- (dtucker) Cache selinux status earlier so we know if it's enabled after a

   chroot.  Allows ChrootDirectory to work with selinux support compiled in
   but not enabled.  Using it with selinux enabled will require some selinux
   support inside the chroot.  "looks sane" djm@

diff --git a/ChangeLog b/ChangeLog
index ea5d59a45195f10391f02a26fc5f5584caacf543..3970803891f8a3dc6255612fa16869d8640eda60 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+20080327
+ - (dtucker) Cache selinux status earlier so we know if it's enabled after a
+   chroot.  Allows ChrootDirectory to work with selinux support compiled in
+   but not enabled.  Using it with selinux enabled will require some selinux
+   support inside the chroot.  "looks sane" djm@
+
 20080315
  - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are
    empty; report and patch from Peter Stuge

diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c
index 45615eab236010e5c4e8a4c15e2e012dad57a863..2e7970e691491afc10ba665536d9e5441b3436fd 100644 (file)
--- a/openbsd-compat/port-linux.c
+++ b/openbsd-compat/port-linux.c
@@ -36,7 +36,7 @@
 #include <selinux/get_context_list.h>
 
 /* Wrapper around is_selinux_enabled() to log its return value once only */
-static int
+int
 ssh_selinux_enabled(void)
 {
        static int enabled = -1;

diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
index ccb42dfc0e2f4c5d8df48bba231737f83e9b49f4..36edd554c67c2e5098990114f621eee18a908aa4 100644 (file)
--- a/openbsd-compat/port-linux.h
+++ b/openbsd-compat/port-linux.h
@@ -20,6 +20,7 @@
 #define _PORT_LINUX_H
 
 #ifdef WITH_SELINUX
+int ssh_selinux_enabled(void);
 void ssh_selinux_setup_pty(char *, const char *);
 void ssh_selinux_setup_exec_context(char *);
 #endif

diff --git a/session.c b/session.c
index 92282f92a8b70f98cb4253d1d015a2e486572ea9..54621a4c046f06c0756e3847a5390d7a20911cb8 100644 (file)
--- a/session.c
+++ b/session.c
@@ -1345,6 +1345,11 @@ do_setusercontext(struct passwd *pw)
 {
        char *chroot_path, *tmp;
 
+#ifdef WITH_SELINUX
+       /* Cache selinux status for later use */
+       (void)ssh_selinux_enabled();
+#endif
+
 #ifndef HAVE_CYGWIN
        if (getuid() == 0 || geteuid() == 0)
 #endif /* HAVE_CYGWIN */