openssh (1:9.1p1-1) [PTS] [DDPO]

NEW: VCS has unreleased changes: 1:9.1p1-2 > 1:9.1p1-1

Git: https://salsa.debian.org/ssh-team/openssh.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Browser: https://salsa.debian.org/ssh-team/openssh
Last scan: 2022-12-04 23:11:19+00
Next scan: 2022-12-13 06:50:00+00
Merge requests: 4
CI pipeline status: success

Debian changelog in Git:

openssh (1:9.1p1-2) UNRELEASED; urgency=medium

  [ Christian Göttsche ]
  * Do not copy SELinux security context in postinst.

 -- Colin Watson <cjwatson@debian.org>  Tue, 15 Nov 2022 15:02:31 +0000

This branch is 3 commits ahead of tag debian/1%9.1p1-1

Git log:

commit f1b82547e654ea81ab2f0cd40d7d98a3a30a7ef7
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Nov 15 15:03:14 2022 +0000

    Add changelog entry

commit 02a7b703c69f875874c34db3ebc43396312ec486
Merge: 9ac317d87 987f81c3c
Author: Colin Watson <cjwatson@debian.org>
Date:   Tue Nov 15 15:02:35 2022 +0000

    Merge branch 'selinux' into 'master'
    
    Do not copy security context in postinst
    
    See merge request ssh-team/openssh!19

commit 987f81c3cdcaf5bf13c01e965ab4628df2185a70
Author: Christian Göttsche <cgzones@googlemail.com>
Date:   Tue Nov 15 15:31:11 2022 +0100

    Do not copy security context in postinst
    
    Do not copy the SELinux context of the example configuration file in
    the postinst script of openssh-server, cause the source context might
    not be valid at the destination, e.g. if /tmp is mounted on a tmpfs:
    
        type=PROCTITLE msg=audit(11/15/22 15:02:37.425:138) : proctitle=cp -a /usr/share/openssh/sshd_config /tmp/tmp.ElPamcNGQn
        type=PATH msg=audit(11/15/22 15:02:37.425:138) : item=0 name=/tmp/tmp.ElPamcNGQn inode=271 dev=00:26 mode=file,600 ouid=root ogid=root rdev=00:00 obj=root:object_r:dpkg_script_tmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
        type=CWD msg=audit(11/15/22 15:02:37.425:138) : cwd=/
        type=SYSCALL msg=audit(11/15/22 15:02:37.425:138) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x7ffca403b605 a1=0x7f5a8198079d a2=0x5559c429dcc0 a3=0x1b items=1 ppid=6632 pid=6634 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts6 ses=4 comm=cp exe=/usr/bin/cp subj=root:sysadm_r:dpkg_script_t:s0-s0:c0.c1023 key=(null)
        type=AVC msg=audit(11/15/22 15:02:37.425:138) : avc:  denied  { associate } for  pid=6634 comm=cp name=tmp.ElPamcNGQn dev="tmpfs" ino=271 scontext=system_u:object_r:usr_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0
    
    Use the default context for the target instead.
    
    Also create /etc/ssh with the default SELinux context.