495e2c203b
Remove complement (~) and wildcard (*) in allow rules so that there are no unintentional additions when new permissions are declared. This patch does not add or remove permissions from any rules.
776 lines
18 KiB
Plaintext
776 lines
18 KiB
Plaintext
## <summary>Secure shell client and server policy.</summary>
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Basic SSH client template.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## This template creates a derived domains which are used
|
|
## for ssh client sessions. A derived
|
|
## type is also created to protect the user ssh keys.
|
|
## </p>
|
|
## <p>
|
|
## This template was added for NX.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="userdomain_prefix">
|
|
## <summary>
|
|
## The prefix of the domain (e.g., user
|
|
## is the prefix for user_t).
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_domain">
|
|
## <summary>
|
|
## The type of the domain.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_role">
|
|
## <summary>
|
|
## The role associated with the user domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
template(`ssh_basic_client_template',`
|
|
|
|
gen_require(`
|
|
attribute ssh_server;
|
|
type ssh_exec_t, sshd_key_t, sshd_tmp_t;
|
|
')
|
|
|
|
##############################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type $1_ssh_t;
|
|
application_domain($1_ssh_t, ssh_exec_t)
|
|
role $3 types $1_ssh_t;
|
|
|
|
type $1_ssh_home_t;
|
|
files_type($1_ssh_home_t)
|
|
typealias $1_ssh_home_t alias $1_home_ssh_t;
|
|
|
|
##############################
|
|
#
|
|
# Client local policy
|
|
#
|
|
|
|
allow $1_ssh_t self:capability { dac_override dac_read_search setgid setuid };
|
|
allow $1_ssh_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr noatsecure siginh rlimitinh dyntransition setkeycreate setsockcreate getrlimit };
|
|
allow $1_ssh_t self:fd use;
|
|
allow $1_ssh_t self:fifo_file rw_fifo_file_perms;
|
|
allow $1_ssh_t self:unix_dgram_socket { create_socket_perms sendto };
|
|
allow $1_ssh_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
allow $1_ssh_t self:shm create_shm_perms;
|
|
allow $1_ssh_t self:sem create_sem_perms;
|
|
allow $1_ssh_t self:msgq create_msgq_perms;
|
|
allow $1_ssh_t self:msg { send receive };
|
|
allow $1_ssh_t self:tcp_socket create_stream_socket_perms;
|
|
|
|
# for rsync
|
|
allow $1_ssh_t $2:unix_stream_socket rw_socket_perms;
|
|
allow $1_ssh_t $2:unix_stream_socket connectto;
|
|
|
|
# Read the ssh key file.
|
|
allow $1_ssh_t sshd_key_t:file read_file_perms;
|
|
|
|
# Access the ssh temporary files.
|
|
allow $1_ssh_t sshd_tmp_t:dir manage_dir_perms;
|
|
allow $1_ssh_t sshd_tmp_t:file manage_file_perms;
|
|
files_tmp_filetrans($1_ssh_t, sshd_tmp_t, { file dir })
