From: dwalsh@redhat.com (Daniel J Walsh)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH 1/2] Properly label /etc/ssh/ssh_host_ecdsa_key private key
Date: Thu, 13 Sep 2012 16:33:57 -0400 [thread overview]
Message-ID: <50524335.6020003@redhat.com> (raw)
In-Reply-To: <20120913182419.4c73f1e2@eldamar.bigon.be>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/13/2012 12:24 PM, Laurent Bigonville wrote:
> Le Thu, 13 Sep 2012 11:40:12 -0400, Daniel J Walsh <dwalsh@redhat.com> a
> ?crit :
>
>> How about /etc/ssh/.*_key --
>> gen_context(system_u:object_r:sshd_key_t,s0)
>>
>> Then we will not need to worry about this.
>
> That could be indeed be a solution.
>
> I've another question about the labels on these files.
>
> On Debian, ssh-keygen is run by the post-installation script of the package
> which could run in the unconfined_t domain, that means that the files could
> not be labeled correctly at their creation.
>
> Dominick was suggesting to use named file transitions so they would be
> labeled correctly even in that case.
>
> Does anybody have a opinion on this?
>
> Cheers
>
> Laurent Bigonville
>
We are currently running ssh_keygen as ssh_keygen_t, but using named file
trans is a better solution.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlBSQzUACgkQrlYvE4MpobNf9gCgjyWWnnkV0r72TPuYRk4m6Bpi
qDQAn3urAdRPqYrJDA2f/TwxvB1dJyz/
=AuVK
-----END PGP SIGNATURE-----
next prev parent reply other threads:[~2012-09-13 20:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-12 19:56 [refpolicy] [PATCH 1/2] Properly label /etc/ssh/ssh_host_ecdsa_key private key Laurent Bigonville
2012-09-12 19:56 ` [refpolicy] [PATCH 2/2] Add Debian location for ssh-keysign Laurent Bigonville
2012-11-04 1:23 ` [refpolicy] [PATCH 2/2 v2] " Laurent Bigonville
2012-11-26 16:13 ` Christopher J. PeBenito
2012-09-13 15:40 ` [refpolicy] [PATCH 1/2] Properly label /etc/ssh/ssh_host_ecdsa_key private key Daniel J Walsh
2012-09-13 16:24 ` Laurent Bigonville
2012-09-13 20:33 ` Daniel J Walsh [this message]
2012-11-27 19:21 ` [refpolicy] [PATCH 1/2 v2] Properly label all the ssh host keys Laurent Bigonville
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50524335.6020003@redhat.com \
--to=dwalsh@redhat.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.