[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Sven Vermeulen]

commit:     3c2ad3e4b5919b0012847ae45f7197cdc0830e94
Author:     Laurent Bigonville <bigon <AT> bigon <DOT> be>
AuthorDate: Wed Feb  5 21:23:31 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Feb  9 10:50:58 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3c2ad3e4

Add fcontext for sshd pidfile and directory used for privsep

Also allow sshd_t domain to chroot(2) in this directory as explained in
the README.privsep file in the openssh tarball.

Thanks to Russell Coker for this patch

---
 policy/modules/services/ssh.fc | 2 ++
 policy/modules/services/ssh.if | 1 +
 2 files changed, 3 insertions(+)

diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
index 76d9f66..8168244 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -13,4 +13,6 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
 
+/var/run/sshd(/.*)?			gen_context(system_u:object_r:sshd_var_run_t,s0)
 /var/run/sshd\.init\.pid	--	gen_context(system_u:object_r:sshd_var_run_t,s0)
+/var/run/sshd\.pid		--	gen_context(system_u:object_r:sshd_var_run_t,s0)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index fe0c682..48eb1c8 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -196,6 +196,7 @@ template(`ssh_server_template', `
 	manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
 	fs_tmpfs_filetrans($1_t, $1_tmpfs_t, file)
 
+	allow $1_t $1_var_run_t:dir search_dir_perms;
 	allow $1_t $1_var_run_t:file manage_file_perms;
 	files_pid_filetrans($1_t, $1_var_run_t, file)