIBEDIT=@LIBEDIT@
334feb
 AR=@AR@
334feb
 AWK=@AWK@
190035
@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
3cd489
 MKDIR_P=@MKDIR_P@
Jan F. Chadima 69dd72
 INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
132f8f
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
Jan F. Chadima 69dd72
 
3cd489
 XMSS_OBJS=\
3cd489
 	ssh-xmss.o \
132f8f
@@ -190,6 +191,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
4cf8f1
 ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
e3f4c1
 	$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lfipscheck $(LIBS) $(LDAPLIBS)
Jan F. Chadima 69dd72
 
bbf61d
+ssh-keycat$(EXEEXT): $(LIBCOMPAT) $(SSHDOBJS) libssh.a ssh-keycat.o uidswap.o
bbf61d
+	$(LD) -o $@ ssh-keycat.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(KEYCATLIBS) $(LIBS)
Jan F. Chadima 69dd72
+
13073f
 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
13073f
 	$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
Jan F. Chadima 69dd72
 
132f8f
@@ -321,6 +325,7 @@ install-files:
Jan F. Chadima 69dd72
 		$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
Jan F. Chadima 69dd72
 		$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
Jan F. Chadima 69dd72
 	fi
Jan F. Chadima 69dd72
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
Jan F. Chadima 69dd72
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
Jan F. Chadima 69dd72
 	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
Jan F. Chadima 69dd72
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
535d34
diff -up openssh/openbsd-compat/port-linux.h.keycat openssh/openbsd-compat/port-linux.h
535d34
--- openssh/openbsd-compat/port-linux.h.keycat	2015-06-24 10:57:50.150849626 +0200
535d34
+++ openssh/openbsd-compat/port-linux.h	2015-06-24 10:57:50.160849601 +0200
535d34
@@ -25,8 +25,10 @@ void ssh_selinux_setup_pty(char *, const
535d34
 void ssh_selinux_change_context(const char *);
535d34
 void ssh_selinux_setfscreatecon(const char *);
84822b
 
535d34
+int sshd_selinux_enabled(void);
535d34
 void sshd_selinux_copy_context(void);
535d34
 void sshd_selinux_setup_exec_context(char *);
535d34
+int sshd_selinux_setup_env_variables(void);
535d34
 #endif
84822b
 
535d34
 #ifdef LINUX_OOM_ADJUST
535d34
diff -up openssh/openbsd-compat/port-linux-sshd.c.keycat openssh/openbsd-compat/port-linux-sshd.c
535d34
--- openssh/openbsd-compat/port-linux-sshd.c.keycat	2015-06-24 10:57:50.150849626 +0200
535d34
+++ openssh/openbsd-compat/port-linux-sshd.c	2015-06-24 10:57:50.159849603 +0200
190035
@@ -54,6 +54,20 @@ extern Authctxt *the_authctxt;
94c6f8
 extern int inetd_flag;
94c6f8
 extern int rexeced_flag;
94c6f8
 
94c6f8
+/* Wrapper around is_selinux_enabled() to log its return value once only */
94c6f8
+int
94c6f8
+sshd_selinux_enabled(void)
94c6f8
+{
94c6f8
+	static int enabled = -1;
94c6f8
+
94c6f8
+	if (enabled == -1) {
94c6f8
+		enabled = (is_selinux_enabled() == 1);
94c6f8
+		debug("SELinux support %s", enabled ? "enabled" : "disabled");
94c6f8
+	}
94c6f8
+
94c6f8
+	return (enabled);
94c6f8
+}
94c6f8
+
94c6f8
 /* Send audit message */
94c6f8
 static int
94c6f8
 sshd_selinux_send_audit_message(int success, security_context_t default_context,
190035
@@ -308,7 +322,7 @@ sshd_selinux_getctxbyname(char *pwname,
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 /* Setup environment variables for pam_selinux */
Jan F. Chadima 69dd72
 static int
94c6f8
-sshd_selinux_setup_pam_variables(void)
94c6f8
+sshd_selinux_setup_variables(int(*set_it)(char *, const char *))
Jan F. Chadima 69dd72
 {
Jan F. Chadima 69dd72
 	const char *reqlvl;
Jan F. Chadima 69dd72
 	char *role;
190035
@@ -319,16 +333,16 @@ sshd_selinux_setup_pam_variables(void)
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 	ssh_selinux_get_role_level(&role, &reqlvl);
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
-	rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : "");
Jan F. Chadima 69dd72
+	rv = set_it("SELINUX_ROLE_REQUESTED", role ? role : "");
84822b
 
