All of lore.kernel.org
 help / color / mirror / Atom feed
* ssh policy
@ 2004-09-08 18:28 Russell Coker
  2004-09-09 20:33 ` James Carter
  0 siblings, 1 reply; 15+ messages in thread
From: Russell Coker @ 2004-09-08 18:28 UTC (permalink / raw)
  To: SE Linux

[-- Attachment #1: Type: text/plain, Size: 352 bytes --]

The attached patch restores the functionality of sshd_extern_t after the 
recent can_exec change.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: ssh.diff --]
[-- Type: text/x-diff, Size: 818 bytes --]

--- /usr/src/se/policy/domains/program/ssh.te	2004-09-02 23:18:48.000000000 +1000
+++ ./domains/program/ssh.te	2004-09-07 23:36:07.000000000 +1000
@@ -26,6 +26,8 @@
 # privfd is for passing the terminal file handle to the user process
 # auth_chkpwd is for running unix_chkpwd and unix_verify.
 type $1_t, domain, privuser, privrole, privlog, privowner, privfd, auth_chkpwd, nscd_client_domain;
+can_exec($1_t, sshd_exec_t)
+r_dir_file($1_t, self)
 role system_r types $1_t;
 dontaudit $1_t shadow_t:file { getattr read };
 uses_shlib($1_t)
@@ -147,8 +149,6 @@
 # sshd_extern_t is the domain for ssh from outside our network
 #
 sshd_program_domain(sshd)
-can_exec(sshd_t, sshd_exec_t)
-r_dir_file(sshd_t, self)
 if (ssh_sysadm_login) {
 sshd_spawn_domain(sshd, userdomain, { sysadm_devpts_t userpty_type })
 } else {

^ permalink raw reply	[flat|nested] 15+ messages in thread
* (no subject)
@ 2003-12-05  1:18 Nick
  2003-12-05  2:07 ` ssh policy Russell Coker
  0 siblings, 1 reply; 15+ messages in thread
From: Nick @ 2003-12-05  1:18 UTC (permalink / raw)
  To: SE Linux

I rebooted the system and logged into the console

newrole -r sysadm_r

dmesg | grep ssh

avc:  denied  { signal } for  pid=1002 exe=/usr/sbin/sshd
scontext=system_u:system_r:sshd_t tcontext=system_u:system_r:sshd_t
tclass=process

I dont think I get this one at all, unless the process which is starting
sshd is what is not able to send a signal or is it sshd can't send a
signal out?

now I walk over to a terminal and ssh in.

newrole -r sysadm_r

dmesg | grep ssh

avc:  denied  { signal } for  pid=1002 exe=/usr/sbin/sshd
scontext=system_u:system_r:sshd_t tcontext=system_u:system_r:sshd_t
tclass=process

avc:  denied  { getattr } for  pid=1055 exe=/usr/sbin/sshd name=xauth
dev=03:02 ino=2261013 scontext=system_u:system_r:sshd_t
tcontext=system_u:object_r:bin_t tclass=file

avc:  denied  { name_bind } for  pid=1055 exe=/usr/sbin/sshd port=6010
scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:port_t
tclass=tcp_socket

The first one is the message that is still there from the startup. I'm
not sure I understand the next two though.

The daemon wants getattr access to xauth (Why) and it wants to bind to
6010. (Why)

More importantly the question is if these are normal why aren't the
covered by the policy already in place? I certainly didn't go out of my
way to change the behavior of SSH.

A google search of "SSH" and 6010 indicates that this is normal behavior
when the daemon is started with port forwarding turned on. So the
question again is since this is "Normal" for Redhat, what is up with the
policy??

Nix

-- 
Never give a cow a typewriter - Click, Clack, Moo

Nick (Nix) Gray
Senior Systems Engineer
Bruzenak Inc.
(512) 331-7998

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 15+ messages in thread
* ssh policy
@ 2002-10-23 18:52 Russell Coker
  2002-10-23 19:20 ` Stephen Smalley
  0 siblings, 1 reply; 15+ messages in thread
From: Russell Coker @ 2002-10-23 18:52 UTC (permalink / raw)
  To: selinux

# Proxy openlogging.
allow $1_ssh_t http_cache_port_t:tcp_socket name_bind;

The above has just appeared in the new policy.  I suggest that it be in the 
policy commented out at the most.

This allows any ssh user (IE any user) to potentially subvert the web cache if 
they can cause it to crash.

I don't think I'll include this in my policy tree.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 15+ messages in thread
* ssh policy
@ 2002-07-31 16:53 Russell Coker
  0 siblings, 0 replies; 15+ messages in thread
From: Russell Coker @ 2002-07-31 16:53 UTC (permalink / raw)
  To: SE Linux

I've put a new archive of my SE Linux policy on 
http://www.coker.com.au/selinux/policy.tgz (no debs yet because I'm still 
experimenting with it).

The major change I've just made is merging ssh.te and sshd.te.  The reason 
for this is that they both require access to ~/.ssh, this means that to 
support one without the other makes the policy more complex but delivers 
little benefit.  There are few people who want to run ssh without sshd (or 
the other way around).  Also I believe that having the files separate will 
result in someone deciding that they don't want ssh and removing ssh.te but 
not /usr/bin/ssh!  This would result in /usr/bin/ssh running in user_t thus 
being marginally less secure.

While these issues are both minor, I think it's enough reason for us as 
policy developers to save ourselves the extra effort and merge the files.

Also it's just occurred to me that I should create a new domain for 
ssh-keygen to give an automatic transition of key files 
{identity,id_rsa,id_dsa}{,.pub} to a type that can't be read by sshd.  I had 
previously thought of just using a different type for the identity, id_dsa, 
and id_rsa files, but I realised that sshd has no cause to read the .pub 
files (although I don't think there's any real need to deny read access 
either).


-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2004-09-13 20:19 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-09-08 18:28 ssh policy Russell Coker
2004-09-09 20:33 ` James Carter
2004-09-10 14:50   ` Daniel J Walsh
2004-09-10 15:08     ` Stephen Smalley
2004-09-10 15:24       ` Daniel J Walsh
2004-09-10 18:09       ` Luke Kenneth Casson Leighton
2004-09-11  9:13       ` Russell Coker
2004-09-13 12:47         ` Daniel J Walsh
2004-09-13 14:31         ` Daniel J Walsh
2004-09-13 20:18     ` James Carter
  -- strict thread matches above, loose matches on Subject: below --
2003-12-05  1:18 Nick
2003-12-05  2:07 ` ssh policy Russell Coker
     [not found]   ` <1070651210.27071.290.camel@hawaii.efficax.net>
2003-12-06  6:22     ` Russell Coker
2002-10-23 18:52 Russell Coker
2002-10-23 19:20 ` Stephen Smalley
2002-07-31 16:53 Russell Coker

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.