118 lines
3.4 KiB
Plaintext
118 lines
3.4 KiB
Plaintext
|
#
|
||
|
|
# Macros for ssh agent
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Author: Thomas Bleher <ThomasBleher@gmx.de>
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# ssh_agent_domain(domain_prefix)
|
||
|
|
#
|
||
|
|
# The type declaration for the executable type for this program is
|
||
|
|
# provided separately in domains/program/ssh-agent.te.
|
||
|
|
#
|
||
|
|
define(`ssh_agent_domain',`
|
||
|
|
# Define a derived domain for the ssh-agent program when executed
|
||
|
|
# by a user domain.
|
||
|
|
# Derived domain based on the calling user domain and the program.
|
||
|
|
type $1_ssh_agent_t, domain, privlog;
|
||
|
|
|
||
|
|
# Transition from the user domain to the derived domain.
|
||
|
|
domain_auto_trans($1_t, ssh_agent_exec_t, $1_ssh_agent_t)
|
||
|
|
|
||
|
|
# The user role is authorized for this domain.
|
||
|
|
role $1_r types $1_ssh_agent_t;
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t privfd:fd use;
|
||
|
|
|
||
|
|
# Write to the user domain tty.
|
||
|
|
access_terminal($1_ssh_agent_t, $1)
|
||
|
|
|
||
|
|
# Allow the user shell to signal the ssh program.
|
||
|
|
allow $1_t $1_ssh_agent_t:process signal;
|
||
|
|
# allow ps to show ssh
|
||
|
|
can_ps($1_t, $1_ssh_agent_t)
|
||
|
|
|
||
|
|
can_ypbind($1_ssh_agent_t)
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
allow $1_ssh_agent_t autofs_t:dir { search getattr };
|
||
|
|
rw_dir_create_file($1_ssh_agent_t, nfs_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
rw_dir_create_file($1_ssh_agent_t, cifs_t)
|
||
|
|
}
|
||
|
|
|
||
|
|
uses_shlib($1_ssh_agent_t)
|
||
|
|
read_locale($1_ssh_agent_t)
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t proc_t:dir search;
|
||
|
|
dontaudit $1_ssh_agent_t proc_t:{ lnk_file file } { getattr read };
|
||
|
|
dontaudit $1_ssh_agent_t selinux_config_t:dir search;
|
||
|
|
read_sysctl($1_ssh_agent_t)
|
||
|
|
|
||
|
|
# Access the ssh temporary files. Should we have an own type here
|
||
|
|
# to which only ssh, ssh-agent and ssh-add have access?
|
||
|
|
allow $1_ssh_agent_t $1_tmp_t:dir r_dir_perms;
|
||
|
|
file_type_auto_trans($1_ssh_agent_t, tmp_t, $1_tmp_t)
|
||
|
|
allow $1_ssh_agent_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow $1_ssh_agent_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t self:process { fork sigchld setrlimit };
|
||
|
|
allow $1_ssh_agent_t self:capability setgid;
|
||
|
|
|
||
|
|
# access the random devices
|
||
|
|
allow $1_ssh_agent_t { random_device_t urandom_device_t }:chr_file read;
|
||
|
|
|
||
|
|
# for ssh-add
|
||
|
|
can_unix_connect($1_t, $1_ssh_agent_t)
|
||
|
|
|
||
|
|
# transition back to normal privs upon exec
|
||
|
|
domain_auto_trans($1_ssh_agent_t, { bin_t shell_exec_t $1_home_t }, $1_t)
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
domain_auto_trans($1_ssh_agent_t, nfs_t, $1_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
domain_auto_trans($1_ssh_agent_t, cifs_t, $1_t)
|
||
|
|
}
|
||
|
|
allow $1_ssh_agent_t bin_t:dir search;
|
||
|
|
|
||
|
|
# allow reading of /usr/bin/X11 (is a symlink)
|
||
|
|
allow $1_ssh_agent_t bin_t:lnk_file read;
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t { $1_ssh_agent_t $1_t }:process signull;
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t { home_root_t $1_home_dir_t }:dir search;
|
||
|
|
|
||
|
|
allow $1_ssh_t $1_tmp_t:sock_file write;
|
||
|
|
allow $1_ssh_t $1_t:unix_stream_socket connectto;
|
||
|
|
allow $1_ssh_t $1_ssh_agent_t:unix_stream_socket connectto;
|
||
|
|
|
||
|
|
ifdef(`xdm.te', `
|
||
|
|
allow $1_ssh_agent_t xdm_t:fd use;
|
||
|
|
allow $1_ssh_agent_t xdm_t:fifo_file { read write };
|
||
|
|
|
||
|
|
# kdm: sigchld
|
||
|
|
allow $1_ssh_agent_t xdm_t:process sigchld;
|
||
|
|
')
|
||
|
|
|
||
|
|
#
|
||
|
|
# Allow command to ssh-agent > ~/.ssh_agent
|
||
|
|
#
|
||
|
|
allow $1_ssh_agent_t $1_home_t:file rw_file_perms;
|
||
|
|
allow $1_ssh_agent_t $1_tmp_t:file rw_file_perms;
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t etc_runtime_t:file { getattr read };
|
||
|
|
allow $1_ssh_agent_t etc_t:file { getattr read };
|
||
|
|
allow $1_ssh_agent_t lib_t:file { getattr read };
|
||
|
|
|
||
|
|
allow $1_ssh_agent_t self:dir search;
|
||
|
|
allow $1_ssh_agent_t self:file { getattr read };
|
||
|
|
|
||
|
|
# Allow the ssh program to communicate with ssh-agent.
|
||
|
|
allow $1_ssh_t $1_tmp_t:sock_file write;
|
||
|
|
allow $1_ssh_t $1_t:unix_stream_socket connectto;
|
||
|
|
allow $1_ssh_t sshd_t:unix_stream_socket connectto;
|
||
|
|
')dnl end if ssh_agent
|
||
|
|
|