Jan F. Chadima 69dd72
 	if (inetd_flag && !rexeced_flag) {
Jan F. Chadima 69dd72
 		use_current = "1";
Jan F. Chadima 69dd72
 	} else {
Jan F. Chadima 69dd72
 		use_current = "";
Jan F. Chadima 69dd72
-		rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
Jan F. Chadima 69dd72
+		rv = rv || set_it("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: "");
Jan F. Chadima 69dd72
 	}
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
-	rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current);
Jan F. Chadima 69dd72
+	rv = rv || set_it("SELINUX_USE_CURRENT_RANGE", use_current);
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
 	if (role != NULL)
84822b
 		free(role);
190035
@@ -336,6 +350,24 @@ sshd_selinux_setup_pam_variables(void)
Jan F. Chadima 69dd72
 	return rv;
Jan F. Chadima 69dd72
 }
Jan F. Chadima 69dd72
 
Jan F. Chadima 69dd72
+static int
94c6f8
+sshd_selinux_setup_pam_variables(void)
Jan F. Chadima 69dd72
+{
94c6f8
+	return sshd_selinux_setup_variables(do_pam_putenv);
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+static int
94c6f8
+do_setenv(char *name, const char *value)
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	return setenv(name, value, 1);
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+int
94c6f8
+sshd_selinux_setup_env_variables(void)
Jan F. Chadima 69dd72
+{
94c6f8
+	return sshd_selinux_setup_variables(do_setenv);
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
 /* Set the execution context to the default for the specified user */
Jan F. Chadima 69dd72
 void
94c6f8
 sshd_selinux_setup_exec_context(char *pwname)
132f8f
@@ -344,7 +376,7 @@ sshd_selinux_setup_exec_context(char *pw
94c6f8
 	int r = 0;
94c6f8
 	security_context_t default_ctx = NULL;
94c6f8
 
94c6f8
-	if (!ssh_selinux_enabled())
94c6f8
+	if (!sshd_selinux_enabled())
94c6f8
 		return;
94c6f8
 
94c6f8
 	if (options.use_pam) {
190035
@@ -415,7 +447,7 @@ sshd_selinux_copy_context(void)
94c6f8
 {
94c6f8
 	security_context_t *ctx;
94c6f8
 
94c6f8
-	if (!ssh_selinux_enabled())
94c6f8
+	if (!sshd_selinux_enabled())
94c6f8
 		return;
94c6f8
 
94c6f8
 	if (getexeccon((security_context_t *)&ctx) != 0) {
535d34
diff -up openssh/platform.c.keycat openssh/platform.c
535d34
--- openssh/platform.c.keycat	2015-06-24 10:57:50.147849633 +0200
535d34
+++ openssh/platform.c	2015-06-24 10:57:50.160849601 +0200
132f8f
@@ -103,7 +103,7 @@ platform_setusercontext(struct passwd *p
94c6f8
 {
94c6f8
 #ifdef WITH_SELINUX
94c6f8
 	/* Cache selinux status for later use */
94c6f8
-	(void)ssh_selinux_enabled();
94c6f8
+	(void)sshd_selinux_enabled();
94c6f8
 #endif
94c6f8
 
