X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=policy%2Fmodules%2Fservices%2Fssh.te;h=aadaa2cb0b2f164ef873a1f80fae6aed00dfe53c;hb=7fdbdb5efdaa964299bed278f31f28e6d72f7772;hp=580297ade94c97e6407906580b9ab89467e407c4;hpb=bd571337235ca7dcbaff72908e7d7b293c3dc3e5;p=people%2Fstevee%2Fselinux-policy.git diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te index 580297ad..aadaa2cb 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -26,9 +26,21 @@ gen_tunable(ssh_sysadm_login, false) ## gen_tunable(sshd_forward_ports, false) +## +##

+## Allow ssh with chroot env to read and write files +## in the user home directories +##

+## +gen_tunable(ssh_chroot_rw_homedirs, false) + +attribute ssh_dyntransition_domain; attribute ssh_server; attribute ssh_agent_type; +ssh_dyntransition_domain_template(chroot_user_t) +ssh_dyntransition_domain_template(sshd_sandbox_t) + type ssh_keygen_t; type ssh_keygen_exec_t; init_system_domain(ssh_keygen_t, ssh_keygen_exec_t) @@ -78,6 +90,7 @@ type ssh_home_t; typealias ssh_home_t alias { home_ssh_t user_ssh_home_t user_home_ssh_t staff_home_ssh_t sysadm_home_ssh_t }; typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; userdom_user_home_content(ssh_home_t) +files_poly_parent(ssh_home_t) ifdef(`enable_mcs',` init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh) @@ -92,6 +105,7 @@ allow ssh_t self:capability { setuid setgid dac_override dac_read_search }; allow ssh_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow ssh_t self:fd use; allow ssh_t self:fifo_file rw_fifo_file_perms; +allow ssh_t self:key read; allow ssh_t self:unix_dgram_socket { create_socket_perms sendto }; allow ssh_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow ssh_t self:shm create_shm_perms; @@ -113,12 +127,16 @@ fs_tmpfs_filetrans(ssh_t, ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file } manage_dirs_pattern(ssh_t, ssh_home_t, ssh_home_t) manage_sock_files_pattern(ssh_t, ssh_home_t, ssh_home_t) userdom_user_home_dir_filetrans(ssh_t, ssh_home_t, { dir sock_file }) +userdom_read_all_users_keys(ssh_t) userdom_stream_connect(ssh_t) +userdom_search_admin_dir(sshd_t) +userdom_admin_home_dir_filetrans(ssh_t, ssh_home_t, { dir sock_file }) # Allow the ssh program to communicate with ssh-agent. stream_connect_pattern(ssh_t, ssh_agent_tmp_t, ssh_agent_tmp_t, ssh_agent_type) allow ssh_t sshd_t:unix_stream_socket connectto; +allow ssh_t sshd_t:peer recv; # ssh client can manage the keys and config manage_files_pattern(ssh_t, ssh_home_t, ssh_home_t) @@ -142,7 +160,9 @@ corenet_tcp_connect_ssh_port(ssh_t) corenet_sendrecv_ssh_client_packets(ssh_t) corenet_tcp_bind_generic_node(ssh_t) corenet_tcp_bind_all_unreserved_ports(ssh_t) +corenet_rw_tun_tap_dev(ssh_t) +dev_read_rand(ssh_t) dev_read_urand(ssh_t) fs_getattr_all_fs(ssh_t) @@ -166,32 +186,26 @@ logging_read_generic_logs(ssh_t) auth_use_nsswitch(ssh_t) miscfiles_read_localization(ssh_t) +miscfiles_read_generic_certs(ssh_t) seutil_read_config(ssh_t) userdom_dontaudit_list_user_home_dirs(ssh_t) userdom_search_user_home_dirs(ssh_t) +userdom_search_admin_dir(ssh_t) # Write to the user domain tty. -userdom_use_user_terminals(ssh_t) +userdom_use_inherited_user_terminals(ssh_t) # needs to read krb/write tgt