Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
openssh.31680
openssh-7.8p1-role-mls.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssh-7.8p1-role-mls.patch of Package openssh.31680
Index: openssh-8.4p1/auth2.c =================================================================== --- openssh-8.4p1.orig/auth2.c +++ openssh-8.4p1/auth2.c @@ -266,6 +266,9 @@ input_userauth_request(int type, u_int32 Authctxt *authctxt = ssh->authctxt; Authmethod *m = NULL; char *user = NULL, *service = NULL, *method = NULL, *style = NULL; +#ifdef WITH_SELINUX + char *role = NULL; +#endif int r, authenticated = 0; double tstart = monotime_double(); @@ -279,6 +282,11 @@ input_userauth_request(int type, u_int32 debug("userauth-request for user %s service %s method %s", user, service, method); debug("attempt %d failures %d", authctxt->attempt, authctxt->failures); +#ifdef WITH_SELINUX + if ((role = strchr(user, '/')) != NULL) + *role++ = 0; +#endif + if ((style = strchr(user, ':')) != NULL) *style++ = 0; @@ -304,8 +312,15 @@ input_userauth_request(int type, u_int32 use_privsep ? " [net]" : ""); authctxt->service = xstrdup(service); authctxt->style = style ? xstrdup(style) : NULL; - if (use_privsep) +#ifdef WITH_SELINUX + authctxt->role = role ? xstrdup(role) : NULL; +#endif + if (use_privsep) { mm_inform_authserv(service, style); +#ifdef WITH_SELINUX + mm_inform_authrole(role); +#endif + } userauth_banner(ssh); if (auth2_setup_methods_lists(authctxt) != 0) ssh_packet_disconnect(ssh, Index: openssh-8.4p1/auth2-gss.c =================================================================== --- openssh-8.4p1.orig/auth2-gss.c +++ openssh-8.4p1/auth2-gss.c @@ -324,6 +324,7 @@ input_gssapi_mic(int type, u_int32_t ple Authctxt *authctxt = ssh->authctxt; Gssctxt *gssctxt; int r, authenticated = 0; + char *micuser; struct sshbuf *b; gss_buffer_desc mic, gssbuf; const char *displayname; @@ -341,7 +342,13 @@ input_gssapi_mic(int type, u_int32_t ple fatal("%s: sshbuf_new failed", __func__); mic.value = p; mic.length = len; - ssh_gssapi_buildmic(b, authctxt->user, authctxt->service, +#ifdef WITH_SELINUX + if (authctxt->role && authctxt->role[0] != 0) + xasprintf(&micuser, "%s/%s", authctxt->user, authctxt->role); + else +#endif + micuser = authctxt->user; + ssh_gssapi_buildmic(b, micuser, authctxt->service, "gssapi-with-mic"); if ((gssbuf.value = sshbuf_mutable_ptr(b)) == NULL) @@ -355,6 +362,8 @@ input_gssapi_mic(int type, u_int32_t ple logit("GSSAPI MIC check failed"); sshbuf_free(b); + if (micuser != authctxt->user) + free(micuser); free(mic.value); if ((!use_privsep || mm_is_monitor()) && Index: openssh-8.4p1/auth2-hostbased.c =================================================================== --- openssh-8.4p1.orig/auth2-hostbased.c +++ openssh-8.4p1/auth2-hostbased.c @@ -131,7 +131,16 @@ userauth_hostbased(struct ssh *ssh) /* reconstruct packet */ if ((r = sshbuf_put_string(b, session_id2, session_id2_len)) != 0 || (r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 || +#ifdef WITH_SELINUX + (authctxt->role + ? ( (r = sshbuf_put_u32(b, strlen(authctxt->user)+strlen(authctxt->role)+1)) != 0 || + (r = sshbuf_put(b, authctxt->user, strlen(authctxt->user))) != 0 || + (r = sshbuf_put_u8(b, '/') != 0) || + (r = sshbuf_put(b, authctxt->role, strlen(authctxt->role))) != 0) + : (r = sshbuf_put_cstring(b, authctxt->user)) != 0) || +#else (r = sshbuf_put_cstring(b, authctxt->user)) != 0 || +#endif (r = sshbuf_put_cstring(b, authctxt->service)) != 0 || (r = sshbuf_put_cstring(b, "hostbased")) != 