94c6f8
 #ifdef USE_SOLARIS_PROJECTS
535d34
diff -up openssh/ssh-keycat.c.keycat openssh/ssh-keycat.c
535d34
--- openssh/ssh-keycat.c.keycat	2015-06-24 10:57:50.161849599 +0200
535d34
+++ openssh/ssh-keycat.c	2015-06-24 10:57:50.161849599 +0200
3cd489
@@ -0,0 +1,241 @@
Jan F. Chadima 69dd72
+/*
Jan F. Chadima 69dd72
+ * Redistribution and use in source and binary forms, with or without
Jan F. Chadima 69dd72
+ * modification, are permitted provided that the following conditions
Jan F. Chadima 69dd72
+ * are met:
Jan F. Chadima 69dd72
+ * 1. Redistributions of source code must retain the above copyright
Jan F. Chadima 69dd72
+ *    notice, and the entire permission notice in its entirety,
Jan F. Chadima 69dd72
+ *    including the disclaimer of warranties.
Jan F. Chadima 69dd72
+ * 2. Redistributions in binary form must reproduce the above copyright
Jan F. Chadima 69dd72
+ *    notice, this list of conditions and the following disclaimer in the
Jan F. Chadima 69dd72
+ *    documentation and/or other materials provided with the distribution.
Jan F. Chadima 69dd72
+ * 3. The name of the author may not be used to endorse or promote
Jan F. Chadima 69dd72
+ *    products derived from this software without specific prior
Jan F. Chadima 69dd72
+ *    written permission.
Jan F. Chadima 69dd72
+ *
Jan F. Chadima 69dd72
+ * ALTERNATIVELY, this product may be distributed under the terms of
Jan F. Chadima 69dd72
+ * the GNU Public License, in which case the provisions of the GPL are
Jan F. Chadima 69dd72
+ * required INSTEAD OF the above restrictions.  (This clause is
Jan F. Chadima 69dd72
+ * necessary due to a potential bad interaction between the GPL and
Jan F. Chadima 69dd72
+ * the restrictions contained in a BSD-style copyright.)
Jan F. Chadima 69dd72
+ *
Jan F. Chadima 69dd72
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
Jan F. Chadima 69dd72
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
Jan F. Chadima 69dd72
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
Jan F. Chadima 69dd72
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
Jan F. Chadima 69dd72
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
Jan F. Chadima 69dd72
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
Jan F. Chadima 69dd72
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
Jan F. Chadima 69dd72
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
Jan F. Chadima 69dd72
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
Jan F. Chadima 69dd72
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
Jan F. Chadima 69dd72
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
Jan F. Chadima 69dd72
+ */
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+/*
Jan F. Chadima 69dd72
+ * Copyright (c) 2011 Red Hat, Inc.
Jan F. Chadima 69dd72
+ * Written by Tomas Mraz <tmraz@redhat.com>
Jan F. Chadima 69dd72
+*/
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+#define _GNU_SOURCE
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+#include "config.h"
Jan F. Chadima 69dd72
+#include <stdio.h>
Jan F. Chadima 69dd72
+#include <stdlib.h>
Jan F. Chadima 69dd72
+#include <string.h>
Jan F. Chadima 69dd72
+#include <sys/types.h>
Jan F. Chadima 69dd72
+#include <sys/stat.h>
Jan F. Chadima 69dd72
+#include <pwd.h>
Jan F. Chadima 69dd72
+#include <fcntl.h>
Jan F. Chadima 69dd72
+#include <unistd.h>
3cd489
+#ifdef HAVE_STDINT_H
3cd489
+#include <stdint.h>
3cd489
+#endif
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+#include <security/pam_appl.h>
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+#include "uidswap.h"
Jan F. Chadima 69dd72
+#include "misc.h"
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+#define ERR_USAGE 1
Jan F. Chadima 69dd72
+#define ERR_PAM_START 2
Jan F. Chadima 69dd72
+#define ERR_OPEN_SESSION 3
Jan F. Chadima 69dd72
+#define ERR_CLOSE_SESSION 4
Jan F. Chadima 69dd72
+#define ERR_PAM_END 5
Jan F. Chadima 69dd72
+#define ERR_GETPWNAM 6
Jan F. Chadima 69dd72
+#define ERR_MEMORY 7
Jan F. Chadima 69dd72
+#define ERR_OPEN 8
Jan F. Chadima 69dd72
+#define ERR_FILE_MODE 9
Jan F. Chadima 69dd72
+#define ERR_FDOPEN 10
Jan F. Chadima 69dd72
+#define ERR_STAT 11
Jan F. Chadima 69dd72
+#define ERR_WRITE 12
Jan F. Chadima 69dd72
+#define ERR_PAM_PUTENV 13
Jan F. Chadima 69dd72
+#define BUFLEN 4096
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+/* Just ignore the messages in the conversation function */
Jan F. Chadima 69dd72
+static int
Jan F. Chadima 69dd72
+dummy_conv(int num_msg, const struct pam_message **msgm,
Jan F. Chadima 69dd72
+	   struct pam_response **response, void *appdata_ptr)
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	struct pam_response *rsp;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	(void)msgm;
Jan F. Chadima 69dd72
+	(void)appdata_ptr;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if (num_msg <= 0)
Jan F. Chadima 69dd72
+		return PAM_CONV_ERR;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	/* Just allocate the array as empty responses */
Jan F. Chadima 69dd72
+	rsp = calloc (num_msg, sizeof (struct pam_response));
Jan F. Chadima 69dd72
+	if (rsp == NULL)
Jan F. Chadima 69dd72
+		return PAM_CONV_ERR;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	*response = rsp;
Jan F. Chadima 69dd72
+	return PAM_SUCCESS;
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+static struct pam_conv conv = {
Jan F. Chadima 69dd72
+	dummy_conv,
Jan F. Chadima 69dd72
+	NULL
Jan F. Chadima 69dd72
+};
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+char *
Jan F. Chadima 69dd72
+make_auth_keys_name(const struct passwd *pwd)
