Skip to contentSkip to conversation

Properly label /etc/ssh/ssh_host_ecdsa_key private key

PATCH New Laurent Bigonville 3 participants 8 messages Sep 12, 2012 – Nov 27, 2012

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH 1/2 Properly label /etc/ssh/ssh_host_ecdsa_key private key

From: Laurent Bigonville <[email protected]>

Since version 5.7, openssh supports ECDSA keys; properly label the private key file.

---
 policy/modules/services/ssh.fc |    1 +
 1 file changed, 1 insertion(+)
policy/modules/services/ssh.fc +1 -0
index 078bcd7..64b3e11 100644
@@ -3,6 +3,7 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 /etc/ssh/primes			--	gen_context(system_u:object_r:sshd_key_t,s0)
 /etc/ssh/ssh_host_key 		--	gen_context(system_u:object_r:sshd_key_t,s0)
 /etc/ssh/ssh_host_dsa_key	--	gen_context(system_u:object_r:sshd_key_t,s0)
+/etc/ssh/ssh_host_ecdsa_key	--	gen_context(system_u:object_r:sshd_key_t,s0)
 /etc/ssh/ssh_host_rsa_key	--	gen_context(system_u:object_r:sshd_key_t,s0)
 
 /usr/bin/ssh			--	gen_context(system_u:object_r:ssh_exec_t,s0)
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH 2/2 Add Debian location for ssh-keysign

From: Laurent Bigonville <[email protected]>

---
 policy/modules/services/ssh.fc |    4 ++++
 1 file changed, 4 insertions(+)
policy/modules/services/ssh.fc +4 -0
index 64b3e11..ce0f22f 100644
@@ -12,6 +12,10 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /usr/libexec/openssh/ssh-keysign --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
 
+ifdef(`distro_debian',`
+/usr/lib/openssh/ssh-keysign --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+')
+
 /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
 
 /var/run/sshd\.init\.pid	--	gen_context(system_u:object_r:sshd_var_run_t,s0)
Signature · 1 line
1.7.10.4
author
#2 lore raw

PATCH v2 2/2 Add Debian location for ssh-keysign

From: Laurent Bigonville <[email protected]>

---
 policy/modules/services/ssh.fc |    2 ++
 1 file changed, 2 insertions(+)
policy/modules/services/ssh.fc +2 -0
index 078bcd7..7df96c5 100644
@@ -9,6 +9,8 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 /usr/bin/ssh-agent		--	gen_context(system_u:object_r:ssh_agent_exec_t,s0)
 /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
 
+/usr/lib/openssh/ssh-keysign	 --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+
 /usr/libexec/openssh/ssh-keysign --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
 
 /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
Signature · 1 line
1.7.10.4
#3 lore raw

PATCH v2 2/2 Add Debian location for ssh-keysign

Quoted 12 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 policy/modules/services/ssh.fc |    2 ++
 1 file changed, 2 insertions(+)
policy/modules/services/ssh.fc +0 -0
index 078bcd7..7df96c5 100644

policy/modules/services/ssh.fc HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) · line 16

Quoted 8 lines
policy/modules/services/ssh.fc +2 -0
@@ -9,6 +9,8 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 /usr/bin/ssh-agent		--	gen_context(system_u:object_r:ssh_agent_exec_t,s0)
 /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
 
+/usr/lib/openssh/ssh-keysign	 --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+
 /usr/libexec/openssh/ssh-keysign --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
 
 /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#4 lore raw

PATCH 1/2 Properly label /etc/ssh/ssh_host_ecdsa_key private key

In reply to Laurent Bigonville

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 17 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

Since version 5.7, openssh supports ECDSA keys; properly label the private
key file. --- policy/modules/services/ssh.fc | 1 + 1 file changed, 1
insertion(+)

