patch for ssh-agent

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

[-- Attachment #1: Type: text/plain, Size: 458 bytes --]

absolutely clueless as to what this is for, but at least it gets
rid of the audit warnings, which were bugging me.

l.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


[-- Attachment #2: ssh_agent --]
[-- Type: text/plain, Size: 1077 bytes --]

diff -Naur 
--- default.1.14/macros/program/ssh_agent_macros.te	2004-08-02 08:28:37.000000000 +0100
+++ current/macros/program/ssh_agent_macros.te	2004-08-14 23:34:48.000000000 +0100
@@ -86,7 +86,10 @@
 
 ifdef(`xdm.te', `
 allow $1_ssh_agent_t xdm_t:fd { use };
-allow $1_ssh_agent_t xdm_t:fifo_file { write };
+allow $1_ssh_agent_t xdm_t:fifo_file { read write };
+
+# kdm: sigchld
+allow $1_ssh_agent_t xdm_t:process { sigchld };
 ')
 
 #
@@ -103,5 +106,17 @@
 allow $1_ssh_t $1_tmp_t:sock_file write;
 allow $1_ssh_t $1_t:unix_stream_socket connectto;
 allow $1_ssh_t sshd_t:unix_stream_socket connectto;
+
+dontaudit $1_ssh_agent_t selinux_config_t:file { getattr read };
+	#EXE=/usr/bin/ssh-agent  NAME=config   :  read
+	#EXE=/usr/bin/ssh-agent  PATH=/etc/selinux/config   :  getattr
+
+allow $1_ssh_agent_t self:dir { search };
+	#EXE=/usr/bin/ssh-agent  NAME=2971   :  search
+
+allow $1_ssh_agent_t self:file { getattr read };
+	#EXE=/usr/bin/ssh-agent  NAME=mounts   :  read
+	#EXE=/usr/bin/ssh-agent  PATH=/proc/2971/mounts   :  getattr
+
 ')dnl end if ssh_agent