[refpolicy] services_ssh.patch

[refpolicy] services_ssh.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_ssh.patch

Handle /root/.ssh directory


Lots of other fixes.

[refpolicy] services_ssh.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 17:02 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_ssh.patch
> 
> Handle /root/.ssh directory
> 
> 
> Lots of other fixes.

Moved tmpfs to server template to go along with the sem usage.

Since the tunnel support apparently needs net_admin capability, it needs
to be put in a conditional.  The capability definitely shouldn't be
allowed in general use.

Dropped home dir changes to the client template.  It shouldn't be using
the user's ssh home dir.

Moved the "Required for FreeNX" /var/lib rules into the NX optional.

Otherwise merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] services_ssh.patch

[Daniel J Walsh]

On 01/15/2010 03:28 PM, Christopher J. PeBenito wrote:
> On Thu, 2009-11-12 at 17:02 -0500, Daniel J Walsh wrote:
>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_ssh.patch
>>
>> Handle /root/.ssh directory
>>
>>
>> Lots of other fixes.
> 
> Moved tmpfs to server template to go along with the sem usage.
> 
> Since the tunnel support apparently needs net_admin capability, it needs
> to be put in a conditional.  The capability definitely shouldn't be
> allowed in general use.
> 
> Dropped home dir changes to the client template.  It shouldn't be using
> the user's ssh home dir.
> 
> Moved the "Required for FreeNX" /var/lib rules into the NX optional.
> 
> Otherwise merged.
> 
You still have places in your ssh.te that use home_ssh_t as opposed to ssh_home_t.

Which should we use?

[refpolicy] services_ssh.patch

[Christopher J. PeBenito]

On Mon, 2010-01-18 at 15:29 -0500, Daniel J Walsh wrote:
> On 01/15/2010 03:28 PM, Christopher J. PeBenito wrote:
> > On Thu, 2009-11-12 at 17:02 -0500, Daniel J Walsh wrote:
> >> http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_ssh.patch

> >> Handle /root/.ssh directory
> >>
> >>
> >> Lots of other fixes.
> > 
> > Moved tmpfs to server template to go along with the sem usage.
> > 
> > Since the tunnel support apparently needs net_admin capability, it needs
> > to be put in a conditional.  The capability definitely shouldn't be
> > allowed in general use.
> > 
> > Dropped home dir changes to the client template.  It shouldn't be using
> > the user's ssh home dir.
> > 
> > Moved the "Required for FreeNX" /var/lib rules into the NX optional.
> > 
> > Otherwise merged.
> > 
> You still have places in your ssh.te that use home_ssh_t as opposed to ssh_home_t.
> 
> Which should we use?

ssh_home_t.  I've fixed the usage.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] services_ssh.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/services_ssh.patch

ssh_home_t should not be per user.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx26UMACgkQrlYvE4MpobOPNACgi3DNR2M7p50eAT/uOZGAxo5D
VhIAn0yOaNZULftrjuxMwAIqSYQzI4Te
=AQZ/
-----END PGP SIGNATURE-----

[refpolicy] services_ssh.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/services_ssh.patch

Handle ssh-copy-id

ssh_home_t should not be per domain.

ssh needs to ask kernel to load modules

Handle tunnels

Allow sshd_t to transition to sftpd_t

[refpolicy] services_ssh.patch

[Christopher J. PeBenito]

On Tue, 2010-02-23 at 17:14 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F13/services_ssh.patch
> 
> Handle ssh-copy-id
> 
> ssh_home_t should not be per domain.

The template you're changing is not used for user home dirs.
ssh_role_template() does not call ssh_basic_client_template().
ssh_basic_client_template() is only called from nx and xen, where it
makes sense to have separate ssh keys.

> ssh needs to ask kernel to load modules
> 
> Handle tunnels
> 
> Allow sshd_t to transition to sftpd_t
> 
> 

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] services_ssh.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/services_ssh.patch

Add label for /root/.ssh



Lots of fixes to remove specify home labeling