Skip to content

Conversation

ensc
Copy link

@ensc ensc commented Nov 11, 2018

Commit adds SELinux support to dropbear by:

  • adding a new '--enable-selinux' option to configure; by default, it
    is disabled. This option defines an ENABLE_SELINUX preprocessor
    macro.

  • mapping the unix username to the SELinux user which is stored in a
    new 'user_sid' attribute in the AuthState object

  • relabeling the controlling pty

  • setting the context for the next execve() call to the user_sid

Operations above will not be done when SELinux is disabled. Failures will
generate LOG_ERR messages and in enforcing SELinux mode, dropbear_exit()
will be called.

Signed-off-by: Enrico Scholz [email protected]

@ensc ensc changed the title added selinu support added selinux support Nov 11, 2018
Copy link
Owner

@mkj mkj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I've noted a few changes.
Out of interest what platform are you using?

Commit adds SELinux support to dropbear by:

- adding a new '--enable-selinux' option to configure; by default, it
  is disabled.  This option defines an ENABLE_SELINUX preprocessor
  macro.

- mapping the unix username to the SELinux user which is stored in a
  new 'user_sid' attribute in the AuthState object

- relabeling the controlling pty

- setting the context for the next execve() call to the user_sid

Operations above will not be done when SELinux is disabled.  Failures will
generate LOG_ERR messages and in enforcing SELinux mode, dropbear_exit()
will be called.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
Copy link
Author

ensc commented Nov 23, 2018

I think, I addressed all the issues.

I am using it in an OpenEmbedded based project:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants