Changeset 2752

Timestamp:

07/09/08 08:49:46 (5 months ago)

Author:

cpebenito

Message:

rbacsep: restore ssh-agent derived types.

Files:

• branches/rbacsep/policy/modules/roles/auditadm.te (modified) (1 diff)
• branches/rbacsep/policy/modules/roles/secadm.te (modified) (1 diff)
• branches/rbacsep/policy/modules/roles/staff.te (modified) (1 diff)
• branches/rbacsep/policy/modules/roles/sysadm.te (modified) (1 diff)
• branches/rbacsep/policy/modules/roles/unprivuser.te (modified) (1 diff)
• branches/rbacsep/policy/modules/services/ssh.if (modified) (2 diffs)
• branches/rbacsep/policy/modules/services/ssh.te (modified) (4 diffs)

branches/rbacsep/policy/modules/roles/auditadm.te

@@ -133 +133 @@
-
-optional_policy(`
-(
+_template(auditadm, 
-')
-

branches/rbacsep/policy/modules/roles/secadm.te

@@ -145 +145 @@
-
-optional_policy(`
-(
+_template(secadm, 
-')
-

branches/rbacsep/policy/modules/roles/staff.te

@@ -117 +117 @@
-
-optional_policy(`
-(
+_template(staff, 
-')
-

branches/rbacsep/policy/modules/roles/sysadm.te

@@ -351 +351 @@
-
-optional_policy(`
-(
+_template(sysadm, 
-')
-

branches/rbacsep/policy/modules/roles/unprivuser.te

@@ -107 +107 @@
-
-optional_policy(`
-(
+_template(user, 
-')
-

branches/rbacsep/policy/modules/services/ssh.if

@@ -292 +292 @@
-##      Role access for ssh
-## </summary>
+## <param name="role_prefix">
+##      <summary>
+##      The prefix of the role (e.g., user
+##      is the prefix for user_r).
+##      </summary>
+## </param>
-## <param name="role">
-##      <summary>
@@ -303 +309 @@
-## </param>
-#
-
-
+
+
+
+
-                type ssh_t, ssh_exec_t, ssh_tmpfs_t, home_ssh_t;
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        # Transition from the domain to the derived domain.
-2
+3
-
-        # inheriting stream sockets is needed for "ssh host command" as no pty
-        # is allocated
-2
+3
-
-        # allow ps to show ssh
-2,
-2
+3, 
+3
-
-        # for rsync
-2
-2
+3
+3
-
-        # user can manage the keys and config
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        # allow ps to show ssh
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-        # transition back to normal privs upon exec
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        # for the transition back to normal privs upon exec
-ssh_agent_t,$2
-2 
-2 
-2 
+$1_ssh_agent_t, $3
+3 $1_
+3 $1_
+3 $1_
-
-        tunable_policy(`use_nfs_home_dirs',`
+                fs_manage_nfs_files($1_ssh_agent_t)
+
-                # transition back to normal privs upon exec
-ssh_agent_t, $2
+$1_ssh_agent_t, $3
-        ')
-
-        tunable_policy(`use_samba_home_dirs',`
+                fs_manage_cifs_files($1_ssh_agent_t)
+
-                # transition back to normal privs upon exec
-
+
+
+
+
+
+
+
+
+
+
-        ')
-')

branches/rbacsep/policy/modules/services/ssh.te

@@ -22 +22 @@
-
-attribute ssh_server;
+attribute ssh_agent_type;
-
-type ssh_keygen_t;
@@ -50 +51 @@
-type ssh_exec_t;
-application_domain(ssh_t, ssh_exec_t)
-
-type ssh_agent_t;
-type ssh_agent_exec_t;
-application_domain(ssh_agent_t, ssh_agent_exec_t)
-domain_interactive_fd(ssh_agent_t)
-
-type ssh_agent_tmp_t;
@@ -107 +103 @@
-
-# Allow the ssh program to communicate with ssh-agent.
-
+ype
-
-allow ssh_t sshd_t:unix_stream_socket connectto;
@@ -213 +209 @@
-        xserver_user_x_domain_template(ssh, ssh_t, ssh_tmpfs_t)
-        xserver_domtrans_xauth(ssh_t)
-')
-
-##############################
-#
-# ssh_agent_t local policy
-#
-
-allow ssh_agent_t self:process setrlimit;
-allow ssh_agent_t self:capability setgid;
-
-allow ssh_agent_t self:process signull;
-
-allow ssh_agent_t self:unix_stream_socket { create_stream_socket_perms connectto };
-
-manage_dirs_pattern(ssh_agent_t, ssh_agent_tmp_t, ssh_agent_tmp_t)
-manage_sock_files_pattern(ssh_agent_t, ssh_agent_tmp_t, ssh_agent_tmp_t)
-files_tmp_filetrans(ssh_agent_t, ssh_agent_tmp_t,{ dir sock_file })
-
-kernel_read_kernel_sysctls(ssh_agent_t)
-
-dev_read_urand(ssh_agent_t)
-dev_read_rand(ssh_agent_t)
-
-fs_search_auto_mountpoints(ssh_agent_t)
-
-domain_use_interactive_fds(ssh_agent_t)
-
-files_read_etc_files(ssh_agent_t)
-files_read_etc_runtime_files(ssh_agent_t)
-files_search_home(ssh_agent_t)
-
-libs_read_lib_files(ssh_agent_t)
-libs_use_ld_so(ssh_agent_t)
-libs_use_shared_libs(ssh_agent_t)
-
-logging_send_syslog_msg(ssh_agent_t)
-
-miscfiles_read_localization(ssh_agent_t)
-
-seutil_dontaudit_read_config(ssh_agent_t)
-
-# Write to the user domain tty.
-userdom_use_user_terminals(ssh_agent_t)
-
-tunable_policy(`use_nfs_home_dirs',`
-        fs_manage_nfs_files(ssh_agent_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-        fs_manage_cifs_files(ssh_agent_t)
-')
-
-optional_policy(`
-        nis_use_ypbind(ssh_agent_t)
-')
-
-optional_policy(`
-        xserver_use_xdm_fds(ssh_agent_t)
-        xserver_rw_xdm_pipes(ssh_agent_t)
-')
-