The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
PATCH 1/1 The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
This keytab functionality should be re-evaluated because it does not make sense in its current implementation
policy/modules/services/ssh.te +7 -1
@@ -74,6 +74,9 @@ typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; userdom_user_home_content(ssh_home_t) +type sshd_keytab_t; +files_type(sshd_keytab_t) + ############################## # # SSH client local policy
@@ -224,6 +227,8 @@ allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; +allow sshd_t sshd_keytab_t:file read_file_perms; + manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)
@@ -261,7 +266,8 @@ ') optional_policy(` - kerberos_keytab_template(sshd, sshd_t) + kerberos_read_keytab(sshd_t) + kerberos_use(sshd_t) ') optional_policy(`
PATCH 1/1 The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
Dan/Miroslav, do you have any comments on the keytab functions? I don't have a kerberos system to look at.
Dominick, from your contrib commit, you're saying that you looked at this because it breaks monolithic? Its too bad the toolchain can't emit file_context files out of semodule_expand, as then we could build all policies as modular, and then if monolithic is requested, simply expand out the modules into policy.2x and file_context files.
Quoted 42 lines · Dominick Grift
This keytab functionality should be re-evaluated because it does not make sense in its current implementation
Signed-off-by Dominick Grift <[email protected]>policy/modules/services/ssh.te +7
-1@@ -74,6 +74,9 @@ typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; userdom_user_home_content(ssh_home_t) +type sshd_keytab_t; +files_type(sshd_keytab_t) + ############################## # # SSH client local policy@@ -224,6 +227,8 @@ allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; +allow sshd_t sshd_keytab_t:file read_file_perms; + manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)@@ -261,7 +266,8 @@ ') optional_policy(` - kerberos_keytab_template(sshd, sshd_t) + kerberos_read_keytab(sshd_t) + kerberos_use(sshd_t) ') optional_policy(`_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
Quoted 4 lines · Christopher J. PeBenito
Dan/Miroslav, do you have any comments on the keytab functions? I don't have a kerberos system to look at.
Dominick, from your contrib commit, you're saying that you looked at this because it breaks monolithic? Its too bad the toolchain can't emit
file_contextfiles out ofsemodule_expand, as then we could build all policies as modular, and then if monolithic is requested, simply expand out the modules into policy.2x andfile_contextfiles.
The monolithic issue i raised is due to the type declarations in the kerberos_keytab_template(), not the file contexts (you will get into nesting optional policy issues if you declare types in optional policy, which is hard to diagnose and also just unnecessary)
The file contexts would raise problems in modular policy, so yes that is another reason to change this to be unconditional (although it was not my primary reason for this commit)
Quoted 45 lines · Dominick Grift
Quoted 42 lines
This keytab functionality should be re-evaluated because it does not make sense in its current implementation
Signed-off-by Dominick Grift <[email protected]>policy/modules/services/ssh.te +7
-1@@ -74,6 +74,9 @@ typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; userdom_user_home_content(ssh_home_t) +type sshd_keytab_t; +files_type(sshd_keytab_t) + ############################## # # SSH client local policy@@ -224,6 +227,8 @@ allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; +allow sshd_t sshd_keytab_t:file read_file_perms; + manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)@@ -261,7 +266,8 @@ ') optional_policy(` - kerberos_keytab_template(sshd, sshd_t) + kerberos_read_keytab(sshd_t) + kerberos_use(sshd_t) ') optional_policy(`_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
PATCH 1/1 The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
In reply to Christopher J. PeBenito-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 9 lines · Christopher J. PeBenito
Dan/Miroslav, do you have any comments on the keytab functions? I don't have a kerberos system to look at.
Dominick, from your contrib commit, you're saying that you looked at this because it breaks monolithic? Its too bad the toolchain can't emit
file_contextfiles out ofsemodule_expand, as then we could build all policies as modular, and then if monolithic is requested, simply expand out the modules into policy.2x andfile_contextfiles.
I think this is a good idea. We should change to this. I was never a fan of creating types in interfaces for all of the weird side effects and makes code harder to understand.
Quoted 22 lines · Dominick Grift
Quoted 21 lines
This keytab functionality should be re-evaluated because it does not make sense in its current implementation
Signed-off-by Dominick Grift <[email protected]> diff --gita/policy/modules/services/ssh.te b/policy/modules/services/ssh.te index eada65c..568c335 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -74,6 +74,9 @@ typealias
ssh_home_talias {auditadm_home_ssh_tsecadm_home_ssh_t};userdom_user_home_content(ssh_home_t)+type
sshd_keytab_t; +files_type(sshd_keytab_t) + ############################## # # SSH client local policy @@ -224,6 +227,8 @@ allowsshd_tself:netlink_route_socketr_netlink_socket_perms; allowsshd_tself:key { search link write };+allow
sshd_tsshd_keytab_t:fileread_file_perms; +manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)@@ -261,7 +266,8 @@ ')
Quoted 9 lines
Quoted 7 lines
optional_policy(` -
kerberos_keytab_template(sshd, sshd_t)+kerberos_read_keytab(sshd_t)+kerberos_use(sshd_t)')optional_policy(` _______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlIbXQEACgkQrlYvE4MpobOLLACg58KPX0C0zSwVXLnBVkn36DM1 GvcAoNVw28+hCXmRfsAPsvlp8xLqCmPw
=DT/w
-----END PGP SIGNATURE-----
PATCH 1/1 The kerberos_keytab_template() template is deprecated: Breaks monolithic built (out-of-scope)
In reply to Dominick GriftQuoted 29 lines · Dominick Grift
This keytab functionality should be re-evaluated because it does not make sense in its current implementation
Signed-off-by Dominick Grift <[email protected]>policy/modules/services/ssh.te +5
-0@@ -74,6 +74,9 @@ typealias ssh_home_t alias { auditadm_home_ssh_t secadm_home_ssh_t }; userdom_user_home_content(ssh_home_t) +type sshd_keytab_t; +files_type(sshd_keytab_t) + ############################## # # SSH client local policy@@ -224,6 +227,8 @@ allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; +allow sshd_t sshd_keytab_t:file read_file_perms; + manage_dirs_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t) manage_sock_files_pattern(sshd_t, sshd_tmp_t, sshd_tmp_t)
policy/modules/services/ssh.te line 271
Quoted 7 lines
policy/modules/services/ssh.te +2
-1@@ -261,7 +266,8 @@ ') optional_policy(` - kerberos_keytab_template(sshd, sshd_t) + kerberos_read_keytab(sshd_t) + kerberos_use(sshd_t) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com