From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BD50C43613 for ; Thu, 20 Jun 2019 15:51:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0FEF72083B for ; Thu, 20 Jun 2019 15:51:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Ek130hfc" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726654AbfFTPvA (ORCPT ); Thu, 20 Jun 2019 11:51:00 -0400 Received: from mail-ed1-f67.google.com ([209.85.208.67]:43334 "EHLO mail-ed1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726620AbfFTPvA (ORCPT ); Thu, 20 Jun 2019 11:51:00 -0400 Received: by mail-ed1-f67.google.com with SMTP id e3so5350097edr.10 for ; Thu, 20 Jun 2019 08:50:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=wgl9Jr8xjWGUBD34VWsqp5MhHev86vZ8XkKJmsUYpYs=; b=Ek130hfcu0bQIN3rPBGX/jalOCeG998RaW8aboiOgOHjGkvV5s1tEP77GiStWIfanL RIb9+WOKPkZ9yvHUuaHU7YnMQqBY1Ain7bfHf4t6A+oH60g2shI2QiPX9Nsbvau8KOHj 525BOFXTWNQihL1oWfkjg0BdqpK4Bm2fDlwfo+rjIISut/tJD8cwJfGnuk1Bjc/44JDr d/vHYRh06mxyDmUy8QvD5crgjroq5zUrnfb5AC4zcKPVlqHp/bG30VS34+2L5/dHm3WX Ugi4VgY3eZUmEkuQHAIRS/Zjo4lnhurlRKbTlbLpVVGs98S0GsbTJsvzYC0MOhedH0K3 WY0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=wgl9Jr8xjWGUBD34VWsqp5MhHev86vZ8XkKJmsUYpYs=; b=hF0ZCZigOkb76g4oJSfI37wYJwWlNEBrxdv/c3r3oDUJyNlNFAXsluVcqVYjPGT1el XU9gJ4oW9gpJo4eWYCcyOTIRJeKTaPCyXpywIr/TT4VssUHyUPMQxA9lPyt7UKP+FU0v AP+i5W/YvXVPmVFAsbcXiLPLo0iimSuFeeALwAXGpjvEhDVhEzVgNHq16De+KWx996L5 yOf6LiMYegEs1Wue+sMlctWftRiGRbp+IFj1x21iSysULH9at0OmKC+MGRewJHcPhs1c HfyVsSDOAD6dWYu/lrDhN+fpKC1jst3KXniXQsg12jXUsZCtXHKVlvZNGZNUp5DIaOUx RJsQ== X-Gm-Message-State: APjAAAVVWbeQTUNF10JrmqOoLFibhooWzJbD4LhiRVc18a9YZMUDwRHL UWTZ7euhGJUJB5tGTNHvcejo4aVR X-Google-Smtp-Source: APXvYqzs8mPncTAeJKghluuhqsh4BJYu2vQqNjaeleVawaLGCEXXJMGofVjd9Vd+8ps4jNxoQ99g4g== X-Received: by 2002:a50:a56d:: with SMTP id z42mr120747276edb.241.1561045858531; Thu, 20 Jun 2019 08:50:58 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id z12sm4033823edq.57.2019.06.20.08.50.57 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Thu, 20 Jun 2019 08:50:57 -0700 (PDT) Date: Thu, 20 Jun 2019 17:50:55 +0200 From: Dominick Grift To: Alexander Miroshnichenko Cc: selinux-refpolicy@vger.kernel.org Subject: Re: [PATCH v2 2/2] ssh: Add interface ssh_search_dir Message-ID: <20190620155055.GF2647@brutus.lan> Mail-Followup-To: Alexander Miroshnichenko , selinux-refpolicy@vger.kernel.org References: <20190620144138.15172-1-alex@millerson.name> <20190620144138.15172-3-alex@millerson.name> <20190620145011.GC2647@brutus.lan> <642ea6d9-97c9-4ec4-a7ed-84995a953b48@millerson.name> <20190620152731.GD2647@brutus.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="yRA+Bmk8aPhU85Qt" Content-Disposition: inline In-Reply-To: User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --yRA+Bmk8aPhU85Qt Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 20, 2019 at 06:38:10PM +0300, Alexander Miroshnichenko wrote: > On =D1=87=D0=B5=D1=82=D0=B2=D0=B5=D1=80=D0=B3, 20 =D0=B8=D1=8E=D0=BD=D1= =8F 2019 =D0=B3. 18:27:31 MSK, Dominick Grift wrote: > > On Thu, Jun 20, 2019 at 06:05:57PM +0300, Alexander Miroshnichenko wrot= e: > > > On =D1=87=D0=B5=D1=82=D0=B2=D0=B5=D1=80=D0=B3, 20 =D0=B8=D1=8E=D0=BD= =D1=8F 2019 =D0=B3. 17:50:11 MSK, Dominick Grift wrote: ... > >=20 > > Yes this sucks. I would probably do the following instead: > >=20 > > 1. echo "ignoredirs=3D/var/lib/gitolite" >> /etc/selinux/semanage.conf > > 2. semodule -B && restorecon -RvF /var/lib/gitolite > > 3. gitosis_read_lib_files(sshd_t) >=20 > I can't use sshd_t in another policy without require statement. > Or I need to add gitosis_read_lib_files(sshd_t) to ssh.te policy file. > All 3 steps are ugly comparing with new ssh_search_dir() interface. > Why such restrictions where caller must be the source for interface? It is > not flexible. You would need to add the gitosis_read_var_lib_files(sshd_t) to ssh.te yes. I agree that this is ugly but the alternative is even more ugly, and I will= say that this is just what I would do (you might want to wait for maintain= er's advice instead of taking my advice) This is one of those scenario's that are the exception rather than the rule= =2E All options are bad. The "restriction" is actually an unwritten rule as I cannot find any refere= nces to it in https://github.com/SELinuxProject/refpolicy/wiki/StyleGuide s= o you might be able to get away with it. >=20 > >=20 > > Dont bother with labeling /var/lib/gitolite/.ssh differently > >=20 > > > ... > >=20 >=20 --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --yRA+Bmk8aPhU85Qt Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGyBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0Lq1sACgkQJXSOVTf5 R2ll4Av4yt8RwP4WAqSIUs8NnPHtYKNAf0lm7VYCZsAAo2yKcp5ojlbIyNc9+Qom 6UFvArMYAjeTyNgnciGJeS8S3LNRAfw12lmKD+HXFL9eF0C479B7/iGqpnJkeGGD R/Kpq2vdAfRRkC4LBruA10iBcIO1Ae0eNDG+A+H8HKryIwVyza16YjMSZc+4D2gT 5KfgHgltCZourWIk0QOeYB7SIlFsY+LjRkajVHACpunr1q3skJLc0/FdiBwfA4k5 TSL73FLgGRbHV+uOQhrEAC6wECSoiY40jwbPIksN4MI8npu4mO14/Llj1biwlcc6 mpLIkTNbguMtbLB5UMGirqorzInyGFxq510THWQwZDJiFw2hHi7W9NrH25JnlZdM 1HmTD+KtOkfYJ/uLT4KeHL8UtwSWuxr7XswspfgtW7k/ECzKk8dO5EJMte+Iq7Cc URsqfBfofjZEK6P1498ANJ9qz0q2diqYjeBI06o7xPxHkYi4NMZ7w+4dhvpjBAPy 033KqVA= =qQ5H -----END PGP SIGNATURE----- --yRA+Bmk8aPhU85Qt--