#
# Macros for ssh agent
#

#
# Author:  Thomas Bleher <ThomasBleher@gmx.de>
#

# 
# ssh_agent_domain(domain_prefix)
#
# The type declaration for the executable type for this program is
# provided separately in domains/program/ssh-agent.te. 
#
define(`ssh_agent_domain',`
# Define a derived domain for the ssh-agent program when executed
# by a user domain.
# Derived domain based on the calling user domain and the program.
type $1_ssh_agent_t, domain, privlog;

# Transition from the user domain to the derived domain.
domain_auto_trans($1_t, ssh_agent_exec_t, $1_ssh_agent_t)

# The user role is authorized for this domain.
role $1_r types $1_ssh_agent_t;

allow $1_ssh_agent_t privfd:fd use;

# Write to the user domain tty.
access_terminal($1_ssh_agent_t, $1)

# Allow the user shell to signal the ssh program.
allow $1_t $1_ssh_agent_t:process signal;
# allow ps to show ssh
can_ps($1_t, $1_ssh_agent_t)

can_ypbind($1_ssh_agent_t)
if (use_nfs_home_dirs) {
allow $1_ssh_agent_t autofs_t:dir { search getattr };
rw_dir_create_file($1_ssh_agent_t, nfs_t)
}
if (use_samba_home_dirs) {
rw_dir_create_file($1_ssh_agent_t, cifs_t)
}

uses_shlib($1_ssh_agent_t)
read_locale($1_ssh_agent_t)

allow $1_ssh_agent_t proc_t:dir search;
dontaudit $1_ssh_agent_t proc_t:{ lnk_file file } { getattr read };
dontaudit $1_ssh_agent_t selinux_config_t:dir search;
dontaudit $1_ssh_agent_t selinux_config_t:file { read getattr };
read_sysctl($1_ssh_agent_t)

# Access the ssh temporary files. Should we have an own type here
# to which only ssh, ssh-agent and ssh-add have access?
allow $1_ssh_agent_t $1_tmp_t:dir r_dir_perms;
file_type_auto_trans($1_ssh_agent_t, tmp_t, $1_tmp_t)
allow $1_ssh_agent_t self:unix_stream_socket create_stream_socket_perms;
allow $1_ssh_agent_t self:unix_dgram_socket create_socket_perms;

allow $1_ssh_agent_t self:process { fork sigchld setrlimit };
allow $1_ssh_agent_t self:capability setgid;

# access the random devices
allow $1_ssh_agent_t { random_device_t urandom_device_t }:chr_file { getattr read };

# for ssh-add
can_unix_connect($1_t, $1_ssh_agent_t)

# transition back to normal privs upon exec
domain_auto_trans($1_ssh_agent_t, { bin_t shell_exec_t $1_home_t }, $1_t)
if (use_nfs_home_dirs) {
domain_auto_trans($1_ssh_agent_t, nfs_t, $1_t)
}
if (use_samba_home_dirs) {
domain_auto_trans($1_ssh_agent_t, cifs_t, $1_t)
}
allow $1_ssh_agent_t bin_t:dir search;

# allow reading of /usr/bin/X11 (is a symlink)
allow $1_ssh_agent_t bin_t:lnk_file read;

allow $1_ssh_agent_t { $1_ssh_agent_t $1_t }:process signull;

allow $1_ssh_agent_t { home_root_t $1_home_dir_t }:dir search;

allow $1_ssh_t $1_tmp_t:sock_file write;
allow $1_ssh_t $1_t:unix_stream_socket connectto;
allow $1_ssh_t $1_ssh_agent_t:unix_stream_socket connectto;

ifdef(`xdm.te', `
can_pipe_xdm($1_ssh_agent_t)

# kdm: sigchld
allow $1_ssh_agent_t xdm_t:process sigchld;
')

#
# Allow command to ssh-agent > ~/.ssh_agent
#
allow $1_ssh_agent_t $1_home_t:file rw_file_perms;
allow $1_ssh_agent_t $1_tmp_t:file rw_file_perms;

allow $1_ssh_agent_t etc_runtime_t:file { getattr read };
allow $1_ssh_agent_t etc_t:file { getattr read };
allow $1_ssh_agent_t lib_t:file { getattr read };

allow $1_ssh_agent_t self:dir search;
allow $1_ssh_agent_t self:file { getattr read };

# Allow the ssh program to communicate with ssh-agent.
allow $1_ssh_t $1_tmp_t:sock_file write;
allow $1_ssh_t $1_t:unix_stream_socket connectto;
allow $1_ssh_t sshd_t:unix_stream_socket connectto;
')dnl end if ssh_agent