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	char *fname;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if (asprintf(&fname, "%s/.ssh/authorized_keys", pwd->pw_dir) < 0)
Jan F. Chadima 69dd72
+		return NULL;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	return fname;
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+int
Jan F. Chadima 69dd72
+dump_keys(const char *user)
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	struct passwd *pwd;
Jan F. Chadima 69dd72
+	int fd = -1;
Jan F. Chadima 69dd72
+	FILE *f = NULL;
Jan F. Chadima 69dd72
+	char *fname = NULL;
Jan F. Chadima 69dd72
+	int rv = 0;
Jan F. Chadima 69dd72
+	char buf[BUFLEN];
Jan F. Chadima 69dd72
+	size_t len;
Jan F. Chadima 69dd72
+	struct stat st;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if ((pwd = getpwnam(user)) == NULL) {
Jan F. Chadima 69dd72
+		return ERR_GETPWNAM;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if ((fname = make_auth_keys_name(pwd)) == NULL) {
Jan F. Chadima 69dd72
+		return ERR_MEMORY;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	temporarily_use_uid(pwd);
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if ((fd = open(fname, O_RDONLY|O_NONBLOCK|O_NOFOLLOW, 0)) < 0) {
Jan F. Chadima 69dd72
+		rv = ERR_OPEN;
Jan F. Chadima 69dd72
+		goto fail;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if (fstat(fd, &st) < 0) {
Jan F. Chadima 69dd72
+		rv = ERR_STAT;
Jan F. Chadima 69dd72
+		goto fail;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if (!S_ISREG(st.st_mode) || 
Jan F. Chadima 69dd72
+		(st.st_uid != pwd->pw_uid && st.st_uid != 0)) {
Jan F. Chadima 69dd72
+		rv = ERR_FILE_MODE;
Jan F. Chadima 69dd72
+		goto fail;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	unset_nonblock(fd);
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if ((f = fdopen(fd, "r")) == NULL) {
Jan F. Chadima 69dd72
+		rv = ERR_FDOPEN;
Jan F. Chadima 69dd72
+		goto fail;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	fd = -1;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	while ((len = fread(buf, 1, sizeof(buf), f)) > 0) {
Jan F. Chadima 69dd72
+		rv = fwrite(buf, 1, len, stdout) != len ? ERR_WRITE : 0;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+fail:
Jan F. Chadima 69dd72
+	if (fd != -1)
Jan F. Chadima 69dd72
+		close(fd);
Jan F. Chadima 69dd72
+	if (f != NULL)
Jan F. Chadima 69dd72
+		fclose(f);
Jan F. Chadima 69dd72
+	free(fname);
Jan F. Chadima 69dd72
+	restore_uid();
Jan F. Chadima 69dd72
+	return rv;
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+static const char *env_names[] = { "SELINUX_ROLE_REQUESTED",
Jan F. Chadima 69dd72
+	"SELINUX_LEVEL_REQUESTED",
Jan F. Chadima 69dd72
+	"SELINUX_USE_CURRENT_RANGE"
Jan F. Chadima 69dd72
+};
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+extern char **environ;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+int
Jan F. Chadima 69dd72
+set_pam_environment(pam_handle_t *pamh)
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	int i;
Jan F. Chadima 69dd72
+	size_t j;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	for (j = 0; j < sizeof(env_names)/sizeof(env_names[0]); ++j) {
Jan F. Chadima 69dd72
+		int len = strlen(env_names[j]);
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+		for (i = 0; environ[i] != NULL; ++i) {
Jan F. Chadima 69dd72
+			if (strncmp(env_names[j], environ[i], len) == 0 &&
Jan F. Chadima 69dd72
+			    environ[i][len] == '=') {
Jan F. Chadima 69dd72
+				if (pam_putenv(pamh, environ[i]) != PAM_SUCCESS)
Jan F. Chadima 69dd72
+					return ERR_PAM_PUTENV;
Jan F. Chadima 69dd72
+			}
Jan F. Chadima 69dd72
+		}
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	return 0;
Jan F. Chadima 69dd72
+}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+int
Jan F. Chadima 69dd72
+main(int argc, char *argv[])
Jan F. Chadima 69dd72
+{
Jan F. Chadima 69dd72
+	pam_handle_t *pamh = NULL;
Jan F. Chadima 69dd72
+	int retval;
Jan F. Chadima 69dd72
+	int ev = 0;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	if (argc != 2) {
Jan F. Chadima 69dd72
+		fprintf(stderr, "Usage: %s <user-name>\n", argv[0]);
Jan F. Chadima 69dd72
+		return ERR_USAGE;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	retval = pam_start("ssh-keycat", argv[1], &conv, &pamh);
Jan F. Chadima 69dd72
+	if (retval != PAM_SUCCESS) {
Jan F. Chadima 69dd72
+		return ERR_PAM_START;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	ev = set_pam_environment(pamh);
Jan F. Chadima 69dd72
+	if (ev != 0)
Jan F. Chadima 69dd72
+		goto finish;
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	retval = pam_open_session(pamh, PAM_SILENT);
Jan F. Chadima 69dd72
+	if (retval != PAM_SUCCESS) {
Jan F. Chadima 69dd72
+		ev = ERR_OPEN_SESSION;
Jan F. Chadima 69dd72
+		goto finish;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	ev = dump_keys(argv[1]);
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+	retval = pam_close_session(pamh, PAM_SILENT);
Jan F. Chadima 69dd72
+	if (retval != PAM_SUCCESS) {
Jan F. Chadima 69dd72
+		ev = ERR_CLOSE_SESSION;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+
Jan F. Chadima 69dd72
+finish:
Jan F. Chadima 69dd72
+	retval = pam_end (pamh,retval);
Jan F. Chadima 69dd72
+	if (retval != PAM_SUCCESS) {
Jan F. Chadima 69dd72
+		ev = ERR_PAM_END;
Jan F. Chadima 69dd72
+	}
Jan F. Chadima 69dd72
+	return ev;
Jan F. Chadima 69dd72
+}
334feb
diff --git a/configure.ac b/configure.ac
334feb
index 3bbccfd..6481f1f 100644
334feb
--- a/configure.ac
334feb
+++ b/configure.ac
334feb
@@ -2952,6 +2952,7 @@ AC_ARG_WITH([pam],
334feb
 			PAM_MSG="yes"
334feb
 