|
|
|
|
# Transition from the domain to the derived domain.
|
|
domtrans_pattern($2, ssh_exec_t, $1_ssh_t)
|
|
|
|
# inheriting stream sockets is needed for "ssh host command" as no pty
|
|
# is allocated
|
|
# cjp: should probably fix target to be an attribute for ssh servers
|
|
# or "regular" (not special like sshd_extern_t) servers
|
|
allow $2 ssh_server:unix_stream_socket rw_stream_socket_perms;
|
|
|
|
# allow ps to show ssh
|
|
ps_process_pattern($2, $1_ssh_t)
|
|
|
|
# user can manage the keys and config
|
|
manage_files_pattern($2, $1_ssh_home_t, $1_ssh_home_t)
|
|
manage_lnk_files_pattern($2, $1_ssh_home_t, $1_ssh_home_t)
|
|
manage_sock_files_pattern($2, $1_ssh_home_t, $1_ssh_home_t)
|
|
|
|
# ssh client can manage the keys and config
|
|
manage_files_pattern($1_ssh_t, $1_ssh_home_t, $1_ssh_home_t)
|
|
read_lnk_files_pattern($1_ssh_t, $1_ssh_home_t, $1_ssh_home_t)
|
|
|
|
# ssh servers can read the user keys and config
|
|
allow ssh_server $1_ssh_home_t:dir list_dir_perms;
|
|
read_files_pattern(ssh_server, $1_ssh_home_t, $1_ssh_home_t)
|
|
read_lnk_files_pattern(ssh_server, $1_ssh_home_t, $1_ssh_home_t)
|
|
|
|
kernel_read_kernel_sysctls($1_ssh_t)
|
|
kernel_read_system_state($1_ssh_t)
|
|
|
|
corenet_all_recvfrom_unlabeled($1_ssh_t)
|
|
corenet_all_recvfrom_netlabel($1_ssh_t)
|
|
corenet_tcp_sendrecv_generic_if($1_ssh_t)
|
|
corenet_tcp_sendrecv_generic_node($1_ssh_t)
|
|
corenet_tcp_sendrecv_all_ports($1_ssh_t)
|
|
corenet_tcp_connect_ssh_port($1_ssh_t)
|
|
corenet_sendrecv_ssh_client_packets($1_ssh_t)
|
|
|
|
dev_read_urand($1_ssh_t)
|
|
|
|
fs_getattr_all_fs($1_ssh_t)
|
|
fs_search_auto_mountpoints($1_ssh_t)
|
|
|
|
# run helper programs - needed eg for x11-ssh-askpass
|
|
corecmd_exec_shell($1_ssh_t)
|
|
corecmd_exec_bin($1_ssh_t)
|
|
|
|
domain_use_interactive_fds($1_ssh_t)
|
|
|
|
files_list_home($1_ssh_t)
|
|
files_read_usr_files($1_ssh_t)
|
|
files_read_etc_runtime_files($1_ssh_t)
|
|
files_read_etc_files($1_ssh_t)
|
|
files_read_var_files($1_ssh_t)
|
|
|
|
auth_use_nsswitch($1_ssh_t)
|
|
|
|
logging_send_syslog_msg($1_ssh_t)
|
|
logging_read_generic_logs($1_ssh_t)
|
|
|
|
miscfiles_read_localization($1_ssh_t)
|
|
|
|
seutil_read_config($1_ssh_t)
|
|
|
|
optional_policy(`
|
|
kerberos_use($1_ssh_t)
|
|
')
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## The template to define a ssh server.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## This template creates a domains to be used for
