From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 142CBC43613 for ; Thu, 20 Jun 2019 14:50:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E06C52083B for ; Thu, 20 Jun 2019 14:50:15 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DqSspx/H" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726760AbfFTOuP (ORCPT ); Thu, 20 Jun 2019 10:50:15 -0400 Received: from mail-ed1-f68.google.com ([209.85.208.68]:43867 "EHLO mail-ed1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726686AbfFTOuP (ORCPT ); Thu, 20 Jun 2019 10:50:15 -0400 Received: by mail-ed1-f68.google.com with SMTP id e3so5069585edr.10 for ; Thu, 20 Jun 2019 07:50:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=TWZw/JxQ28j5NxTxfJukYEu9Wi/9QQhBTfwBSr1o4w4=; b=DqSspx/HqAhXo+Sp5qhQv3AFMAlinhl2NjiKTjWanr8d3C/EMzSBECCDjPR3wU77o/ Wl57FEhn27dOaVBPtWlpAlDKxOk6jMkSkf/5rkr/HTX6brtVh0UO4lizgUFTf067U8vf aMWdmnn+LbAe8XoV0e+i580F0z1xzdEymnkqtjEwQXpBwxQOL53Ss+zNzI8YTtvFE4m2 epD0g/4D/OIPGM6UQAWE1O+pG7OPWMmLrpHwz7/FHX6wsiIz1l+xIIQ75uit82cryZmZ Z988N/kFhmZnh78ku2WDCZgFdM3w6ZL8wryeuWjDqfeBBjWAKskgTYzC1pIx/Tb1YaSY wLgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=TWZw/JxQ28j5NxTxfJukYEu9Wi/9QQhBTfwBSr1o4w4=; b=sdlbCPwMEmwq2QgDIJMHx8QmD63dhRguMYJ4gIeZSG+5eadtogDcCJ71zyy0CHD0zt OVKFvDJFMU7JcKSneoEGBqV9VRnLYdlgmpZ67rUcdVUIaurBE1gu7EX94TytYfaB9iLE EJhZuBLHWL2kLHMhLnQV2V4Q+moBysdvz6Q3HH7s9C0VXxY8HmkFPGx7yKW0rcXUcodA AcmyqFXYEdwY6aKvyZ/xp+DIDN2/P61GNfA/0t2eLFs+mXh8RejEnUod9kBJWdXwqCfZ DX7YVCkhE2FsHSFozF2lldr9ixCJ6M+v/Zv12TJyTzm6PjPKL6xZK04jk6CSafEK0Smj 0h/g== X-Gm-Message-State: APjAAAXPz8jKbdZwh1XgC+SZL/U09RVt8TiUhjno6NqCmUuPS8UxHJ2C e4VxzDGgwRWCsAcqxHWL8/seQglD X-Google-Smtp-Source: APXvYqzFu8SlGRoabqW4CmHhjsLo/cMKCrz5ODj4bSHgqFKPhG/eJRfjrjKAAucrLQbeVjeAxMQSWg== X-Received: by 2002:a50:a5e7:: with SMTP id b36mr113374395edc.301.1561042214023; Thu, 20 Jun 2019 07:50:14 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id a27sm6704889edd.78.2019.06.20.07.50.13 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Thu, 20 Jun 2019 07:50:13 -0700 (PDT) Date: Thu, 20 Jun 2019 16:50:11 +0200 From: Dominick Grift To: Alexander Miroshnichenko Cc: selinux-refpolicy@vger.kernel.org Subject: Re: [PATCH v2 2/2] ssh: Add interface ssh_search_dir Message-ID: <20190620145011.GC2647@brutus.lan> Mail-Followup-To: Alexander Miroshnichenko , selinux-refpolicy@vger.kernel.org References: <20190620144138.15172-1-alex@millerson.name> <20190620144138.15172-3-alex@millerson.name> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ALfTUftag+2gvp1h" Content-Disposition: inline In-Reply-To: <20190620144138.15172-3-alex@millerson.name> User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --ALfTUftag+2gvp1h Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 20, 2019 at 05:41:38PM +0300, Alexander Miroshnichenko wrote: > Create interface ssh_search_dir to allow ssh_server search for keys in no= n-standard location. >=20 > Signed-off-by: Alexander Miroshnichenko > --- > policy/modules/services/ssh.if | 18 ++++++++++++++++++ > 1 file changed, 18 insertions(+) >=20 > diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh= =2Eif > index 0941f133711e..51c64ded00c4 100644 > --- a/policy/modules/services/ssh.if > +++ b/policy/modules/services/ssh.if > @@ -680,6 +680,24 @@ interface(`ssh_agent_exec',` > can_exec($1, ssh_agent_exec_t) > ') > =20 > +######################################## > +## > +## Search for keys in non-standard location > +## > +## > +## > +## Domain allowed access. > +## > +## > +# > +interface(`ssh_search_dir',` > + gen_require(` > + type sshd_t; > + ') > + > + allow sshd_t $1:dir search_dir_perms; This is generally not allowed. The caller should generally be the source. Regardless of the above. Keys should be in user home directories. I wonder = what specific scenario prompted you to propose this interface? > +') > + > ######################################## > ## > ## Read ssh home directory content > --=20 > 2.21.0 >=20 --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --ALfTUftag+2gvp1h Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0LnR8ACgkQJXSOVTf5 R2lR4wv/ca0OCq/YHBE/YOv2Sc1iuAlw2MzLTVRrADrf2RfroeBhQJ4CbW7lytDl 9t6vGzv3zwjzuY6dAQ/8ZQFYvku6Qu6HozBNPAKFDtMfdwdYZmX+RSvc8Ckv8v/7 Kr7/L7JznMfkEIVQsXfur2K4fC8Qe08NzjB63h54olgZLOB4S1LGY4Ur48vp7e/8 t1/ey9i5KGBP41taR9S5C8WzJE8gdQfkbaf5V697zcrfw5Rcx05kiF2zovdLD5ep qXkTlvmqVdlzpYEIxOG/6gx7W268ix3WpuFTlKO1H6EzzOM7UbUXIJ/yYPzP26iW Oxb9lSQZ19IUg6pLfqxeDbbijHGNKt98IO/yz4rP+tQdYys6kMZlxe/shXLW8a7d GzHbg0rjNImYgAe180NnNTJp7bFklzs3JX4D88w4F6QhURTGf5iYlIV+7IE4LguS d7a2503r5FsbdzSscelmrbJAa0Q9vQ9Vcbwj7G0M4BFzg+s3s5EHzeQRJnacyNOH 2rPB6MZd =6WS5 -----END PGP SIGNATURE----- --ALfTUftag+2gvp1h--