I have just filed Debian bug report #556644 against the version of openssh-server in Debian/Unstable (Squeeze). Â It has a patch that moves the code to set the SE Linux context for the child process before calling chroot. Without this a chroot environment on a SE Linux system can only work correctly if /proc and /selinux are mounted in the chroot environment.
deb http://www.coker.com.au squeeze selinux
I’ve created the above APT repository for Squeeze which has a package that fixes this bug. I will continue to use that repository for a variety of SE Linux patches to Squeeze packages, at the moment it’s packages from Unstable but I will also modify released packages as needed.
The bug report #498684 has a fix for a trivial uninitialised variable bug. The fix is also in my build.
Also I filed the bug report #556648 about the internal version of sftp being
incompatible with SE Linux (it doesn’t involve an exec so the context doesn’t change). The correct thing to do is for sshd to refuse to run an internal sftpd at least if the system is in enforcing mode, and probably even in permissive mode.
deb http://www.coker.com.au lenny selinux
Update: I’ve also backported my sshd changes to Lenny at the above APT repository.
Rememeber thet Debian/Unstable is named Sid, Squeeze is the current testing brach.