0 || (r = sshbuf_put_string(b, pkalg, alen)) != 0 || Index: openssh-8.4p1/auth2-pubkey.c =================================================================== --- openssh-8.4p1.orig/auth2-pubkey.c +++ openssh-8.4p1/auth2-pubkey.c @@ -194,9 +194,16 @@ userauth_pubkey(struct ssh *ssh) goto done; } /* reconstruct packet */ - xasprintf(&userstyle, "%s%s%s", authctxt->user, + xasprintf(&userstyle, "%s%s%s%s%s", authctxt->user, authctxt->style ? ":" : "", - authctxt->style ? authctxt->style : ""); + authctxt->style ? authctxt->style : "", +#ifdef WITH_SELINUX + authctxt->role ? "/" : "", + authctxt->role ? authctxt->role : "" +#else + "", "" +#endif + ); if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 || (r = sshbuf_put_cstring(b, userstyle)) != 0 || (r = sshbuf_put_cstring(b, authctxt->service)) != 0 || Index: openssh-8.4p1/auth.h =================================================================== --- openssh-8.4p1.orig/auth.h +++ openssh-8.4p1/auth.h @@ -63,6 +63,9 @@ struct Authctxt { char *service; struct passwd *pw; /* set if 'valid' */ char *style; +#ifdef WITH_SELINUX + char *role; +#endif /* Method lists for multiple authentication */ char **auth_methods; /* modified from server config */ Index: openssh-8.4p1/auth-pam.c =================================================================== --- openssh-8.4p1.orig/auth-pam.c +++ openssh-8.4p1/auth-pam.c @@ -1222,7 +1222,7 @@ is_pam_session_open(void) * during the ssh authentication process. */ int -do_pam_putenv(char *name, char *value) +do_pam_putenv(char *name, const char *value) { int ret = 1; char *compound; Index: openssh-8.4p1/auth-pam.h =================================================================== --- openssh-8.4p1.orig/auth-pam.h +++ openssh-8.4p1/auth-pam.h @@ -33,7 +33,7 @@ u_int do_pam_account(void); void do_pam_session(struct ssh *); void do_pam_setcred(int ); void do_pam_chauthtok(void); -int do_pam_putenv(char *, char *); +int do_pam_putenv(char *, const char *); char ** fetch_pam_environment(void); char ** fetch_pam_child_environment(void); void free_pam_environment(char **); Index: openssh-8.4p1/misc.c =================================================================== --- openssh-8.4p1.orig/misc.c +++ openssh-8.4p1/misc.c @@ -670,6 +670,7 @@ char * colon(char *cp) { int flag = 0; + int start = 1; if (*cp == ':') /* Leading colon is part of file name. */ return NULL; @@ -685,6 +686,13 @@ colon(char *cp) return (cp); if (*cp == '/') return NULL; + if (start) { + /* Slash on beginning or after dots only denotes file name. */ + if (*cp == '/') + return (0); + if (*cp != '.') + start = 0; + } } return NULL; } Index: openssh-8.4p1/monitor.c =================================================================== --- openssh-8.4p1.orig/monitor.c +++ openssh-8.4p1/monitor.c @@ -121,6 +121,9 @@ int mm_answer_sign(struct ssh *, int, st int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *); int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *); int mm_answer_authserv(struct ssh *, int, struct sshbuf *); +#ifdef WITH_SELINUX +int mm_answer_authrole(struct ssh *, int, struct sshbuf *); +#endif int mm_answer_authpassword(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *); @@ -206,6 +209,9 @@ struct mon_table mon_dispatch_proto20[] {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, +#ifdef WITH_SELINUX + {MONITOR_REQ_AUTHROLE, MON_ONCE, mm_answer_authrole}, +#endif {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, #ifdef USE_PAM @@ -837,6 +843,9 @@ mm_answer_pwnamallow(struct ssh *ssh, in /* Allow service/style information on the auth context */ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); +#ifdef WITH_SELINUX + monitor_permit(mon_dispatch, MONITOR_REQ_AUTHROLE, 1); +#endif monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); #ifdef USE_PAM @@ -912,6 +921,26 @@ key_base_type_match(const char *method, return found; } +#ifdef WITH_SELINUX +int +mm_answer_authrole(struct ssh *ssh, int sock, struct sshbuf *m) +{ + int r; + monitor_permit_authentications(1); + + if ((r = sshbuf_get_cstring(m, &authctxt->role, NULL)) != 0) + fatal("%s: buffer error: %s", __func__, ssh_err(r)); + debug3("%s: role=%s", __func__, authctxt->role); + + if (strlen(authctxt->role) == 0) { + free(authctxt->role); + authctxt->role = NULL; + } + + return (0); +} +#endif + int mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m) { @@ -1285,7 +1314,7 @@ monitor_valid_userblob(const u_char *dat { struct sshbuf *b; const u_char *p; - char *userstyle, *cp; + char *userstyle, *s, *cp; size_t len; u_char type; int r, fail = 0; @@ -1316,6 +1345,8 @@ monitor_valid_userblob(const u_char *dat fail++; if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0) fatal("%s: buffer error: %s", __func__, ssh_err(r)); + if ((s = strchr(cp, '/')) != NULL) + *s = '\0'; xasprintf(&userstyle, "%s%s%s", authctxt->user, authctxt->style ? ":" : "", authctxt->style ? authctxt->style : ""); @@ -1351,7 +1382,7 @@ monitor_valid_hostbasedblob(const u_char { struct sshbuf *b; const u_char *p; - char *cp, *userstyle; + char *cp, *s, *userstyle; size_t len; int r, fail = 0; u_char type; @@ -1372,6 +1403,8 @@ monitor_valid_hostbasedblob(const u_char fail++; if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0) fatal("%s: buffer error: %s", __func__, ssh_err(r)); + if ((s = strchr(p, '/')) != NULL) + *s = '\0'; xasprintf(&userstyle, "%s%s%s", authctxt->user, authctxt->style ? ":" : "", authctxt->style ? authctxt->style : ""); Index: openssh-8.4p1/monitor.h =================================================================== --- openssh-8.4p1.orig/monitor.h +++ openssh-8.4p1/monitor.h @@ -55,6 +55,10 @@ enum monitor_reqtype { MONITOR_REQ_GSSCHECKMIC = 48, MONITOR_ANS_GSSCHECKMIC = 49, MONITOR_REQ_TERM = 50, +#ifdef WITH_SELINUX + MONITOR_REQ_AUTHROLE = 80, +#endif + MONITOR_REQ_PAM_START = 100, MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103, MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105, Index: openssh-8.4p1/monitor_wrap.c =================================================================== --- openssh-8.4p1.orig/monitor_wrap.c +++ openssh-8.4p1/monitor_wrap.c @@ -385,6 +385,27 @@ mm_inform_authserv(char *service, char * sshbuf_free(m); } +/* Inform the privileged process about role */ + +#ifdef WITH_SELINUX +void +mm_inform_authrole(char *role) +{ + int r; + struct sshbuf *m; + + debug3("%s entering", __func__); + + if ((m = sshbuf_new()) == NULL) + fatal("%s: sshbuf_new failed", __func__); + if ((r = sshbuf_put_cstring(m, role ? role : "")) != 0) + fatal("%s: buffer error: %s", __func__, ssh_err(r)); + mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUTHROLE, m); + + sshbuf_free(m); +} +#endif + /* Do the password authentication */ int mm_auth_password(struct ssh *ssh, char *password) Index: openssh-8.4p1/monitor_wrap.h =================================================================== --- openssh-8.4p1.orig/monitor_wrap.h +++ openssh-8.4p1/monitor_wrap.h @@ -49,6 +49,9 @@ int mm_sshkey_sign(struct ssh *, struct const u_char *, size_t, const char *, const