On четверг, 20 июня 2019 г. 17:50:11 MSK, Dominick Grift wrote:
On Thu, Jun 20, 2019 at 05:41:38PM +0300, Alexander Miroshnichenko wrote:
Create interface ssh_search_dir to allow ssh_server search for
keys in non-standard location.
Signed-off-by: Alexander Miroshnichenko <alex@xxxxxxxxxxxxxx>
---
policy/modules/services/ssh.if | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/policy/modules/services/ssh.if
b/policy/modules/services/ssh.if
index 0941f133711e..51c64ded00c4 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -680,6 +680,24 @@ interface(`ssh_agent_exec',`
can_exec($1, ssh_agent_exec_t)
')
+########################################
+## <summary>
+## Search for keys in non-standard location
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ssh_search_dir',`
+ gen_require(`
+ type sshd_t;
+ ')
+
+ allow sshd_t $1:dir search_dir_perms;
This is generally not allowed. The caller should generally be the source.
Regardless of the above. Keys should be in user home
directories. I wonder what specific scenario prompted you to
propose this interface?
GIT hosting software like gitolite/gitosis/gitea manage users ssh keys and
store them own location like /var/lib/gitolite/.ssh .
/var/lib/gitolite have gitosis_var_lib_t type,
/var/lib/gitolite/.ssh have gitosis_ssh_home_t type (in patched policy
which
I want to submit).
If sshd does not have { search getattr } permissions to full path to ssh
key
user fail to login.
Can you propose corret way to give such permissions to multiple policies?
It is incorrect to label /var/lib/gitolite as user_home_dir_t type, IMHO.
+')
+
########################################
## <summary>
## Read ssh home directory content ...