userdom_read_user_tmp_files(ssh_t) userdom_write_user_tmp_files(ssh_t) userdom_read_user_home_content_symlinks(ssh_t) +userdom_read_home_certs(ssh_t) +userdom_home_manager(ssh_t) tunable_policy(`allow_ssh_keysign',` domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t) ') -tunable_policy(`use_nfs_home_dirs',` - fs_manage_nfs_dirs(ssh_t) - fs_manage_nfs_files(ssh_t) -') - -tunable_policy(`use_samba_home_dirs',` - fs_manage_cifs_dirs(ssh_t) - fs_manage_cifs_files(ssh_t) -') - # for port forwarding tunable_policy(`user_tcp_server',` corenet_tcp_bind_ssh_port(ssh_t) @@ -199,56 +213,14 @@ tunable_policy(`user_tcp_server',` ') optional_policy(` - xserver_user_x_domain_template(ssh, ssh_t, ssh_tmpfs_t) - xserver_domtrans_xauth(ssh_t) + gnome_stream_connect_all_gkeyringd(ssh_t) ') -######################################## -# -# ssh_keygen local policy -# - -# ssh_keygen_t is the type of the ssh-keygen program when run at install time -# and by sysadm_t - -dontaudit ssh_keygen_t self:capability sys_tty_config; -allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal }; -allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; - -allow ssh_keygen_t sshd_key_t:file manage_file_perms; -files_etc_filetrans(ssh_keygen_t, sshd_key_t, file) - -kernel_read_kernel_sysctls(ssh_keygen_t) - -fs_search_auto_mountpoints(ssh_keygen_t) - -dev_read_sysfs(ssh_keygen_t) -dev_read_urand(ssh_keygen_t) - -term_dontaudit_use_console(ssh_keygen_t) - -domain_use_interactive_fds(ssh_keygen_t) - -files_read_etc_files(ssh_keygen_t) - -init_use_fds(ssh_keygen_t) -init_use_script_ptys(ssh_keygen_t) - -logging_send_syslog_msg(ssh_keygen_t) - -userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) - optional_policy(` - nscd_socket_use(ssh_keygen_t) -') - -optional_policy(` - seutil_sigchld_newrole(ssh_keygen_t) + xserver_user_x_domain_template(ssh, ssh_t, ssh_tmpfs_t) + xserver_domtrans_xauth(ssh_t) ') -optional_policy(` - udev_read_db(ssh_keygen_t) -') ############################## # @@ -261,17 +233,12 @@ tunable_policy(`allow_ssh_keysign',` allow ssh_keysign_t sshd_key_t:file read_file_perms; + dev_read_rand(ssh_keysign_t) dev_read_urand(ssh_keysign_t) files_read_etc_files(ssh_keysign_t) ') -optional_policy(` - tunable_policy(`allow_ssh_keysign',` - nscd_socket_use(ssh_keysign_t) - ') -') - ################################# # # sshd local policy @@ -299,10 +266,10 @@ corenet_sendrecv_xserver_server_packets(sshd_t) userdom_read_user_home_content_files(sshd_t) userdom_read_user_home_content_symlinks(sshd_t) -userdom_search_admin_dir(sshd_t) userdom_manage_tmp_role(system_r, sshd_t) userdom_spec_domtrans_unpriv_users(sshd_t) userdom_signal_unpriv_users(sshd_t) +userdom_dyntransition_unpriv_users(sshd_t) tunable_policy(`sshd_forward_ports',` corenet_tcp_bind_all_unreserved_ports(sshd_t) @@ -315,6 +282,11 @@ tunable_policy(`ssh_sysadm_login',` # display the tty. # some versions of sshd on the new SE Linux require setattr userdom_signal_all_users(sshd_t) + userdom_spec_domtrans_all_users(sshd_t) +') + +optional_policy(` + amanda_search_var_lib(sshd_t) ') optional_policy(` @@ -330,10 +302,6 @@ optional_policy(` ftp_dyntrans_anon_sftpd(sshd_t) ') -optional_policy(` - gitosis_manage_lib_files(sshd_t) -') - optional_policy(` inetd_tcp_service_domain(sshd_t, sshd_exec_t) ') @@ -352,6 +320,10 @@ optional_policy(` rssh_read_ro_content(sshd_t) ') +optional_policy(` + systemd_exec_systemctl(sshd_t) +') + optional_policy(` usermanage_domtrans_passwd(sshd_t) usermanage_read_crack_db(sshd_t) @@ -396,6 +368,7 @@ ifdef(`TODO',` # ssh_keygen_t is the type of the ssh-keygen program when run at install time # and by sysadm_t +allow ssh_keygen_t self:capability dac_override; dontaudit ssh_keygen_t self:capability sys_tty_config; allow ssh_keygen_t self:process { sigchld sigkill sigstop signull signal }; allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; @@ -403,11 +376,18 @@ allow ssh_keygen_t self:unix_stream_socket create_stream_socket_perms; allow ssh_keygen_t sshd_key_t:file manage_file_perms; files_etc_filetrans(ssh_keygen_t, sshd_key_t, file) +manage_dirs_pattern(ssh_keygen_t, ssh_home_t, ssh_home_t) +manage_files_pattern(ssh_keygen_t, ssh_home_t, ssh_home_t) +userdom_admin_home_dir_filetrans(ssh_keygen_t, ssh_home_t, dir) +userdom_user_home_dir_filetrans(ssh_keygen_t, ssh_home_t, dir) + +kernel_read_system_state(ssh_keygen_t) kernel_read_kernel_sysctls(ssh_keygen_t) fs_search_auto_mountpoints(ssh_keygen_t) dev_read_sysfs(ssh_keygen_t) +dev_read_rand(ssh_keygen_t) dev_read_urand(ssh_keygen_t) term_dontaudit_use_console(ssh_keygen_t) @@ -424,6 +404,7 @@ auth_use_nsswitch(ssh_keygen_t) logging_send_syslog_msg(ssh_keygen_t) userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) +userdom_use_user_terminals(ssh_keygen_t) optional_policy(` seutil_sigchld_newrole(ssh_keygen_t) @@ -432,3 +413,77 @@ optional_policy(` optional_policy(` udev_read_db(ssh_keygen_t) ') + +#################################### +# +# ssh_dyntransition domain local policy +# + +allow ssh_dyntransition_domain self:capability { setuid sys_chroot setgid }; + +allow ssh_dyntransition_domain self:fifo_file rw_fifo_file_perms; + +optional_policy(` + ssh_rw_stream_sockets(ssh_dyntransition_domain) + ssh_rw_tcp_sockets(ssh_dyntransition_domain) +') + +##################################### +# +# ssh_sandbox local policy +# + +allow sshd_t sshd_sandbox_t:process signal; + +init_ioctl_stream_sockets(sshd_sandbox_t) + +logging_send_audit_msgs(sshd_sandbox_t) + +###################################### +# +# chroot_user_t local policy +# + + +userdom_read_user_home_content_files(chroot_user_t) +userdom_read_inherited_user_home_content_files(chroot_user_t) +userdom_read_user_home_content_symlinks(chroot_user_t) +userdom_exec_user_home_content_files(chroot_user_t) + +tunable_policy(`ssh_chroot_rw_homedirs',` + files_list_home(chroot_user_t) + userdom_read_user_home_content_files(chroot_user_t) + userdom_manage_user_home_content(chroot_user_t) +', ` + + userdom_user_home_dir_filetrans_pattern(chroot_user_t, { dir file lnk_file }) +') + +tunable_policy(`ssh_chroot_rw_homedirs && use_nfs_home_dirs',` + fs_manage_nfs_dirs(chroot_user_t) + fs_manage_nfs_files(chroot_user_t) + fs_manage_nfs_symlinks(chroot_user_t) +') + +tunable_policy(`ssh_chroot_rw_homedirs && use_samba_home_dirs',` + fs_manage_cifs_dirs(chroot_user_t) + fs_manage_cifs_files(chroot_user_t) + fs_manage_cifs_symlinks(chroot_user_t) +') + +tunable_policy(`ssh_chroot_rw_homedirs && use_fusefs_home_dirs',` + fs_manage_fusefs_dirs(chroot_user_t) + fs_manage_fusefs_files(chroot_user_t) + fs_manage_fusefs_symlinks(chroot_user_t) +') + +tunable_policy(`use_samba_home_dirs',` + fs_read_cifs_files(chroot_user_t) + fs_read_cifs_symlinks(chroot_user_t) +') + +userdom_home_manager(chroot_user_t) + +optional_policy(` + ssh_rw_dgram_sockets(chroot_user_t) +')