* [refpolicy] [PATCH] ssh: Debian sshd is configured to use capabilities
@ 2013-09-27 11:36 Dominick Grift
2013-09-27 20:27 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Dominick Grift @ 2013-09-27 11:36 UTC (permalink / raw)
To: refpolicy
Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 6977e7a..42a0400 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -245,6 +245,10 @@
corenet_tcp_bind_xserver_port(sshd_t)
corenet_sendrecv_xserver_server_packets(sshd_t)
+ifdef(`distro_debian',`
+ allow sshd_t self:process { getcap setcap };
+')
+
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
# ioctl is necessary for logout() processing for utmp entry and for w to
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH] ssh: Debian sshd is configured to use capabilities
2013-09-27 11:36 [refpolicy] [PATCH] ssh: Debian sshd is configured to use capabilities Dominick Grift
@ 2013-09-27 20:27 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2013-09-27 20:27 UTC (permalink / raw)
To: refpolicy
On Fri 27 Sep 2013 07:36:07 AM EDT, Dominick Grift wrote:
>
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
> index 6977e7a..42a0400 100644
> --- a/policy/modules/services/ssh.te
> +++ b/policy/modules/services/ssh.te
> @@ -245,6 +245,10 @@
> corenet_tcp_bind_xserver_port(sshd_t)
> corenet_sendrecv_xserver_server_packets(sshd_t)
>
> +ifdef(`distro_debian',`
> + allow sshd_t self:process { getcap setcap };
> +')
> +
> tunable_policy(`ssh_sysadm_login',`
> # Relabel and access ptys created by sshd
> # ioctl is necessary for logout() processing for utmp entry and for w to
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-09-27 20:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-27 11:36 [refpolicy] [PATCH] ssh: Debian sshd is configured to use capabilities Dominick Grift
2013-09-27 20:27 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.