diff mbox series

[meta-selinux,wrynose] openssh: restore SELinux labels for /var/run/sshd

Message ID 20260807125219.420529-1-yannik.tannhaeuser@gmail.com
State New
Headers show
Series [meta-selinux,wrynose] openssh: restore SELinux labels for /var/run/sshd | expand

Commit Message

Yannik Tannhaeuser Aug. 7, 2026, 12:52 p.m. UTC 
Since /var/run/sshd is in most deployments a tmpfs, we need to call
restorecon to set the correct SELinux labels each time.

Signed-off-by: Yannik Tannhaeuser <yannik.tannhaeuser@gmail.com>
---
 .../openssh/files/var-run-sshd-restorecon.conf              | 2 ++
 recipes-connectivity/openssh/openssh_selinux.inc            | 6 ++++++
 2 files changed, 8 insertions(+)
 create mode 100644 recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf
diff mbox series

Patch

diff --git a/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf b/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf
new file mode 100644
index 0000000..250dc4f
--- /dev/null
+++ b/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf
@@ -0,0 +1,2 @@ 
+[Socket]
+ExecStartPre=/sbin/restorecon /var/run/sshd
diff --git a/recipes-connectivity/openssh/openssh_selinux.inc b/recipes-connectivity/openssh/openssh_selinux.inc
index 119ce63..6fb105d 100644
--- a/recipes-connectivity/openssh/openssh_selinux.inc
+++ b/recipes-connectivity/openssh/openssh_selinux.inc
@@ -4,15 +4,21 @@  FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
 SRC_URI += " \
     file://50-selinux.conf \
+    file://var-run-sshd-restorecon.conf \
 "
 
 do_install:append() {
     install -d ${D}${sysconfdir}/ssh/sshd_config.d
     install -m 0644 ${UNPACKDIR}/50-selinux.conf \
         ${D}${sysconfdir}/ssh/sshd_config.d/50-selinux.conf
+
+    install -d ${D}${systemd_system_unitdir}/sshd.socket.d
+    install -m 0644 ${UNPACKDIR}/var-run-sshd-restorecon.conf \
+        ${D}${systemd_system_unitdir}/sshd.socket.d/var-run-sshd-restorecon.conf
 }
 
 FILES:${PN}-sshd:append = " ${sysconfdir}/ssh/sshd_config.d/50-selinux.conf"
+FILES:${PN}-sshd:append = " ${systemd_system_unitdir}/sshd.socket.d/var-run-sshd-restorecon.conf"
 
 PACKAGECONFIG[selinux] = "--with-selinux,--without-selinux,libselinux"
 PACKAGECONFIG[audit] = "--with-audit=linux,--without-audit,audit"