|
|
## creating a ssh server. This is typically done
|
|
## to have multiple ssh servers of different sensitivities,
|
|
## such as for an internal network-facing ssh server, and
|
|
## a external network-facing ssh server.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="userdomain_prefix">
|
|
## <summary>
|
|
## The prefix of the server domain (e.g., sshd
|
|
## is the prefix for sshd_t).
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
template(`ssh_server_template', `
|
|
type $1_t, ssh_server;
|
|
auth_login_pgm_domain($1_t)
|
|
|
|
type $1_devpts_t;
|
|
term_login_pty($1_devpts_t)
|
|
|
|
type $1_tmpfs_t;
|
|
files_tmpfs_file($1_tmpfs_t)
|
|
|
|
type $1_var_run_t;
|
|
files_pid_file($1_var_run_t)
|
|
|
|
allow $1_t self:capability { chown dac_override fowner fsetid kill setgid setuid sys_chroot sys_nice sys_resource sys_tty_config };
|
|
# net_admin is for SO_SNDBUFFORCE
|
|
dontaudit $1_t self:capability net_admin;
|
|
allow $1_t self:fifo_file rw_fifo_file_perms;
|
|
allow $1_t self:process { signal getsched setsched setrlimit setexec setkeycreate };
|
|
allow $1_t self:tcp_socket create_stream_socket_perms;
|
|
allow $1_t self:udp_socket create_socket_perms;
|
|
# ssh agent connections:
|
|
allow $1_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow $1_t self:shm create_shm_perms;
|
|
|
|
allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr getattr relabelfrom };
|
|
term_create_pty($1_t, $1_devpts_t)
|
|
|
|
manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
|
|
fs_tmpfs_filetrans($1_t, $1_tmpfs_t, file)
|
|
|
|
allow $1_t $1_var_run_t:dir search_dir_perms;
|
|
allow $1_t $1_var_run_t:file manage_file_perms;
|
|
files_pid_filetrans($1_t, $1_var_run_t, file)
|
|
|
|
can_exec($1_t, sshd_exec_t)
|
|
|
|
# Access key files
|
|
allow $1_t sshd_key_t:file read_file_perms;
|
|
|
|
kernel_read_kernel_sysctls($1_t)
|
|
kernel_read_network_state($1_t)
|
|
|
|
corenet_all_recvfrom_unlabeled($1_t)
|
|
corenet_all_recvfrom_netlabel($1_t)
|
|
corenet_tcp_sendrecv_generic_if($1_t)
|
|
corenet_udp_sendrecv_generic_if($1_t)
|
|
corenet_raw_sendrecv_generic_if($1_t)
|
|
corenet_tcp_sendrecv_generic_node($1_t)
|
|
corenet_udp_sendrecv_generic_node($1_t)
|
|
corenet_raw_sendrecv_generic_node($1_t)
|
|
corenet_udp_sendrecv_all_ports($1_t)
|
|
corenet_tcp_sendrecv_all_ports($1_t)
|
|
corenet_tcp_bind_generic_node($1_t)
|
|
corenet_udp_bind_generic_node($1_t)
|
|
corenet_tcp_bind_ssh_port($1_t)
|
|
corenet_tcp_connect_all_ports($1_t)
|
|
corenet_sendrecv_ssh_server_packets($1_t)
|
|
|
|
fs_dontaudit_getattr_all_fs($1_t)
|
|
|
|
auth_rw_login_records($1_t)
|
|
auth_rw_faillog($1_t)
|
|
|
|
# for sshd subsystems, such as sftp-server.
|
|
corecmd_getattr_bin_files($1_t)
|
|
|
|
domain_interactive_fd($1_t)
|
|
|
|
files_read_etc_files($1_t)
|
|
files_read_etc_runtime_files($1_t)
|
|
files_read_usr_files($1_t)
|
|
|
|
logging_search_logs($1_t)
|
|
|
|
miscfiles_read_localization($1_t)
|
|
|
|
userdom_create_all_users_keys($1_t)
|
|
userdom_dontaudit_relabelfrom_user_ptys($1_t)
|
|
userdom_search_user_home_dirs($1_t)
|
|
|
|
# Allow checking users mail at login
|
|
optional_policy(`
|
|
mta_getattr_spool($1_t)
|
|
')
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_read_nfs_files($1_t)
|
|
fs_read_nfs_symlinks($1_t)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_read_cifs_files($1_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
kerberos_use($1_t)
|
|
kerberos_manage_host_rcache($1_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
files_read_var_lib_symlinks($1_t)
|
|
nx_spec_domtrans_server($1_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
systemd_read_logind_sessions_files($1_t)
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Role access for ssh
|
|
## </summary>
|
|
## <param name="role_prefix">
|
|
## <summary>
|
|
## The prefix of the role (e.g., user
|
|
## is the prefix for user_r).
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access
|
|
## </summary>
|
|
## </param>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## User domain for the role
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
template(`ssh_role_template',`
|
|
gen_require(`
|
|
attribute ssh_server, ssh_agent_type;
|
|
|
|
type ssh_t, ssh_exec_t, ssh_tmpfs_t, ssh_home_t;
|
|
type ssh_agent_exec_t, ssh_keysign_t, ssh_tmpfs_t;
|
|
type ssh_agent_tmp_t;
|
|
')
|
|
|
|
##############################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
role $2 types ssh_t;
|
|
|
|
type $1_ssh_agent_t, ssh_agent_type;
|
|
userdom_user_application_domain($1_ssh_agent_t, ssh_agent_exec_t)
|
|
domain_interactive_fd($1_ssh_agent_t)
|
|
role $2 types $1_ssh_agent_t;
|
|
|
|
##############################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
