[meta-selinux][master][PATCH] openssh: restore SELinux labels for /var/run/sshd

[meta-selinux][master][PATCH] openssh: restore SELinux labels for /var/run/sshd

[Yannik Tannhaeuser]

Since /var/run/sshd is in most deployments a tmpfs, we need to call
restorecon to set the correct SELinux labels each time.

Signed-off-by: Yannik Tannhaeuser <yannik.tannhaeuser@gmail.com>
---
 .../openssh/files/var-run-sshd-restorecon.conf              | 2 ++
 recipes-connectivity/openssh/openssh_selinux.inc            | 6 ++++++
 2 files changed, 8 insertions(+)
 create mode 100644 recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf

diff --git a/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf b/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf
new file mode 100644
index 0000000..250dc4f
--- /dev/null
+++ b/recipes-connectivity/openssh/files/var-run-sshd-restorecon.conf
@@ -0,0 +1,2 @@
+[Socket]
+ExecStartPre=/sbin/restorecon /var/run/sshd
diff --git a/recipes-connectivity/openssh/openssh_selinux.inc b/recipes-connectivity/openssh/openssh_selinux.inc
index 119ce63..6fb105d 100644
--- a/recipes-connectivity/openssh/openssh_selinux.inc
+++ b/recipes-connectivity/openssh/openssh_selinux.inc
@@ -4,15 +4,21 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
 SRC_URI += " \
     file://50-selinux.conf \
+    file://var-run-sshd-restorecon.conf \
 "
 
 do_install:append() {
     install -d ${D}${sysconfdir}/ssh/sshd_config.d
     install -m 0644 ${UNPACKDIR}/50-selinux.conf \
         ${D}${sysconfdir}/ssh/sshd_config.d/50-selinux.conf
+
+    install -d ${D}${systemd_system_unitdir}/sshd.socket.d
+    install -m 0644 ${UNPACKDIR}/var-run-sshd-restorecon.conf \
+        ${D}${systemd_system_unitdir}/sshd.socket.d/var-run-sshd-restorecon.conf
 }
 
 FILES:${PN}-sshd:append = " ${sysconfdir}/ssh/sshd_config.d/50-selinux.conf"
+FILES:${PN}-sshd:append = " ${systemd_system_unitdir}/sshd.socket.d/var-run-sshd-restorecon.conf"
 
 PACKAGECONFIG[selinux] = "--with-selinux,--without-selinux,libselinux"
 PACKAGECONFIG[audit] = "--with-audit=linux,--without-audit,audit"
-- 
2.43.0

Re: [meta-selinux][master][PATCH] openssh: restore SELinux labels for /var/run/sshd

[Yannik Tannhaeuser]

[-- Attachment #1: Type: text/plain, Size: 120 bytes --]

Hi all,

please let me know if you want take this patch or have any suggestions for improving it.

Thanks,
Yannik

[-- Attachment #2: Type: text/html, Size: 4374 bytes --]