rpms/openssh/devel openssh-5.2p1-homechroot.patch, 1.4, 1.5 openssh-5.2p1-sesftp.patch, 1.3, 1.4 openssh.spec, 1.152, 1.153

[Jan F. Chadima]

Author: jfch2222

Update of /cvs/pkgs/rpms/openssh/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv21842

Modified Files:
	openssh-5.2p1-homechroot.patch openssh-5.2p1-sesftp.patch 
	openssh.spec 
Log Message:
only INTERNAL_SFTP can be home-chrooted
save _u and _r parts of context changing to sftpd_t


openssh-5.2p1-homechroot.patch:
 chrootenv.h        |   32 ++++++++++++++++++++++++++++++++
 session.c          |   22 +++++++++++++++++++---
 sftp-common.c      |    5 +++--
 sftp-server-main.c |    3 +++
 sftp.c             |    2 ++
 5 files changed, 59 insertions(+), 5 deletions(-)

Index: openssh-5.2p1-homechroot.patch
===================================================================
RCS file: /cvs/pkgs/rpms/openssh/devel/openssh-5.2p1-homechroot.patch,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -p -r1.4 -r1.5
--- openssh-5.2p1-homechroot.patch	29 Jun 2009 20:51:16 -0000	1.4
+++ openssh-5.2p1-homechroot.patch	24 Jul 2009 06:15:35 -0000	1.5
@@ -1,6 +1,6 @@
 diff -up /dev/null openssh-5.2p1/chrootenv.h
---- /dev/null	2009-06-11 17:05:12.257284457 +0200
-+++ openssh-5.2p1/chrootenv.h	2009-06-29 11:06:19.772277766 +0200
+--- /dev/null	2009-07-23 14:57:23.604046842 +0200
++++ openssh-5.2p1/chrootenv.h	2009-07-24 07:11:29.000000000 +0200
 @@ -0,0 +1,32 @@
 +/* $OpenBSD: session.h,v 1.30 2008/05/08 12:21:16 djm Exp $ */
 +
@@ -35,8 +35,8 @@ diff -up /dev/null openssh-5.2p1/chroote
 +#endif
 +
 diff -up openssh-5.2p1/session.c.homechroot openssh-5.2p1/session.c
---- openssh-5.2p1/session.c.homechroot	2009-06-29 10:58:43.715586616 +0200
-+++ openssh-5.2p1/session.c	2009-06-29 11:04:58.684830462 +0200
+--- openssh-5.2p1/session.c.homechroot	2009-07-24 07:11:22.000000000 +0200
++++ openssh-5.2p1/session.c	2009-07-24 07:33:14.000000000 +0200
 @@ -119,6 +119,8 @@ void	do_child(Session *, const char *);
  void	do_motd(void);
  int	check_quietlogin(Session *, const char *);
@@ -46,18 +46,18 @@ diff -up openssh-5.2p1/session.c.homechr
  static void do_authenticated1(Authctxt *);
  static void do_authenticated2(Authctxt *);
  
-@@ -784,6 +786,11 @@ do_exec(Session *s, const char *command)
- {
- 	int ret;
+@@ -802,6 +804,11 @@ do_exec(Session *s, const char *command)
+ 		debug("Forced command (key option) '%.900s'", command);
+ 	}
  
 +	if ((s->is_subsystem != SUBSYSTEM_INT_SFTP) && chroot_no_tree) {
 +		logit("You aren't welcomed, go away!");
 +		exit (1);
 +	}
 +
- 	if (options.adm_forced_command) {
- 		original_command = command;
- 		command = options.adm_forced_command;
+ #ifdef SSH_AUDIT_EVENTS
+ 	if (command != NULL)
+ 		PRIVSEP(audit_run_command(command));
 @@ -1408,6 +1415,7 @@ safely_chroot(const char *path, uid_t ui
  	const char *cp;
  	char component[MAXPATHLEN];
@@ -110,7 +110,7 @@ diff -up openssh-5.2p1/session.c.homechr
  
