1 |
commit: 8796183777154929efc6b058e462cc7037eb0817 |
2 |
Author: Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org> |
3 |
AuthorDate: Sun Dec 20 15:28:50 2015 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Jan 30 17:16:56 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=87961837 |
7 |
|
8 |
Label OpenSSH systemd unit files |
9 |
|
10 |
On Arch Linux, OpenSSH unit files are: |
11 |
/usr/lib/systemd/system/sshdgenkeys.service |
12 |
/usr/lib/systemd/system/sshd.service |
13 |
/usr/lib/systemd/system/sshd@.service |
14 |
/usr/lib/systemd/system/sshd.socket |
15 |
|
16 |
On Debian jessie, the unit files are: |
17 |
/lib/systemd/system/ssh.service |
18 |
/lib/systemd/system/ssh@.service |
19 |
/lib/systemd/system/ssh.socket |
20 |
|
21 |
On Fedora 22, the unit files are: |
22 |
/usr/lib/systemd/system/sshd-keygen.service |
23 |
/usr/lib/systemd/system/sshd.service |
24 |
/usr/lib/systemd/system/sshd@.service |
25 |
/usr/lib/systemd/system/sshd.socket |
26 |
|
27 |
Use a pattern which matches every sshd unit and introduce an other type |
28 |
for ssh-keygen units. |
29 |
|
30 |
policy/modules/services/ssh.fc | 4 ++++ |
31 |
policy/modules/services/ssh.te | 6 ++++++ |
32 |
2 files changed, 10 insertions(+) |
33 |
|
34 |
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc |
35 |
index fd6c218..027c8a8 100644 |
36 |
--- a/policy/modules/services/ssh.fc |
37 |
+++ b/policy/modules/services/ssh.fc |
38 |
@@ -10,6 +10,10 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) |
39 |
/usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) |
40 |
/usr/lib/ssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) |
41 |
|
42 |
+/usr/lib/systemd/system/ssh.* -- gen_context(system_u:object_r:sshd_unit_t,s0) |
43 |
+/usr/lib/systemd/system/sshdgenkeys.* -- gen_context(system_u:object_r:sshd_keygen_unit_t,s0) |
44 |
+/usr/lib/systemd/system/sshd-keygen.* -- gen_context(system_u:object_r:sshd_keygen_unit_t,s0) |
45 |
+ |
46 |
/usr/libexec/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) |
47 |
|
48 |
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0) |
49 |
|
50 |
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te |
51 |
index d83662a..917187a 100644 |
52 |
--- a/policy/modules/services/ssh.te |
53 |
+++ b/policy/modules/services/ssh.te |
54 |
@@ -47,6 +47,12 @@ type sshd_tmp_t; |
55 |
files_tmp_file(sshd_tmp_t) |
56 |
files_poly_parent(sshd_tmp_t) |
57 |
|
58 |
+type sshd_keygen_unit_t; |
59 |
+init_unit_file(sshd_keygen_unit_t) |
60 |
+ |
61 |
+type sshd_unit_t; |
62 |
+init_unit_file(sshd_unit_t) |
63 |
+ |
64 |
ifdef(`enable_mcs',` |
65 |
init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh) |
66 |
') |