selinux-refpolicy/strict/domains/program/ssh.te

#DESC SSH - SSH daemon
#
# Authors:  Anthony Colatrella (NSA) <amcolat@epoch.ncsc.mil>
#           Stephen Smalley <sds@epoch.ncsc.mil>
#           Russell Coker <russell@coker.com.au>
# X-Debian-Packages: ssh
#

# Allow ssh logins as sysadm_r:sysadm_t
bool ssh_sysadm_login false;

# allow host key based authentication
bool allow_ssh_keysign false;

ifdef(`inetd.te', `
# Allow ssh to run from inetd instead of as a daemon.
bool run_ssh_inetd false;
')

# sshd_exec_t is the type of the sshd executable.
# sshd_key_t is the type of the ssh private key files
type sshd_exec_t, file_type, exec_type, sysadmfile;
type sshd_key_t, file_type, sysadmfile;

define(`sshd_program_domain', `
# privowner is for changing the identity on the terminal device
# privfd is for passing the terminal file handle to the user process
# auth_chkpwd is for running unix_chkpwd and unix_verify.
type $1_t, domain, privuser, privrole, privlog, privowner, privfd, auth_chkpwd, nscd_client_domain, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade, mlsprocsetsl;
can_exec($1_t, sshd_exec_t)
r_dir_file($1_t, self)
role system_r types $1_t;
dontaudit $1_t shadow_t:file { getattr read };
uses_shlib($1_t)
allow $1_t self:unix_dgram_socket create_socket_perms;
allow $1_t self:unix_stream_socket create_stream_socket_perms;
allow $1_t self:fifo_file rw_file_perms;
allow $1_t self:process { fork sigchld signal setsched setrlimit };

dontaudit $1_t self:lnk_file read;

# do not allow statfs()
dontaudit $1_t fs_type:filesystem getattr;

allow $1_t bin_t:dir search;
allow $1_t bin_t:lnk_file read;

# for sshd subsystems, such as sftp-server.
allow $1_t bin_t:file getattr;

# Read /var.
allow $1_t var_t:dir { getattr search };

# Read /var/log.
allow $1_t var_log_t:dir search;

# Read /etc.
allow $1_t etc_t:dir search;
# ioctl is for pam_console
dontaudit $1_t etc_t:file ioctl;
allow $1_t etc_t:file { getattr read };
allow $1_t etc_t:lnk_file { getattr read };
allow $1_t etc_runtime_t:file { getattr read };

# Read and write /dev/tty and /dev/null.
allow $1_t devtty_t:chr_file rw_file_perms;
allow $1_t { null_device_t zero_device_t }:chr_file rw_file_perms;

# Read /dev/urandom
allow $1_t urandom_device_t:chr_file { getattr read };

can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
can_kerberos($1_t)

allow $1_t self:capability { kill sys_chroot sys_resource chown dac_override fowner fsetid setgid setuid sys_tty_config };
allow $1_t { home_root_t home_dir_type }:dir { search getattr };
if (use_nfs_home_dirs) {
allow $1_t autofs_t:dir { search getattr };
allow $1_t nfs_t:dir { search getattr };
allow $1_t nfs_t:file { getattr read };
}

if (use_samba_home_dirs) {
allow $1_t cifs_t:dir { search getattr };
allow $1_t cifs_t:file { getattr read };
}

# Set exec context.
can_setexec($1_t)

# Update utmp.
allow $1_t initrc_var_run_t:file rw_file_perms;

# Update wtmp.
allow $1_t wtmp_t:file rw_file_perms;

# Get security policy decisions.
can_getsecurity($1_t)

# Allow read access to login context
r_dir_file( $1_t, default_context_t)

# Access key files
allow $1_t sshd_key_t:file { getattr read };

# Update /var/log/lastlog.
allow $1_t lastlog_t:file rw_file_perms;

read_locale($1_t)
read_sysctl($1_t)

# Can create ptys
can_create_pty($1, `, server_pty')
allow $1_t $1_devpts_t:chr_file { setattr getattr relabelfrom };
dontaudit sshd_t userpty_type:chr_file relabelfrom;

allow $1_t faillog_t:file { append getattr };
allow $1_t sbin_t:file getattr;

# Allow checking users mail at login
allow $1_t { var_spool_t mail_spool_t }:dir search;
allow $1_t mail_spool_t:lnk_file read;
allow $1_t mail_spool_t:file getattr;
')dnl end sshd_program_domain

