Some fixes in the ssh module with regard to userdom_user_home_content and ubac.
PATCH 1/1 Some fixes in the ssh module with regard to userdom_user_home_content and ubac.
---
:100644 100644 ef3f32d... 1a59f6a... M policy/modules/services/ssh.if
:100644 100644 512834a... afbe9ac... M policy/modules/services/ssh.te
policy/modules/services/ssh.if | 4 +++- policy/modules/services/ssh.te | 1 - 2 files changed, 3 insertions(+), 2 deletions(-)
policy/modules/services/ssh.if +3 -1
@@ -45,11 +45,13 @@ template(`ssh_basic_client_template',` type $1_ssh_t; application_domain($1_ssh_t, ssh_exec_t) + ubac_constrained($1_ssh_t) + role $3 types $1_ssh_t; type $1_ssh_home_t; - files_type($1_ssh_home_t) typealias $1_ssh_home_t alias $1_home_ssh_t; + userdom_user_home_content($1_ssh_home_t) ############################## #
policy/modules/services/ssh.te +0 -1
@@ -74,7 +74,6 @@ ubac_constrained(ssh_tmpfs_t) type ssh_home_t; typealias ssh_home_t alias { home_ssh_t user_ssh_home_t user_home_ssh_t staff_home_ssh_t sysadm_home_ssh_t }; typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; -files_type(ssh_home_t) userdom_user_home_content(ssh_home_t) ##############################
Signature · 9 lines
1.7.1.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100709/daa0a627/attachment-0001.bin
PATCH 1/1 Some fixes in the ssh module with regard to userdom_user_home_content and ubac.
Quoted 17 lines · Dominick Grift
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 ef3f32d... 1a59f6a... M policy/modules/services/ssh.if
:100644 100644 512834a... afbe9ac... M policy/modules/services/ssh.tepolicy/modules/services/ssh.if | 4 +++- policy/modules/services/ssh.te | 1 - 2 files changed, 3 insertions(+), 2 deletions(-)policy/modules/services/ssh.if +1
-0@@ -45,11 +45,13 @@ template(`ssh_basic_client_template',` type $1_ssh_t; application_domain($1_ssh_t, ssh_exec_t) + ubac_constrained($1_ssh_t)
policy/modules/services/ssh.if template(`ssh_basic_client_template',` · line 57
Quoted 10 lines
policy/modules/services/ssh.if +2
-1+ role $3 types $1_ssh_t; type $1_ssh_home_t; - files_type($1_ssh_home_t) typealias $1_ssh_home_t alias $1_home_ssh_t; + userdom_user_home_content($1_ssh_home_t) ############################## #
I don't think we actually want this change. The template isn't meant to be used by users; they use ssh_t.
Quoted 12 lines
policy/modules/services/ssh.te +0
-1@@ -74,7 +74,6 @@ ubac_constrained(ssh_tmpfs_t) type ssh_home_t; typealias ssh_home_t alias { home_ssh_t user_ssh_home_t user_home_ssh_t staff_home_ssh_t sysadm_home_ssh_t }; typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; -files_type(ssh_home_t) userdom_user_home_content(ssh_home_t) ##############################
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Some fixes in the ssh module with regard to userdom_user_home_content and ubac.
Quoted 27 lines · Christopher J. PeBenito
Quoted 26 lines · Dominick Grift
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 ef3f32d... 1a59f6a... M policy/modules/services/ssh.if
:100644 100644 512834a... afbe9ac... M policy/modules/services/ssh.tepolicy/modules/services/ssh.if | 4 +++- policy/modules/services/ssh.te | 1 - 2 files changed, 3 insertions(+), 2 deletions(-)policy/modules/services/ssh.if +3
-1@@ -45,11 +45,13 @@ template(`ssh_basic_client_template',` type $1_ssh_t; application_domain($1_ssh_t, ssh_exec_t) + ubac_constrained($1_ssh_t) + role $3 types $1_ssh_t; type $1_ssh_home_t; - files_type($1_ssh_home_t) typealias $1_ssh_home_t alias $1_home_ssh_t; + userdom_user_home_content($1_ssh_home_t)
Quoted 6 lines
policy/modules/services/ssh.if template(`ssh_basic_client_template',` · line 57
Quoted 2 lines
policy/modules/services/ssh.if +0
-0############################## #I don't think we actually want this change. The template isn't meant to be used by users; they use
ssh_t.
Is this not a template for ssh client application? Is that not an user agent. Should user agents not be ubac_constrained?
Is $1_ssh_home_t not userdom_user_home_content. However you look at it?
Quoted 2 lines
Quoted 1 line
##############################
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 261 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100712/3eb4d5df/attachment-0001.bin
PATCH 1/1 Some fixes in the ssh module with regard to userdom_user_home_content and ubac.
Quoted 28 lines · Dominick Grift
Quoted 27 lines · Christopher J. PeBenito
Quoted 26 lines · Dominick Grift
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 ef3f32d... 1a59f6a... M policy/modules/services/ssh.if
:100644 100644 512834a... afbe9ac... M policy/modules/services/ssh.tepolicy/modules/services/ssh.if | 4 +++- policy/modules/services/ssh.te | 1 - 2 files changed, 3 insertions(+), 2 deletions(-)policy/modules/services/ssh.if +3
-1@@ -45,11 +45,13 @@ template(`ssh_basic_client_template',` type $1_ssh_t; application_domain($1_ssh_t, ssh_exec_t) + ubac_constrained($1_ssh_t) + role $3 types $1_ssh_t; type $1_ssh_home_t; - files_type($1_ssh_home_t) typealias $1_ssh_home_t alias $1_home_ssh_t; + userdom_user_home_content($1_ssh_home_t)
Quoted 8 lines
Quoted 6 lines
policy/modules/services/ssh.if template(`ssh_basic_client_template',` · line 57
Quoted 2 lines
policy/modules/services/ssh.if +0
-0############################## #I don't think we actually want this change. The template isn't meant to be used by users; they use
ssh_t.Is this not a template for ssh client application?
Yes, but not necessarily for users. This could be used for an automated processes run out of cron to just scp a file from this machine over to another one (eg. a poor man's backup).
Quoted 2 lines
Is that not an user
agent. Should user agents not beubac_constrained?
They should.
Quoted 1 line
Is $1_ssh_home_t not
userdom_user_home_content. However you look at it?
No, it would only be if this is for users.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com