char *, const char *, u_int compat); void mm_inform_authserv(char *, char *); +#ifdef WITH_SELINUX +void mm_inform_authrole(char *); +#endif struct passwd *mm_getpwnamallow(struct ssh *, const char *); char *mm_auth2_read_banner(void); int mm_auth_password(struct ssh *, char *); Index: openssh-8.4p1/openbsd-compat/Makefile.in =================================================================== --- openssh-8.4p1.orig/openbsd-compat/Makefile.in +++ openssh-8.4p1/openbsd-compat/Makefile.in @@ -96,7 +96,8 @@ PORTS= port-aix.o \ port-linux.o \ port-solaris.o \ port-net.o \ - port-uw.o + port-uw.o \ + port-linux-sshd.o .c.o: $(CC) $(CFLAGS_NOPIE) $(PICFLAG) $(CPPFLAGS) -c $< Index: openssh-8.4p1/openbsd-compat/port-linux.c =================================================================== --- openssh-8.4p1.orig/openbsd-compat/port-linux.c +++ openssh-8.4p1/openbsd-compat/port-linux.c @@ -101,37 +101,6 @@ ssh_selinux_getctxbyname(char *pwname) return sc; } -/* Set the execution context to the default for the specified user */ -void -ssh_selinux_setup_exec_context(char *pwname) -{ - security_context_t user_ctx = NULL; - - if (!ssh_selinux_enabled()) - return; - - debug3("%s: setting execution context", __func__); - - user_ctx = ssh_selinux_getctxbyname(pwname); - if (setexeccon(user_ctx) != 0) { - switch (security_getenforce()) { - case -1: - fatal("%s: security_getenforce() failed", __func__); - case 0: - error("%s: Failed to set SELinux execution " - "context for %s", __func__, pwname); - break; - default: - fatal("%s: Failed to set SELinux execution context " - "for %s (in enforcing mode)", __func__, pwname); - } - } - if (user_ctx != NULL) - freecon(user_ctx); - - debug3("%s: done", __func__); -} - /* Set the TTY context for the specified user */ void ssh_selinux_setup_pty(char *pwname, const char *tty) @@ -146,7 +115,11 @@ ssh_selinux_setup_pty(char *pwname, cons debug3("%s: setting TTY context on %s", __func__, tty); - user_ctx = ssh_selinux_getctxbyname(pwname); + if (getexeccon(&user_ctx) != 0) { + error("%s: getexeccon: %s", __func__, strerror(errno)); + goto out; + } + /* XXX: should these calls fatal() upon failure in enforcing mode? */ Index: openssh-8.4p1/openbsd-compat/port-linux.h =================================================================== --- openssh-8.4p1.orig/openbsd-compat/port-linux.h +++ openssh-8.4p1/openbsd-compat/port-linux.h @@ -20,9 +20,10 @@ #ifdef WITH_SELINUX int ssh_selinux_enabled(void); void ssh_selinux_setup_pty(char *, const char *); -void ssh_selinux_setup_exec_context(char *); void ssh_selinux_change_context(const char *); void ssh_selinux_setfscreatecon(const char *); + +void sshd_selinux_setup_exec_context(char *); #endif #ifdef LINUX_OOM_ADJUST Index: openssh-8.4p1/openbsd-compat/port-linux-sshd.c =================================================================== --- /dev/null +++ openssh-8.4p1/openbsd-compat/port-linux-sshd.c @@ -0,0 +1,425 @@ +/* + * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> + * Copyright (c) 2014 Petr Lautrbach <plautrba@redhat.com> + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * Linux-specific portability code - just SELinux support for sshd at present + */ + +#include "includes.h" + +#if defined(WITH_SELINUX) || defined(LINUX_OOM_ADJUST) +#include <errno.h> +#include <stdarg.h> +#include <string.h> +#include <stdio.h> +#include <stdlib.h> + +#include "log.h" +#include "xmalloc.h" +#include "misc.h" /* servconf.h needs misc.h for struct ForwardOptions */ +#include "servconf.h" +#include "port-linux.h" +#include "sshkey.h" +#include "hostfile.h" +#include "auth.h" + +#ifdef WITH_SELINUX +#include <selinux/selinux.h> +#include <selinux/context.h> +#include <selinux/get_context_list.h> +#include <selinux/get_default_type.h> + +#ifdef HAVE_LINUX_AUDIT +#include <libaudit.h> +#include <unistd.h> +#endif + +extern ServerOptions options; +extern Authctxt *the_authctxt; +extern int inetd_flag; +extern int rexeced_flag; + +/* Send audit message */ +static int +sshd_selinux_send_audit_message(int success, security_context_t default_context, + security_context_t selected_context) +{ + int rc=0; +#ifdef HAVE_LINUX_AUDIT + char *msg = NULL; + int audit_fd = audit_open(); + security_context_t default_raw=NULL; + security_context_t selected_raw=NULL; + rc = -1; + if (audit_fd < 0) { + if (errno == EINVAL || errno == EPROTONOSUPPORT || + errno == EAFNOSUPPORT) + return 0; /* No audit support in kernel */ + error("Error connecting to audit system."); + return rc; + } + if (selinux_trans_to_raw_context(default_context, &default_raw) < 0) { + error("Error translating default context."); + default_raw = NULL; + } + if (selinux_trans_to_raw_context(selected_context, &selected_raw) < 0) { + error("Error translating selected context."); + selected_raw = NULL; + } + if (asprintf(&msg, "sshd: default-context=%s selected-context=%s", + default_raw ? default_raw : (default_context ? default_context: "?"), + selected_context ? selected_raw : (selected_context ? selected_context :"?")) < 0) { + error("Error allocating memory."); + goto out; + } + if (audit_log_user_message(audit_fd, AUDIT_USER_ROLE_CHANGE, + msg, NULL, NULL, NULL, success) <= 0) { + error("Error sending audit message."); + goto out; + } + rc = 0; + out: + free(msg); + freecon(default_raw); + freecon(selected_raw); + close(audit_fd); +#endif + return rc; +} + +static int +mls_range_allowed(security_context_t src, security_context_t dst) +{ + struct av_decision avd; + int retval; + access_vector_t bit; + security_class_t class; + + debug("%s: src:%s dst:%s", __func__, src, dst); + class = string_to_security_class("context"); + if (!class) { + error("string_to_security_class failed to translate security class context"); + return 1; + } + bit = string_to_av_perm(class, "contains"); + if (!bit) { + error("string_to_av_perm failed to translate av perm contains"); + return 1; + } + retval = security_compute_av(src, dst, class, bit, &avd); + if (retval || ((bit & avd.allowed) != bit)) + return 0; + + return 1; +} + +static int +get_user_context(const char *sename, const char *role, const char *lvl, + security_context_t *sc) { +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + if (lvl == NULL || lvl[0] == '\0' || get_default_context_with_level(sename, lvl, NULL, sc) != 0) { + /* User may have requested a level completely outside of his + allowed range. We get a context just for auditing as the + range check below will certainly fail for default context. */ +#endif + if (get_default_context(sename, NULL, sc) != 0) { + *sc = NULL; + return -1; + } +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + } +#endif + if (role != NULL && role[0]) { + context_t con; + char *type=NULL; + if (get_default_type(role, &type) != 0) { + error("get_default_type: failed to get default type for '%s'", + role); + goto out; + } + con = context_new(*sc); + if (!con) { + goto out; + } + context_role_set(con, role); + context_type_set(con, type); + freecon(*sc); + *sc = strdup(context_str(con)); + context_free(con); + if (!