mirror of
https://abf.rosa.ru/djam/openssh.git
synced 2025-02-24 02:02:57 +00:00
121 lines
3.6 KiB
Diff
121 lines
3.6 KiB
Diff
diff -ur openssh-9.5p1/openbsd-compat/port-linux.h openssh-9.5p1_patched/openbsd-compat/port-linux.h
|
|
--- openssh-9.5p1/openbsd-compat/port-linux.h 2023-11-06 14:25:01.218241801 +0300
|
|
+++ openssh-9.5p1_patched/openbsd-compat/port-linux.h 2023-11-06 14:30:17.429018079 +0300
|
|
@@ -23,6 +23,7 @@
|
|
void ssh_selinux_change_context(const char *);
|
|
void ssh_selinux_setfscreatecon(const char *);
|
|
|
|
+void sshd_selinux_copy_context(void);
|
|
void sshd_selinux_setup_exec_context(char *);
|
|
#endif
|
|
|
|
diff -ur openssh-9.5p1/openbsd-compat/port-linux-sshd.c openssh-9.5p1_patched/openbsd-compat/port-linux-sshd.c
|
|
--- openssh-9.5p1/openbsd-compat/port-linux-sshd.c 2023-11-06 14:25:01.218241801 +0300
|
|
+++ openssh-9.5p1_patched/openbsd-compat/port-linux-sshd.c 2023-11-06 14:30:17.429018079 +0300
|
|
@@ -416,6 +416,28 @@
|
|
debug3_f("done");
|
|
}
|
|
|
|
+void
|
|
+sshd_selinux_copy_context(void)
|
|
+{
|
|
+ security_context_t *ctx;
|
|
+
|
|
+ if (!ssh_selinux_enabled())
|
|
+ return;
|
|
+
|
|
+ if (getexeccon((security_context_t *)&ctx) != 0) {
|
|
+ logit_f("getexeccon failed with %s", strerror(errno));
|
|
+ return;
|
|
+ }
|
|
+ if (ctx != NULL) {
|
|
+ /* unset exec context before we will lose this capabililty */
|
|
+ if (setexeccon(NULL) != 0)
|
|
+ fatal_f("setexeccon failed with %s", strerror(errno));
|
|
+ if (setcon(ctx) != 0)
|
|
+ fatal_f("setcon failed with %s", strerror(errno));
|
|
+ freecon(ctx);
|
|
+ }
|
|
+}
|
|
+
|
|
#endif
|
|
#endif
|
|
|
|
diff -ur openssh-9.5p1/session.c openssh-9.5p1_patched/session.c
|
|
--- openssh-9.5p1/session.c 2023-11-06 14:02:26.177409262 +0300
|
|
+++ openssh-9.5p1_patched/session.c 2023-11-06 14:31:28.561393077 +0300
|
|
@@ -1367,7 +1367,7 @@
|
|
|
|
platform_setusercontext(pw);
|
|
|
|
- if (platform_privileged_uidswap()) {
|
|
+ if (platform_privileged_uidswap() && (!is_child || !use_privsep)) {
|
|
#ifdef HAVE_LOGIN_CAP
|
|
if (setusercontext(lc, pw, pw->pw_uid,
|
|
(LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
|
|
@@ -1399,6 +1399,9 @@
|
|
(unsigned long long)pw->pw_uid);
|
|
chroot_path = percent_expand(tmp, "h", pw->pw_dir,
|
|
"u", pw->pw_name, "U", uidstr, (char *)NULL);
|
|
+#ifdef WITH_SELINUX
|
|
+ sshd_selinux_copy_context();
|
|
+#endif
|
|
safely_chroot(chroot_path, pw->pw_uid);
|
|
free(tmp);
|
|
free(chroot_path);
|
|
@@ -1434,6 +1437,11 @@
|
|
/* Permanently switch to the desired uid. */
|
|
permanently_set_uid(pw);
|
|
#endif
|
|
+
|
|
+#ifdef WITH_SELINUX
|
|
+ if (in_chroot == 0)
|
|
+ sshd_selinux_copy_context();
|
|
+#endif
|
|
} else if (options.chroot_directory != NULL &&
|
|
strcasecmp(options.chroot_directory, "none") != 0) {
|
|
fatal("server lacks privileges to chroot to ChrootDirectory");
|
|
@@ -1451,9 +1459,6 @@
|
|
if (s->ttyfd != -1) {
|
|
fprintf(stderr,
|
|
"You must change your password now and login again!\n");
|
|
-#ifdef WITH_SELINUX
|
|
- setexeccon(NULL);
|
|
-#endif
|
|
#ifdef PASSWD_NEEDS_USERNAME
|
|
execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
|
|
(char *)NULL);
|
|
@@ -1657,9 +1662,6 @@
|
|
argv[i] = NULL;
|
|
optind = optreset = 1;
|
|
__progname = argv[0];
|
|
-#ifdef WITH_SELINUX
|
|
- ssh_selinux_change_context("sftpd_t");
|
|
-#endif
|
|
exit(sftp_server_main(i, argv, s->pw, have_dev_log));
|
|
}
|
|
|
|
diff -ur openssh-9.5p1/sshd.c openssh-9.5p1_patched/sshd.c
|
|
--- openssh-9.5p1/sshd.c 2023-11-06 14:25:01.219241778 +0300
|
|
+++ openssh-9.5p1_patched/sshd.c 2023-11-06 14:30:17.431018034 +0300
|
|
@@ -449,6 +449,10 @@
|
|
/* Demote the private keys to public keys. */
|
|
demote_sensitive_data();
|
|
|
|
+#ifdef WITH_SELINUX
|
|
+ ssh_selinux_change_context("sshd_net_t");
|
|
+#endif
|
|
+
|
|
/* Demote the child */
|
|
if (privsep_chroot) {
|
|
/* Change our root directory */
|
|
@@ -541,6 +545,9 @@
|
|
{
|
|
#ifdef DISABLE_FD_PASSING
|
|
if (1) {
|
|
+#elif defined(WITH_SELINUX)
|
|
+ if (0) {
|
|
+ /* even root user can be confined by SELinux */
|
|
#else
|
|
if (authctxt->pw->pw_uid == 0) {
|
|
#endif
|