sshd transition points

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

hi,

i'm just in the process of setting up a rather paranoid selinux
environment involving sshd, on a Redhat FC3 system.

the execution of ordinary shells (/bin/bash) is banned - or at
least must be restricted / tracked by selinux.

i am running the sftp subsystem.

therein lies part of the problem - sshd appears to be running
/bin/bash for a user - in the sshd_t domain - as part of the
process of firing up /usr/libexec/ssh/sftp-server.

which is a bit weird and annoying, because what i _wanted_ to do
was to associate a user with a net_context, such that only
a particular user may sftp in from a certain IP address.

... and that's not possible, because by the time sftp-server is
being run, there's a disconnect: sftp-server is in the correct
domain but it only has a unix-domain-socket to contact a forked
sshd, which has the TCP connection open but is still running
in the domain sshd_t.

so basically, my question boils down to this:

* _should_ sshd, after a fork, be still running in sshd_t?

l.

-- 
--
<a href="http://lkcl.net">http://lkcl.net</a>
--

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.