*sc) + return -1; + } +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + if (lvl != NULL && lvl[0]) { + /* verify that the requested range is obtained */ + context_t con; + security_context_t obtained_raw; + security_context_t requested_raw; + con = context_new(*sc); + if (!con) { + goto out; + } + context_range_set(con, lvl); + if (selinux_trans_to_raw_context(*sc, &obtained_raw) < 0) { + context_free(con); + goto out; + } + if (selinux_trans_to_raw_context(context_str(con), &requested_raw) < 0) { + freecon(obtained_raw); + context_free(con); + goto out; + } + + debug("get_user_context: obtained context '%s' requested context '%s'", + obtained_raw, requested_raw); + if (strcmp(obtained_raw, requested_raw)) { + /* set the context to the real requested one but fail */ + freecon(requested_raw); + freecon(obtained_raw); + freecon(*sc); + *sc = strdup(context_str(con)); + context_free(con); + return -1; + } + freecon(requested_raw); + freecon(obtained_raw); + context_free(con); + } +#endif + return 0; + out: + freecon(*sc); + *sc = NULL; + return -1; +} + +static void +ssh_selinux_get_role_level(char **role, const char **level) +{ + *role = NULL; + *level = NULL; + if (the_authctxt) { + if (the_authctxt->role != NULL) { + char *slash; + *role = xstrdup(the_authctxt->role); + if ((slash = strchr(*role, '/')) != NULL) { + *slash = '\0'; + *level = slash + 1; + } + } + } +} + +/* Return the default security context for the given username */ +static int +sshd_selinux_getctxbyname(char *pwname, + security_context_t *default_sc, security_context_t *user_sc) +{ + char *sename, *lvl; + char *role; + const char *reqlvl; + int r = 0; + context_t con = NULL; + + ssh_selinux_get_role_level(&role, &reqlvl); + +#ifdef HAVE_GETSEUSERBYNAME + if ((r=getseuserbyname(pwname, &sename, &lvl)) != 0) { + sename = NULL; + lvl = NULL; + } +#else + sename = pwname; + lvl = ""; +#endif + + if (r == 0) { +#ifdef HAVE_GET_DEFAULT_CONTEXT_WITH_LEVEL + r = get_default_context_with_level(sename, lvl, NULL, default_sc); +#else + r = get_default_context(sename, NULL, default_sc); +#endif + } + + if (r == 0) { + /* If launched from xinetd, we must use current level */ + if (inetd_flag && !rexeced_flag) { + security_context_t sshdsc=NULL; + + if (getcon_raw(&sshdsc) < 0) + fatal("failed to allocate security context"); + + if ((con=context_new(sshdsc)) == NULL) + fatal("failed to allocate selinux context"); + reqlvl = context_range_get(con); + freecon(sshdsc); + if (reqlvl !=NULL && lvl != NULL && strcmp(reqlvl, lvl) == 0) + /* we actually don't change level */ + reqlvl = ""; + + debug("%s: current connection level '%s'", __func__, reqlvl); + + } + + if ((reqlvl != NULL && reqlvl[0]) || (role != NULL && role[0])) { + r = get_user_context(sename, role, reqlvl, user_sc); + + if (r == 0 && reqlvl != NULL && reqlvl[0]) { + security_context_t default_level_sc = *default_sc; + if (role != NULL && role[0]) { + if (get_user_context(sename, role, lvl, &default_level_sc) < 0) + default_level_sc = *default_sc; + } + /* verify that the requested range is contained in the user range */ + if (mls_range_allowed(default_level_sc, *user_sc)) { + logit("permit MLS level %s (user range %s)", reqlvl, lvl); + } else { + r = -1; + error("deny MLS level %s (user range %s)", reqlvl, lvl); + } + if (default_level_sc != *default_sc) + freecon(default_level_sc); + } + } else { + *user_sc = *default_sc; + } + } + if (r != 0) { + error("%s: Failed to get default SELinux security " + "context for %s", __func__, pwname); + } + +#ifdef