Commit Graph

13 Commits

Author SHA1 Message Date
bauen1
5124a48bf5
ssh: fix for debian wrapper script
debian ships a wrapper script that moves the ssh-agent socket to
/run/user/$UID/openssh_agent

Signed-off-by: bauen1 <j2468h@gmail.com>
2020-04-24 15:29:17 +02:00
Chris PeBenito
69a403cd97 Rename *_var_run_t types to *_runtime_t.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-30 20:02:43 -04:00
Nicolas Iooss
69c742f11b
Support systems with a single /usr/bin directory
On systems such as Arch Linux, all programs which are usually located in
/bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the
other locations are symbolic links to this directory.  With such a
configuration, the file contexts which define types for files in
/bin, /sbin and /usr/sbin need to be duplicated to provide definitions
for /usr/bin/...

As the "/bin vs. /usr/bin" part of the needed definitions has already
been done with the "usr merge" patches, the next step consists in
duplicating file contexts for /usr/sbin. This is what this patch does
for all modules which are not in contrib.

This is the second iteration of an idea I have previously posted on
http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 20:49:07 +02:00
cgzones
7d376d7e4d transition file contexts to /run
Remove file context aliases and update file context paths to use the /run filesystem path.
Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321
Lock files are still seated at /var/lock
2016-12-17 18:32:39 +01:00
Nicolas Iooss
ce2982bf50 Label OpenSSH systemd unit files
On Arch Linux, OpenSSH unit files are:
    /usr/lib/systemd/system/sshdgenkeys.service
    /usr/lib/systemd/system/sshd.service
    /usr/lib/systemd/system/sshd@.service
    /usr/lib/systemd/system/sshd.socket

On Debian jessie, the unit files are:
    /lib/systemd/system/ssh.service
    /lib/systemd/system/ssh@.service
    /lib/systemd/system/ssh.socket

On Fedora 22, the unit files are:
    /usr/lib/systemd/system/sshd-keygen.service
    /usr/lib/systemd/system/sshd.service
    /usr/lib/systemd/system/sshd@.service
    /usr/lib/systemd/system/sshd.socket

Use a pattern which matches every sshd unit and introduce an other type
for ssh-keygen units.
2016-01-05 13:22:52 -05:00
Nicolas Iooss
3505a51d76 Label OpenSSH files correctly on Arch Linux
On Arch Linux, OpenSSH installs these binary files in /usr/lib/ssh:

* sftp-server (labeled with ssh_keysign_exec_t type in refpolicy)
* ssh-askpass (symlink to x11-ssh-askpass)
* ssh-keysign
* ssh-pkcs11-helper
* x11-ssh-askpass (from x11-ssh-askpass package)

Label all these files but sftp-server as bin_t.
2016-01-05 13:22:52 -05:00
Laurent Bigonville
f2313e5304 Add fcontext for sshd pidfile and directory used for privsep
Also allow sshd_t domain to chroot(2) in this directory as explained in
the README.privsep file in the openssh tarball.

Thanks to Russell Coker for this patch
2014-02-06 09:14:31 -05:00
Laurent Bigonville
b20a9b30bc Properly label all the ssh host keys
Be sure that we are labeling properly all ssh host keys even if new
algorithms are added in the future.
2012-12-07 00:15:59 -05:00
Laurent Bigonville
28067a810a Add Debian location for ssh-keysign 2012-11-26 11:12:40 -05:00
Chris PeBenito
cde15072d0 SSH patch from Dan Walsh. 2010-01-15 15:28:27 -05:00
Chris PeBenito
296273a719 trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
Chris PeBenito
350b6ab767 trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00
Chris PeBenito
17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00