# macro for defining which domains a sshd can spawn
# $1_t is the domain of the sshd, $2 is the domain to be spawned, $3 is the
# type of the pty for the child
define(`sshd_spawn_domain', `
login_spawn_domain($1, $2)
ifdef(`xauth.te', `
domain_trans($1_t, xauth_exec_t, $2)
')

# Relabel and access ptys created by sshd
# ioctl is necessary for logout() processing for utmp entry and for w to
# display the tty.
# some versions of sshd on the new SE Linux require setattr
allow $1_t $3:chr_file { relabelto read write getattr ioctl setattr };

# inheriting stream sockets is needed for "ssh host command" as no pty
# is allocated
allow $2 $1_t:unix_stream_socket rw_stream_socket_perms;
')dnl end sshd_spawn_domain definition

#################################
#
# Rules for the sshd_t domain, et al.
#
# sshd_t is the domain for the sshd program.
# sshd_extern_t is the domain for ssh from outside our network
#
sshd_program_domain(sshd)
if (ssh_sysadm_login) {
allow sshd_t devpts_t:dir r_dir_perms;
sshd_spawn_domain(sshd, userdomain, { sysadm_devpts_t userpty_type })
} else {
sshd_spawn_domain(sshd, unpriv_userdomain, userpty_type)
}

# for X forwarding
allow sshd_t xserver_port_t:tcp_socket name_bind;

r_dir_file(sshd_t, selinux_config_t)
sshd_program_domain(sshd_extern)
sshd_spawn_domain(sshd_extern, user_mini_domain, mini_pty_type)

# for when the network connection breaks after running newrole -r sysadm_r
dontaudit sshd_t sysadm_devpts_t:chr_file setattr;

ifdef(`inetd.te', `
if (run_ssh_inetd) {
allow inetd_t ssh_port_t:tcp_socket name_bind;
domain_auto_trans(inetd_t, sshd_exec_t, sshd_t)
domain_trans(inetd_t, sshd_exec_t, sshd_extern_t)
allow { sshd_t sshd_extern_t } inetd_t:tcp_socket rw_socket_perms;
allow { sshd_t sshd_extern_t } var_run_t:dir { getattr search };
allow { sshd_t sshd_extern_t } self:process signal;
} else {
')
can_access_pty({ sshd_t sshd_extern_t }, initrc)
allow { sshd_t sshd_extern_t } self:capability net_bind_service;
allow { sshd_t sshd_extern_t } ssh_port_t:tcp_socket name_bind;

# for port forwarding
can_tcp_connect(userdomain, sshd_t)

domain_auto_trans(initrc_t, sshd_exec_t, sshd_t)
domain_trans(initrc_t, sshd_exec_t, sshd_extern_t)
dontaudit initrc_t sshd_key_t:file { getattr read };

# Inherit and use descriptors from init.
allow { sshd_t sshd_extern_t } init_t:fd use;
ifdef(`inetd.te', `
}
')

# Create /var/run/sshd.pid
var_run_domain(sshd)
var_run_domain(sshd_extern)

ifdef(`direct_sysadm_daemon', `
# Direct execution by sysadm_r.
domain_auto_trans(sysadm_t, sshd_exec_t, sshd_t)
role_transition sysadm_r sshd_exec_t system_r;
')

undefine(`sshd_program_domain')

# so a tunnel can point to another ssh tunnel...
can_tcp_connect(sshd_t, sshd_t)

tmp_domain(sshd, `', { dir file sock_file })
ifdef(`pam.te', `
can_exec(sshd_t, pam_exec_t)
')

# ssh_keygen_t is the type of the ssh-keygen program when run at install time
# and by sysadm_t
daemon_base_domain(ssh_keygen)
allow ssh_keygen_t etc_t:file { getattr read };
file_type_auto_trans(ssh_keygen_t, etc_t, sshd_key_t, file)

# Type for the ssh executable.
type ssh_exec_t, file_type, exec_type, sysadmfile;
type ssh_keysign_exec_t, file_type, exec_type, sysadmfile;

# Everything else is in the ssh_domain macro in
# macros/program/ssh_macros.te.

allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms;
allow ssh_keygen_t sysadm_tty_device_t:chr_file { read write };
allow ssh_keygen_t urandom_device_t:chr_file { getattr read };
ifdef(`use_mcs', `
range_transition initrc_t sshd_exec_t s0 - s0:c0.c255;
')