# Transition from the domain to the derived domain.
|
|
domtrans_pattern($3, ssh_exec_t, ssh_t)
|
|
|
|
# inheriting stream sockets is needed for "ssh host command" as no pty
|
|
# is allocated
|
|
allow $3 ssh_server:unix_stream_socket rw_stream_socket_perms;
|
|
|
|
# allow ps to show ssh
|
|
ps_process_pattern($3, ssh_t)
|
|
allow $3 ssh_t:process signal;
|
|
|
|
# for rsync
|
|
allow ssh_t $3:unix_stream_socket rw_socket_perms;
|
|
allow ssh_t $3:unix_stream_socket connectto;
|
|
|
|
# user can manage the keys and config
|
|
manage_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
userdom_search_user_home_dirs($1_t)
|
|
|
|
##############################
|
|
#
|
|
# SSH agent local policy
|
|
#
|
|
|
|
allow $1_ssh_agent_t self:process { setrlimit signal };
|
|
allow $1_ssh_agent_t self:capability setgid;
|
|
allow $1_ssh_agent_t self:fifo_file rw_file_perms;
|
|
|
|
allow $1_ssh_agent_t { $1_ssh_agent_t $3 }:process signull;
|
|
|
|
allow $1_ssh_agent_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
|
|
|
manage_dirs_pattern($1_ssh_agent_t, ssh_agent_tmp_t, ssh_agent_tmp_t)
|
|
manage_sock_files_pattern($1_ssh_agent_t, ssh_agent_tmp_t, ssh_agent_tmp_t)
|
|
files_tmp_filetrans($1_ssh_agent_t, ssh_agent_tmp_t, { dir sock_file })
|
|
|
|
# for ssh-add
|
|
stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t)
|
|
|
|
# Allow the user shell to signal the ssh program.
|
|
allow $3 $1_ssh_agent_t:process signal;
|
|
|
|
# allow ps to show ssh
|
|
ps_process_pattern($3, $1_ssh_agent_t)
|
|
|
|
domtrans_pattern($3, ssh_agent_exec_t, $1_ssh_agent_t)
|
|
|
|
kernel_read_kernel_sysctls($1_ssh_agent_t)
|
|
|
|
dev_read_urand($1_ssh_agent_t)
|
|
dev_read_rand($1_ssh_agent_t)
|
|
|
|
fs_search_auto_mountpoints($1_ssh_agent_t)
|
|
|
|
# transition back to normal privs upon exec
|
|
corecmd_shell_domtrans($1_ssh_agent_t, $3)
|
|
corecmd_bin_domtrans($1_ssh_agent_t, $3)
|
|
|
|
domain_use_interactive_fds($1_ssh_agent_t)
|
|
|
|
files_read_etc_files($1_ssh_agent_t)
|
|
files_read_etc_runtime_files($1_ssh_agent_t)
|
|
files_search_home($1_ssh_agent_t)
|
|
|
|
libs_read_lib_files($1_ssh_agent_t)
|
|
|
|
logging_send_syslog_msg($1_ssh_agent_t)
|
|
|
|
miscfiles_read_localization($1_ssh_agent_t)
|
|
miscfiles_read_generic_certs($1_ssh_agent_t)
|
|
|
|
seutil_dontaudit_read_config($1_ssh_agent_t)