(quoted diff) +0 -0

b/policy/modules/services/ssh.fc index 078bcd7..64b3e11 100644 --- a/policy/modules/services/ssh.fc +++ b/policy/modules/services/ssh.fc @@ -3,6 +3,7 @@ HOME_DIR/\.ssh(/.*)?
gen_context(system_u:object_r:ssh_home_t,s0) /etc/ssh/primes --
gen_context(system_u:object_r:sshd_key_t,s0) /etc/ssh/ssh_host_key --
gen_context(system_u:object_r:sshd_key_t,s0) /etc/ssh/ssh_host_dsa_key --
gen_context(system_u:object_r:sshd_key_t,s0) +/etc/ssh/ssh_host_ecdsa_key
-- gen_context(system_u:object_r:sshd_key_t,s0) /etc/ssh/ssh_host_rsa_key
-- gen_context(system_u:object_r:sshd_key_t,s0)

Quoted 2 lines

/usr/bin/ssh -- gen_context(system_u:object_r:ssh_exec_t,s0)

How about /etc/ssh/.*_key -- gen_context(system_u:object_r:sshd_key_t,s0)

Then we will not need to worry about this.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBR/lwACgkQrlYvE4MpobOvdgCeMKvMsbrUyPdHySoDNqBGgYsT 9McAoJJpYrWXiPVGAsLCsU5JXwhwkgnD
=LvlC
-----END PGP SIGNATURE-----

author
#5 lore raw

PATCH 1/2 Properly label /etc/ssh/ssh_host_ecdsa_key private key

Le Thu, 13 Sep 2012 11:40:12 -0400,
Daniel J Walsh <[email protected]> a ?crit :

Quoted 4 lines

How about /etc/ssh/.*_key --
gen_context(system_u:object_r:sshd_key_t,s0)

Then we will not need to worry about this.

That could be indeed be a solution.

I've another question about the labels on these files.

On Debian, ssh-keygen is run by the post-installation script of the package which could run in the unconfined_t domain, that means that the files could not be labeled correctly at their creation.

Dominick was suggesting to use named file transitions so they would be labeled correctly even in that case.

Does anybody have a opinion on this?

Cheers

Laurent Bigonville

#6 lore raw

PATCH 1/2 Properly label /etc/ssh/ssh_host_ecdsa_key private key

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 16 lines · Laurent Bigonville

Le Thu, 13 Sep 2012 11:40:12 -0400, Daniel J Walsh <[email protected]> a ?crit :

Quoted 4 lines

How about /etc/ssh/.*_key --
gen_context(system_u:object_r:sshd_key_t,s0)

Then we will not need to worry about this.

That could be indeed be a solution.

I've another question about the labels on these files.

On Debian, ssh-keygen is run by the post-installation script of the package which could run in the unconfined_t domain, that means that the files could not be labeled correctly at their creation.

Quoted 9 lines

Dominick was suggesting to use named file transitions so they would be labeled correctly even in that case.

Does anybody have a opinion on this?

Cheers

Laurent Bigonville

We are currently running ssh_keygen as ssh_keygen_t, but using named file trans is a better solution.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBSQzUACgkQrlYvE4MpobNf9gCgjyWWnnkV0r72TPuYRk4m6Bpi qDQAn3urAdRPqYrJDA2f/TwxvB1dJyz/
=AuVK
-----END PGP SIGNATURE-----

author
#7 lore raw

PATCH v2 1/2 Properly label all the ssh host keys

In reply to Daniel J Walsh

From: Laurent Bigonville <[email protected]>

Be sure that we are labeling properly all ssh host keys even if new algorithms are added in the future.

---
 policy/modules/services/ssh.fc |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
policy/modules/services/ssh.fc +1 -3
index 7df96c5..76d9f66 100644
@@ -1,9 +1,7 @@
 HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /etc/ssh/primes			--	gen_context(system_u:object_r:sshd_key_t,s0)
-/etc/ssh/ssh_host_key 		--	gen_context(system_u:object_r:sshd_key_t,s0)
-/etc/ssh/ssh_host_dsa_key	--	gen_context(system_u:object_r:sshd_key_t,s0)
-/etc/ssh/ssh_host_rsa_key	--	gen_context(system_u:object_r:sshd_key_t,s0)
+/etc/ssh/ssh_host.*_key		--	gen_context(system_u:object_r:sshd_key_t,s0)
 
 /usr/bin/ssh			--	gen_context(system_u:object_r:ssh_exec_t,s0)
 /usr/bin/ssh-agent		--	gen_context(system_u:object_r:ssh_agent_exec_t,s0)
Signature · 1 line
1.7.10.4