nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ssh, roles: use user exec domain attribute

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-08-08 11:03:01 -04:00
parent 86462c81ec
commit 562d61bda9
4 changed files with 36 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/roles/staff.te
View File

@ -45,7 +45,7 @@ optional_policy(`
')
optional_policy(`
ssh_role_template(staff, staff_r, staff_t)
ssh_role_template(staff, staff_t, staff_application_exec_domain, staff_r)
')
optional_policy(`

2
policy/modules/roles/sysadm.te
View File

@ -992,7 +992,7 @@ optional_policy(`
')
optional_policy(`
ssh_role_template(sysadm, sysadm_r, sysadm_t)
ssh_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
')
optional_policy(`

2
policy/modules/roles/unprivuser.te
View File

@ -147,7 +147,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
ssh_role_template(user, user_r, user_t)
ssh_role_template(user, user_t, user_application_exec_domain, user_r)
')
optional_policy(`

49
policy/modules/services/ssh.if
View File

@ -143,6 +143,10 @@ template(`ssh_basic_client_template',`
optional_policy(`
kerberos_use($1_ssh_t)
')
optional_policy(`
systemd_user_app_status($1, $1_ssh_t)
')
')
#######################################
@ -281,20 +285,25 @@ template(`ssh_server_template', `
## </summary>
## <param name="role_prefix">
## <summary>
## The prefix of the role (e.g., user
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## User domain for the role.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
## <param name="domain">
## <summary>
## User domain for the role
## </summary>
## </param>
#
template(`ssh_role_template',`
gen_require(`
@ -309,12 +318,12 @@ template(`ssh_role_template',`
# Declarations
#
role $2 types ssh_t;
role $4 types ssh_t;
type $1_ssh_agent_t, ssh_agent_type;
userdom_user_application_domain($1_ssh_agent_t, ssh_agent_exec_t)
domain_interactive_fd($1_ssh_agent_t)
role $2 types $1_ssh_agent_t;
role $4 types $1_ssh_agent_t;
##############################
#
@ -338,11 +347,15 @@ template(`ssh_role_template',`
allow ssh_t $3:key manage_key_perms;
# user can manage the keys and config
manage_files_pattern($3, ssh_home_t, ssh_home_t)
manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)
manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)
manage_files_pattern($2, ssh_home_t, ssh_home_t)
manage_lnk_files_pattern($2, ssh_home_t, ssh_home_t)
manage_sock_files_pattern($2, ssh_home_t, ssh_home_t)
userdom_search_user_home_dirs($1_t)
optional_policy(`
systemd_user_app_status($1, ssh_t)
')
##############################
#
# SSH agent local policy
@ -379,8 +392,8 @@ template(`ssh_role_template',`
fs_search_auto_mountpoints($1_ssh_agent_t)
# transition back to normal privs upon exec
corecmd_shell_domtrans($1_ssh_agent_t, $3)
corecmd_bin_domtrans($1_ssh_agent_t, $3)
corecmd_shell_domtrans($1_ssh_agent_t, $2)
corecmd_bin_domtrans($1_ssh_agent_t, $2)
domain_use_interactive_fds($1_ssh_agent_t)
@ -402,7 +415,7 @@ template(`ssh_role_template',`
# for the transition back to normal privs upon exec
userdom_search_user_home_content($1_ssh_agent_t)
userdom_user_home_domtrans($1_ssh_agent_t, $3)
userdom_user_home_domtrans($1_ssh_agent_t, $2)
allow $3 $1_ssh_agent_t:fd use;
allow $3 $1_ssh_agent_t:fifo_file rw_inherited_fifo_file_perms;
allow $3 $1_ssh_agent_t:process sigchld;
@ -415,20 +428,24 @@ template(`ssh_role_template',`
fs_manage_nfs_files($1_ssh_agent_t)
# transition back to normal privs upon exec
fs_nfs_domtrans($1_ssh_agent_t, $3)
fs_nfs_domtrans($1_ssh_agent_t, $2)
')
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_ssh_agent_t)
# transition back to normal privs upon exec
fs_cifs_domtrans($1_ssh_agent_t, $3)
fs_cifs_domtrans($1_ssh_agent_t, $2)
')
optional_policy(`
nis_use_ypbind($1_ssh_agent_t)
')
optional_policy(`
systemd_user_app_status($1, $1_ssh_agent_t)
')
optional_policy(`
tunable_policy(`ssh_use_gpg_agent',`
# for ssh-add