|
|
|
|
# Write to the user domain tty.
|
|
userdom_use_user_terminals($1_ssh_agent_t)
|
|
|
|
# for the transition back to normal privs upon exec
|
|
userdom_search_user_home_content($1_ssh_agent_t)
|
|
userdom_user_home_domtrans($1_ssh_agent_t, $3)
|
|
allow $3 $1_ssh_agent_t:fd use;
|
|
allow $3 $1_ssh_agent_t:fifo_file rw_file_perms;
|
|
allow $3 $1_ssh_agent_t:process sigchld;
|
|
|
|
tunable_policy(`use_nfs_home_dirs',`
|
|
fs_manage_nfs_files($1_ssh_agent_t)
|
|
|
|
# transition back to normal privs upon exec
|
|
fs_nfs_domtrans($1_ssh_agent_t, $3)
|
|
')
|
|
|
|
tunable_policy(`use_samba_home_dirs',`
|
|
fs_manage_cifs_files($1_ssh_agent_t)
|
|
|
|
# transition back to normal privs upon exec
|
|
fs_cifs_domtrans($1_ssh_agent_t, $3)
|
|
')
|
|
|
|
optional_policy(`
|
|
nis_use_ypbind($1_ssh_agent_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
tunable_policy(`ssh_use_gpg_agent',`
|
|
# for ssh-add
|
|
gpg_stream_connect_agent($3)
|
|
')
|
|
')
|
|
|
|
optional_policy(`
|
|
xserver_use_xdm_fds($1_ssh_agent_t)
|
|
xserver_rw_xdm_pipes($1_ssh_agent_t)
|
|
xserver_sigchld_xdm($1_ssh_agent_t)
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a SIGCHLD signal to the ssh server.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_sigchld',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:process sigchld;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a generic signal to the ssh server.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_signal',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a null signal to sshd processes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_signull',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:process signull;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read a ssh server unnamed pipe.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_read_pipes',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:fifo_file { getattr read };
|
|
')
|
|
########################################
|
|
## <summary>
|
|
## Read and write a ssh server unnamed pipe.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_rw_pipes',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:fifo_file { write read getattr ioctl };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write ssh server unix domain stream sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_rw_stream_sockets',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:unix_stream_socket rw_stream_socket_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write ssh server TCP sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_rw_tcp_sockets',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
allow $1 sshd_t:tcp_socket rw_stream_socket_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read and write
|
|
## ssh server TCP sockets.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_dontaudit_rw_tcp_sockets',`
|
|
gen_require(`
|
|
type sshd_t;
|
|
')
|
|
|
|
dontaudit $1 sshd_t:tcp_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the ssh daemon in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_exec_sshd',`
|
|
gen_require(`
|
|
type sshd_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, sshd_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the ssh daemon sshd domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_domtrans',`
|
|
gen_require(`
|
|
type sshd_t, sshd_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1, sshd_exec_t, sshd_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the ssh client in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_exec',`
|
|
gen_require(`
|
|
type ssh_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, ssh_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Set the attributes of sshd key files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_setattr_key_files',`
|
|
gen_require(`
|
|
type sshd_key_t;
|
|
')
|
|
|
|
allow $1 sshd_key_t:file setattr;
|
|
files_search_pids($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the ssh agent client in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_agent_exec',`
|
|
gen_require(`
|
|
type ssh_agent_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, ssh_agent_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read ssh home directory content
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_read_user_home_files',`
|
|
gen_require(`
|
|
type ssh_home_t;
|
|
')
|
|
|
|
allow $1 ssh_home_t:dir list_dir_perms;
|
|
read_files_pattern($1, ssh_home_t, ssh_home_t)
|
|
read_lnk_files_pattern($1, ssh_home_t, ssh_home_t)
|
|
userdom_search_user_home_dirs($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute the ssh key generator in the ssh keygen domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_domtrans_keygen',`
|
|
gen_require(`
|
|
type ssh_keygen_t, ssh_keygen_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1, ssh_keygen_exec_t, ssh_keygen_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read ssh server keys
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_dontaudit_read_server_keys',`
|
|
gen_require(`
|
|
type sshd_key_t;
|
|
')
|
|
|
|
dontaudit $1 sshd_key_t:file { getattr read };
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Manage ssh home directory content
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_manage_home_files',`
|
|
gen_require(`
|
|
type ssh_home_t;
|
|
')
|
|
|
|
manage_files_pattern($1, ssh_home_t, ssh_home_t)
|
|
userdom_search_user_home_dirs($1)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Delete from the ssh temp files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`ssh_delete_tmp',`
|
|
gen_require(`
|
|
type sshd_tmp_t;
|
|
')
|
|
|
|
files_search_tmp($1)
|
|
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
|
|
')
|