RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssh: fix for debian wrapper script 

debian ships a wrapper script that moves the ssh-agent socket to
/run/user/$UID/openssh_agent

Signed-off-by: bauen1 <j2468h@gmail.com>
This commit is contained in:
bauen1 2020-04-22 19:24:38 +02:00
parent 466b59f447
commit 5124a48bf5
No known key found for this signature in database
GPG Key ID: FF0AAF5E0812BA9C
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/services/ssh.fc
View File

@ -22,3 +22,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
/run/sshd(/.*)? gen_context(system_u:object_r:sshd_runtime_t,s0) /run/sshd(/.*)? gen_context(system_u:object_r:sshd_runtime_t,s0)
/run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_runtime_t,s0) /run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_runtime_t,s0)
/run/sshd\.pid -- gen_context(system_u:object_r:sshd_runtime_t,s0) /run/sshd\.pid -- gen_context(system_u:object_r:sshd_runtime_t,s0)
ifdef(`distro_debian',`
/run/user/%{USERID}/openssh_agent -s gen_context(system_u:object_r:ssh_agent_tmp_t,s0)
')

4
policy/modules/services/ssh.if
View File

@ -408,6 +408,10 @@ template(`ssh_role_template',`
allow $3 $1_ssh_agent_t:fifo_file rw_inherited_fifo_file_perms; allow $3 $1_ssh_agent_t:fifo_file rw_inherited_fifo_file_perms;
allow $3 $1_ssh_agent_t:process sigchld; allow $3 $1_ssh_agent_t:process sigchld;
ifdef(`distro_debian', `
userdom_user_runtime_filetrans($1_ssh_agent_t, ssh_agent_tmp_t, sock_file)
')
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files($1_ssh_agent_t) fs_manage_nfs_files($1_ssh_agent_t)