334feb
 			SSHDLIBS="$SSHDLIBS -lpam"
334feb
+			KEYCATLIBS="$KEYCATLIBS -lpam"
334feb
 			AC_DEFINE([USE_PAM], [1],
334feb
 				[Define if you want to enable PAM support])
334feb
 
334feb
@@ -3105,6 +3106,7 @@
334feb
 					;;
334feb
 				*)
334feb
 					SSHDLIBS="$SSHDLIBS -ldl"
334feb
+					KEYCATLIBS="$KEYCATLIBS -ldl"
334feb
 					;;
334feb
 				esac
334feb
 			fi
334feb
@@ -4042,6 +4044,7 @@ AC_ARG_WITH([selinux],
334feb
 )
334feb
 AC_SUBST([SSHLIBS])
334feb
 AC_SUBST([SSHDLIBS])
334feb
+AC_SUBST([KEYCATLIBS])
334feb
 
334feb
 # Check whether user wants Kerberos 5 support
334feb
 KRB5_MSG="no"
334feb
@@ -5031,6 +5034,9 @@ fi
334feb
 if test ! -z "${SSHLIBS}"; then
334feb
 echo "          +for ssh: ${SSHLIBS}"
334feb
 fi
334feb
+if test ! -z "${KEYCATLIBS}"; then
334feb
+echo "   +for ssh-keycat: ${KEYCATLIBS}"
334feb
+fi
334feb
 
334feb
 echo ""
334feb