Makefile     |  4 ++--
 pam_mktemp.c | 36 ++++++++++++++++++++++++++----------
 2 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/Makefile b/Makefile
index 55dd81e..9afcfea 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ RM = rm -f
 MKDIR = mkdir -p
 INSTALL = install -c
 CFLAGS = -Wall -O2 -fPIC
-LDFLAGS = -s --shared -Wl,--version-script,$(MAP)
+LDFLAGS = --shared -Wl,--version-script,$(MAP)
 LDLIBS = -lpam
 
 # This requires GNU make
@@ -23,7 +23,7 @@ endif
 TITLE = pam_mktemp
 PAM_SO_SUFFIX =
 LIBSHARED = $(TITLE).so$(PAM_SO_SUFFIX)
-SHLIBMODE = 755
+SHLIBMODE = 644
 SECUREDIR = /lib/security
 DESTDIR =
 
diff --git a/pam_mktemp.c b/pam_mktemp.c
index bf95512..7546bc4 100644
--- a/pam_mktemp.c
+++ b/pam_mktemp.c
@@ -23,6 +23,7 @@
  * is built with SELinux support, it creates directories in the proper context.
  */
 #include <selinux/selinux.h>
+#include <selinux/label.h>
 #endif /* USE_SELINUX */
 
 #ifndef HAVE_APPEND_FL
@@ -107,9 +108,9 @@ static int ext2fs_chflags(const char *name, int set, int clear)
 #endif /* HAVE_APPEND_FL */
 
 #ifdef USE_SELINUX
-static int check_scontext(const security_context_t scontext, const char *file)
+static int check_scontext(const char *scontext, const char *file)
 {
-	security_context_t fscon = NULL;
+	char *fscon = NULL;
 	int ret;
 
 	if (getfilecon(file, &fscon) < 0)
@@ -146,10 +147,13 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
 	const char *user;
 	char *userdir = NULL;
 	int usergroups;
+	int mode;
 	int status;
 #ifdef USE_SELINUX
-	security_context_t old_fscreatecon, new_fscreatecon = NULL;
+	char *old_fscreatecon = NULL;
+	char *new_fscreatecon = NULL;
 	int fscreatecon_saved = 0, selinux_enabled;
+	struct selabel_handle *label_handle = NULL;
 #endif /* USE_SELINUX */
 
 	if (geteuid() != 0)
@@ -188,8 +192,11 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
  * selinux_enabled will be reset to 0, to skip subsequent SELinux
  * function calls. */
 	selinux_enabled = is_selinux_enabled() > 0;
-	if (selinux_enabled && matchpathcon_init_prefix(NULL, PRIVATE_PREFIX))
-		selinux_enabled = 0;
+	if (selinux_enabled) {
+		label_handle = selabel_open(SELABEL_CTX_FILE, NULL, 0);
+		if (label_handle == NULL)
+			selinux_enabled = 0;
+	}
 
 	/* Save current file creation context. */
 	if (selinux_enabled) {
@@ -200,15 +207,21 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
 	}
 	/* Set file creation context before mkdir() call. */
 	if (selinux_enabled) {
-		if (matchpathcon(PRIVATE_PREFIX, S_IFDIR, &new_fscreatecon) ||
+		if (selabel_lookup(label_handle, &new_fscreatecon, PRIVATE_PREFIX, S_IFDIR) ||
 		    setfscreatecon(new_fscreatecon))
 			selinux_enabled = 0;
 	}
 #endif /* USE_SELINUX */
 
+	/* Inherit PRIVATE_PREFIX directory permissions from /home. */
+	if (stat("/home", &st))
+		mode = 0711;
+	else
+		mode = (st.st_mode | 0711) & 0755;
+
 /* This directory should be created at system installation or bootup time and
  * never removed, or there's the obvious DoS possibility here. */
-	if (mkdir(PRIVATE_PREFIX, 0711) && errno != EEXIST)
+	if (mkdir(PRIVATE_PREFIX, mode) && errno != EEXIST)
 		goto out;
 
 	if (lstat(PRIVATE_PREFIX, &st) ||
@@ -216,7 +229,9 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
 	    st.st_uid != 0)
 		goto out;
 
-	if ((st.st_mode & 0777) != 0711 && chmod(PRIVATE_PREFIX, 0711))
+	if ((st.st_mode & 0777) != mode &&
+	    chmod(PRIVATE_PREFIX, mode) &&
+	    (st.st_mode & 0777 & ~mode) != 0)
 		goto out;
 
 #ifdef USE_SELINUX
@@ -247,7 +262,7 @@ PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
 	if (selinux_enabled) {
 		freecon(new_fscreatecon);
 		new_fscreatecon = NULL;
-		if (matchpathcon(userdir, S_IFDIR, &new_fscreatecon) ||
+		if (selabel_lookup(label_handle, &new_fscreatecon, userdir, S_IFDIR) ||
 		    setfscreatecon(new_fscreatecon))
 			selinux_enabled = 0;
 	}
@@ -293,7 +308,8 @@ out:
 		freecon(old_fscreatecon);
 	}
 	freecon(new_fscreatecon);
-	matchpathcon_fini();
+	if (label_handle)
+		selabel_close(label_handle);
 #endif /* USE_SELINUX */
 	free(userdir);