 diff -up openssh-5.2p1/sftp.c.homechroot openssh-5.2p1/sftp.c
 --- openssh-5.2p1/sftp.c.homechroot	2009-02-14 06:26:19.000000000 +0100
-+++ openssh-5.2p1/sftp.c	2009-06-29 11:06:59.610415272 +0200
++++ openssh-5.2p1/sftp.c	2009-07-24 07:11:29.000000000 +0200
 @@ -94,6 +94,8 @@ int remote_glob(struct sftp_conn *, cons
  
  extern char *__progname;
@@ -122,7 +122,7 @@ diff -up openssh-5.2p1/sftp.c.homechroot
  
 diff -up openssh-5.2p1/sftp-common.c.homechroot openssh-5.2p1/sftp-common.c
 --- openssh-5.2p1/sftp-common.c.homechroot	2006-08-05 04:39:40.000000000 +0200
-+++ openssh-5.2p1/sftp-common.c	2009-06-29 11:05:37.180134733 +0200
++++ openssh-5.2p1/sftp-common.c	2009-07-24 07:11:29.000000000 +0200
 @@ -40,6 +40,7 @@
  #include "xmalloc.h"
  #include "buffer.h"
@@ -149,7 +149,7 @@ diff -up openssh-5.2p1/sftp-common.c.hom
  		snprintf(gbuf, sizeof gbuf, "%u", (u_int)st->st_gid);
 diff -up openssh-5.2p1/sftp-server-main.c.homechroot openssh-5.2p1/sftp-server-main.c
 --- openssh-5.2p1/sftp-server-main.c.homechroot	2009-02-21 22:47:02.000000000 +0100
-+++ openssh-5.2p1/sftp-server-main.c	2009-06-29 11:07:13.704123635 +0200
++++ openssh-5.2p1/sftp-server-main.c	2009-07-24 07:11:29.000000000 +0200
 @@ -22,11 +22,14 @@
  #include <stdarg.h>
  #include <stdio.h>

openssh-5.2p1-sesftp.patch:
 session.c |   26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

Index: openssh-5.2p1-sesftp.patch
===================================================================
RCS file: /cvs/pkgs/rpms/openssh/devel/openssh-5.2p1-sesftp.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -p -r1.3 -r1.4
--- openssh-5.2p1-sesftp.patch	22 Jul 2009 14:22:03 -0000	1.3
+++ openssh-5.2p1-sesftp.patch	24 Jul 2009 06:15:35 -0000	1.4
@@ -39,7 +39,7 @@ diff -up openssh-5.2p1/session.c.sesftp 
 +				strcpy (c2 + l, "sftpd_t");
 +				if ((cx = index (cx + 1, ':')))
 +					strcat (c2, cx);
-+logit ("<= %s", c1); logit ("=> %s", c2);				if (setcon ("system_u:system_r:sftpd_t:s0-s0:c0.c1023") < 0) 
++				if (setcon ("system_u:system_r:sftpd_t:s0-s0:c0.c1023") < 0) 
 +					logit("do_child: setcon failed witch %s", strerror (errno));
 +			
 +			}


Index: openssh.spec
===================================================================
RCS file: /cvs/pkgs/rpms/openssh/devel/openssh.spec,v
retrieving revision 1.152
retrieving revision 1.153
diff -u -p -r1.152 -r1.153
--- openssh.spec	17 Jul 2009 07:06:59 -0000	1.152
+++ openssh.spec	24 Jul 2009 06:15:35 -0000	1.153
@@ -63,7 +63,7 @@
 Summary: An open source implementation of SSH protocol versions 1 and 2
 Name: openssh
 Version: 5.2p1
-Release: 14%{?dist}%{?rescue_rel}
+Release: 15%{?dist}%{?rescue_rel}
 URL: http://www.openssh.com/portable.html
 #Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 #Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -472,6 +472,10 @@ fi
 %endif
 
 %changelog
+* Fri Jul 24 2009 Jan F. Chadima <jchadima at redhat.com> - 5.2p1-15
+- only INTERNAL_SFTP can be home-chrooted
+- save _u and _r parts of context changing to sftpd_t
+
 * Fri Jul 17 2009 Jan F. Chadima <jchadima at redhat.com> - 5.2p1-14
 - changed internal-sftp context to sftpd_t