[gentoo-hardened] Various questions about ssh, yp, and nfs

[Michael Ihde]

Currently I'm setting up a machine that uses NIS for authentication, nfs
for shared home directories, and ssh for remote access.

In the process I have created a context for ypbind.  However there are a
few rules that I had to add that I'm not sure where they fit, or if some
modification needs to be done to other parts of the policy.


First off, when using yp the bash_profile cannot set the prompt
correctly becuase it doesn't have access to the var_yp_t:dir and file. 
The prompt looks like this

    I have no name!@p12 ihde $

If I add
    allow { user_t } var_yp_t:dir { search };
    allow { user_t } var_yp_t:file { read };

the prompt looks correct.  I think this might be too loose, but I cannot
figure out how else to accomplish this without because the offending
process is /bin/bash.

As a side note, the same problem exists with whoami (which is also
called in bash_profile).  For this I created an fc and te for whoami so
it can access the var_yp stuff.  Is this a good idea?

Secondly, for ssh to recognize the NIS users I had to add

   allow { sshd_t } var_yp_t:dir { search };
   allow { sshd_t } var_yp_t:file { read };


On to NFS, mount needed
   allow { mount_t } resolv_conf_t:file { read getattr };
   allow { mount_t } mount_t:tcp_socket { write read };

I could probably get by without resolv_conf_t:file if I used an IP
address in fstab as opposed to the hostname.

Right now all the nfs files and directories and labeled (null).  And a
relabel does not change this.  Because of this they seem to all be in
the context nfs_t:dir and nfs_t:file.  I don't want to give users full
access to nfs_t.  How can I label these nfs file systems appropriatly
(btw...I believe they are ext2).

Thanks for any help and all useful comments.

~Michael