HAVE_GETSEUSERBYNAME + free(sename); + free(lvl); +#endif + + if (role != NULL) + free(role); + if (con) + context_free(con); + + return (r); +} + +/* Setup environment variables for pam_selinux */ +static int +sshd_selinux_setup_pam_variables(void) +{ + const char *reqlvl; + char *role; + char *use_current; + int rv; + + debug3("%s: setting execution context", __func__); + + ssh_selinux_get_role_level(&role, &reqlvl); + + rv = do_pam_putenv("SELINUX_ROLE_REQUESTED", role ? role : ""); + + if (inetd_flag && !rexeced_flag) { + use_current = "1"; + } else { + use_current = ""; + rv = rv || do_pam_putenv("SELINUX_LEVEL_REQUESTED", reqlvl ? reqlvl: ""); + } + + rv = rv || do_pam_putenv("SELINUX_USE_CURRENT_RANGE", use_current); + + if (role != NULL) + free(role); + + return rv; +} + +/* Set the execution context to the default for the specified user */ +void +sshd_selinux_setup_exec_context(char *pwname) +{ + security_context_t user_ctx = NULL; + int r = 0; + security_context_t default_ctx = NULL; + + if (!ssh_selinux_enabled()) + return; + + if (options.use_pam) { + /* do not compute context, just setup environment for pam_selinux */ + if (sshd_selinux_setup_pam_variables()) { + switch (security_getenforce()) { + case -1: + fatal("%s: security_getenforce() failed", __func__); + case 0: + error("%s: SELinux PAM variable setup failure. Continuing in permissive mode.", + __func__); + break; + default: + fatal("%s: SELinux PAM variable setup failure. Aborting connection.", + __func__); + } + } + return; + } + + debug3("%s: setting execution context", __func__); + + r = sshd_selinux_getctxbyname(pwname, &default_ctx, &user_ctx); + if (r >= 0) { + r = setexeccon(user_ctx); + if (r < 0) { + error("%s: Failed to set SELinux execution context %s for %s", + __func__, user_ctx, pwname); + } +#ifdef HAVE_SETKEYCREATECON + else if (setkeycreatecon(user_ctx) < 0) { + error("%s: Failed to set SELinux keyring creation context %s for %s", + __func__, user_ctx, pwname); + } +#endif + } + if (user_ctx == NULL) { + user_ctx = default_ctx; + } + if (r < 0 || user_ctx != default_ctx) { + /* audit just the case when user changed a role or there was + a failure */ + sshd_selinux_send_audit_message(r >= 0, default_ctx, user_ctx); + } + if (r < 0) { + switch (security_getenforce()) { + case -1: + fatal("%s: security_getenforce() failed", __func__); + case 0: + error("%s: SELinux failure. Continuing in permissive mode.", + __func__); + break; + default: + fatal("%s: SELinux failure. Aborting connection.", + __func__); + } + } + if (user_ctx != NULL && user_ctx != default_ctx) + freecon(user_ctx); + if (default_ctx != NULL) + freecon(default_ctx); + + debug3("%s: done", __func__); +} + +#endif +#endif + Index: openssh-8.4p1/platform.c =================================================================== --- openssh-8.4p1.orig/platform.c +++ openssh-8.4p1/platform.c @@ -184,7 +184,7 @@ platform_setusercontext_post_groups(stru } #endif /* HAVE_SETPCRED */ #ifdef WITH_SELINUX - ssh_selinux_setup_exec_context(pw->pw_name); + sshd_selinux_setup_exec_context(pw->pw_name); #endif } Index: openssh-8.4p1/sshd.c =================================================================== --- openssh-8.4p1.orig/sshd.c +++ openssh-8.4p1/sshd.c @@ -2373,6 +2373,9 @@ main(int ac, char **av) restore_uid(); } #endif +#ifdef WITH_SELINUX + sshd_selinux_setup_exec_context(authctxt->pw->pw_name); +#endif #ifdef USE_PAM if (options.use_pam) { do_pam_setcred(1);
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
