231 lines
6.9 KiB
Plaintext
231 lines
6.9 KiB
Plaintext
#DESC SSH - SSH daemon
|
|
#
|
|
# Authors: Anthony Colatrella (NSA) <amcolat@epoch.ncsc.mil>
|
|
# Stephen Smalley <sds@epoch.ncsc.mil>
|
|
# Russell Coker <russell@coker.com.au>
|
|
# X-Debian-Packages: ssh
|
|
#
|
|
|
|
# Allow ssh logins as sysadm_r:sysadm_t
|
|
bool ssh_sysadm_login false;
|
|
|
|
# allow host key based authentication
|
|
bool allow_ssh_keysign false;
|
|
|
|
ifdef(`inetd.te', `
|
|
# Allow ssh to run from inetd instead of as a daemon.
|
|
bool run_ssh_inetd false;
|
|
')
|
|
|
|
# sshd_exec_t is the type of the sshd executable.
|
|
# sshd_key_t is the type of the ssh private key files
|
|
type sshd_exec_t, file_type, exec_type, sysadmfile;
|
|
type sshd_key_t, file_type, sysadmfile;
|
|
|
|
define(`sshd_program_domain', `
|
|
# privowner is for changing the identity on the terminal device
|
|
# privfd is for passing the terminal file handle to the user process
|
|
# auth_chkpwd is for running unix_chkpwd and unix_verify.
|
|
type $1_t, domain, privuser, privrole, privlog, privowner, privfd, auth_chkpwd, nscd_client_domain, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade, mlsprocsetsl;
|
|
can_exec($1_t, sshd_exec_t)
|
|
r_dir_file($1_t, self)
|
|
role system_r types $1_t;
|
|
dontaudit $1_t shadow_t:file { getattr read };
|
|
uses_shlib($1_t)
|
|
allow $1_t self:unix_dgram_socket create_socket_perms;
|
|
allow $1_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow $1_t self:fifo_file rw_file_perms;
|
|
allow $1_t self:process { fork sigchld signal setsched setrlimit };
|
|
|
|
dontaudit $1_t self:lnk_file read;
|
|
|
|
# do not allow statfs()
|
|
dontaudit $1_t fs_type:filesystem getattr;
|
|
|
|
allow $1_t bin_t:dir search;
|
|
allow $1_t bin_t:lnk_file read;
|
|
|
|
# for sshd subsystems, such as sftp-server.
|
|
allow $1_t bin_t:file getattr;
|
|
|
|
# Read /var.
|
|
allow $1_t var_t:dir { getattr search };
|
|
|
|
# Read /var/log.
|
|
allow $1_t var_log_t:dir search;
|
|
|
|
# Read /etc.
|
|
allow $1_t etc_t:dir search;
|
|
# ioctl is for pam_console
|
|
dontaudit $1_t etc_t:file ioctl;
|
|
allow $1_t etc_t:file { getattr read };
|
|
allow $1_t etc_t:lnk_file { getattr read };
|
|
allow $1_t etc_runtime_t:file { getattr read };
|
|
|
|
# Read and write /dev/tty and /dev/null.
|
|
allow $1_t devtty_t:chr_file rw_file_perms;
|
|
allow $1_t { null_device_t zero_device_t }:chr_file rw_file_perms;
|
|
|
|
# Read /dev/urandom
|
|
allow $1_t urandom_device_t:chr_file { getattr read };
|
|
|
|
can_network($1_t)
|
|
allow $1_t port_type:tcp_socket name_connect;
|
|
can_kerberos($1_t)
|
|
|
|
allow $1_t self:capability { kill sys_chroot sys_resource chown dac_override fowner fsetid setgid setuid sys_tty_config };
|
|
allow $1_t { home_root_t home_dir_type }:dir { search getattr };
|
|
if (use_nfs_home_dirs) {
|
|
allow $1_t autofs_t:dir { search getattr };
|
|
allow $1_t nfs_t:dir { search getattr };
|
|
allow $1_t nfs_t:file { getattr read };
|
|
}
|
|
|
|
if (use_samba_home_dirs) {
|
|
allow $1_t cifs_t:dir { search getattr };
|
|
allow $1_t cifs_t:file { getattr read };
|
|
}
|
|
|
|
# Set exec context.
|
|
can_setexec($1_t)
|
|
|
|
# Update utmp.
|
|
allow $1_t initrc_var_run_t:file rw_file_perms;
|
|
|
|
# Update wtmp.
|
|
allow $1_t wtmp_t:file rw_file_perms;
|
|
|
|
# Get security policy decisions.
|
|
can_getsecurity($1_t)
|
|
|
|
# Allow read access to login context
|
|
r_dir_file( $1_t, default_context_t)
|
|
|
|
# Access key files
|
|
allow $1_t sshd_key_t:file { getattr read };
|
|
|
|
# Update /var/log/lastlog.
|
|
allow $1_t lastlog_t:file rw_file_perms;
|
|
|
|
read_locale($1_t)
|
|
read_sysctl($1_t)
|
|
|
|
# Can create ptys
|
|
can_create_pty($1, `, server_pty')
|
|
allow $1_t $1_devpts_t:chr_file { setattr getattr relabelfrom };
|
|
dontaudit sshd_t userpty_type:chr_file relabelfrom;
|
|
|
|
# Allow checking users mail at login
|
|
allow $1_t { var_spool_t mail_spool_t }:dir search;
|
|
allow $1_t mail_spool_t:lnk_file read;
|
|
allow $1_t mail_spool_t:file getattr;
|
|
')dnl end sshd_program_domain
|
|
|
|
# macro for defining which domains a sshd can spawn
|
|
# $1_t is the domain of the sshd, $2 is the domain to be spawned, $3 is the
|
|
# type of the pty for the child
|
|
define(`sshd_spawn_domain', `
|
|
login_spawn_domain($1, $2)
|
|
ifdef(`xauth.te', `
|
|
domain_trans($1_t, xauth_exec_t, $2)
|
|
')
|
|
|
|
# Relabel and access ptys created by sshd
|
|
# ioctl is necessary for logout() processing for utmp entry and for w to
|
|
# display the tty.
|
|
# some versions of sshd on the new SE Linux require setattr
|
|
allow $1_t $3:chr_file { relabelto read write getattr ioctl setattr };
|
|
|
|
# inheriting stream sockets is needed for "ssh host command" as no pty
|
|
# is allocated
|
|
allow $2 $1_t:unix_stream_socket rw_stream_socket_perms;
|
|
')dnl end sshd_spawn_domain definition
|
|
|
|
#################################
|
|
#
|
|
# Rules for the sshd_t domain, et al.
|
|
#
|
|
# sshd_t is the domain for the sshd program.
|
|
# sshd_extern_t is the domain for ssh from outside our network
|
|
#
|
|
sshd_program_domain(sshd)
|
|
if (ssh_sysadm_login) {
|
|
sshd_spawn_domain(sshd, userdomain, { sysadm_devpts_t userpty_type })
|
|
} else {
|
|
sshd_spawn_domain(sshd, unpriv_userdomain, userpty_type)
|
|
}
|
|
|
|
# for X forwarding
|
|
allow sshd_t xserver_port_t:tcp_socket name_bind;
|
|
|
|
r_dir_file(sshd_t, selinux_config_t)
|
|
sshd_program_domain(sshd_extern)
|
|
sshd_spawn_domain(sshd_extern, user_mini_domain, mini_pty_type)
|
|
|
|
# for when the network connection breaks after running newrole -r sysadm_r
|
|
dontaudit sshd_t sysadm_devpts_t:chr_file setattr;
|
|
|
|
ifdef(`inetd.te', `
|
|
if (run_ssh_inetd) {
|
|
allow inetd_t ssh_port_t:tcp_socket name_bind;
|
|
domain_auto_trans(inetd_t, sshd_exec_t, sshd_t)
|
|
domain_trans(inetd_t, sshd_exec_t, sshd_extern_t)
|
|
allow { sshd_t sshd_extern_t } inetd_t:tcp_socket rw_socket_perms;
|
|
allow { sshd_t sshd_extern_t } var_run_t:dir { getattr search };
|
|
allow { sshd_t sshd_extern_t } self:process signal;
|
|
} else {
|
|
')
|
|
allow { sshd_t sshd_extern_t } initrc_devpts_t:chr_file rw_file_perms;
|
|
allow { sshd_t sshd_extern_t } self:capability net_bind_service;
|
|
allow { sshd_t sshd_extern_t } ssh_port_t:tcp_socket name_bind;
|
|
|
|
# for port forwarding
|
|
can_tcp_connect(userdomain, sshd_t)
|
|
|
|
domain_auto_trans(initrc_t, sshd_exec_t, sshd_t)
|
|
domain_trans(initrc_t, sshd_exec_t, sshd_extern_t)
|
|
dontaudit initrc_t sshd_key_t:file { getattr read };
|
|
|
|
# Inherit and use descriptors from init.
|
|
allow { sshd_t sshd_extern_t } init_t:fd use;
|
|
ifdef(`inetd.te', `
|
|
}
|
|
')
|
|
|
|
# Create /var/run/sshd.pid
|
|
var_run_domain(sshd)
|
|
var_run_domain(sshd_extern)
|
|
|
|
ifdef(`direct_sysadm_daemon', `
|
|
# Direct execution by sysadm_r.
|
|
domain_auto_trans(sysadm_t, sshd_exec_t, sshd_t)
|
|
role_transition sysadm_r sshd_exec_t system_r;
|
|
')
|
|
|
|
undefine(`sshd_program_domain')
|
|
|
|
# so a tunnel can point to another ssh tunnel...
|
|
can_tcp_connect(sshd_t, sshd_t)
|
|
|
|
tmp_domain(sshd, `', { dir file sock_file })
|
|
ifdef(`pam.te', `
|
|
can_exec(sshd_t, pam_exec_t)
|
|
')
|
|
|
|
# ssh_keygen_t is the type of the ssh-keygen program when run at install time
|
|
# and by sysadm_t
|
|
daemon_base_domain(ssh_keygen)
|
|
allow ssh_keygen_t etc_t:file { getattr read };
|
|
file_type_auto_trans(ssh_keygen_t, etc_t, sshd_key_t, file)
|
|
|
|
# Type for the ssh executable.
|
|
type ssh_exec_t, file_type, exec_type, sysadmfile;
|
|
type ssh_keysign_exec_t, file_type, exec_type, sysadmfile;
|
|
|
|
# Everything else is in the ssh_domain macro in
|
|
# macros/program/ssh_macros.te.
|
|
|
|
allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms;
|
|
allow ssh_keygen_t sysadm_tty_device_t:chr_file { read write };
|
|
allow ssh_keygen_t urandom_device_t:chr_file { getattr read };
|