Skip to contentSkip to conversation

Add fcontext for sshd pidfile and directory used for privsep

PATCH New Laurent Bigonville 2 participants 6 messages Jan 25, 2014 – Feb 1, 2014

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH 1/2 Add fcontext for sshd pidfile and directory used for privsep

From: Laurent Bigonville <[email protected]>

Also allow sshd_t domain to chroot(2) in this directory as explained in the README.privsep file in the openssh tarball.

Thanks to Russell Coker for this patch

---
 policy/modules/services/ssh.fc | 2 ++
 policy/modules/services/ssh.te | 1 +
 2 files changed, 3 insertions(+)
policy/modules/services/ssh.fc +2 -0
index 76d9f66..8168244 100644
@@ -13,4 +13,6 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /usr/sbin/sshd			--	gen_context(system_u:object_r:sshd_exec_t,s0)
 
+/var/run/sshd(/.*)?			gen_context(system_u:object_r:sshd_var_run_t,s0)
 /var/run/sshd\.init\.pid	--	gen_context(system_u:object_r:sshd_var_run_t,s0)
+/var/run/sshd\.pid		--	gen_context(system_u:object_r:sshd_var_run_t,s0)
policy/modules/services/ssh.te +1 -0
index 30726f2..a19c9f9 100644
@@ -34,6 +34,7 @@ ssh_server_template(sshd)
 init_daemon_domain(sshd_t, sshd_exec_t)
 
 ifdef(`distro_debian',`
+	allow sshd_t sshd_var_run_t:dir { getattr search };
 	init_daemon_run_dir(sshd_var_run_t, "sshd")
 ')
Signature · 1 line
1.8.5.3
author
#1 lore raw

PATCH 2/2 Add fcontext for rsyslog pidfile

From: Laurent Bigonville <[email protected]>

---
 policy/modules/system/logging.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/system/logging.fc +1 -0
index b50c5fe..740897d 100644
@@ -65,6 +65,7 @@ ifdef(`distro_redhat',`
 /var/run/syslogd\.pid	--	gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
 /var/run/syslog-ng.ctl	--	gen_context(system_u:object_r:syslogd_var_run_t,s0)
 /var/run/syslog-ng(/.*)?	gen_context(system_u:object_r:syslogd_var_run_t,s0)
+/var/run/rsyslogd\.pid	--	gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
 
 /var/spool/audit(/.*)?		gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
 /var/spool/bacula/log(/.*)? 	gen_context(system_u:object_r:var_log_t,s0)
Signature · 1 line
1.8.5.3
#2 lore raw

PATCH 2/2 Add fcontext for rsyslog pidfile

Quoted 11 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 policy/modules/system/logging.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/system/logging.fc +0 -0
index b50c5fe..740897d 100644

policy/modules/system/logging.fc ifdef(`distro_redhat',` · line 71

Quoted 7 lines
policy/modules/system/logging.fc +1 -0
@@ -65,6 +65,7 @@ ifdef(`distro_redhat',`
 /var/run/syslogd\.pid	--	gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
 /var/run/syslog-ng.ctl	--	gen_context(system_u:object_r:syslogd_var_run_t,s0)
 /var/run/syslog-ng(/.*)?	gen_context(system_u:object_r:syslogd_var_run_t,s0)
+/var/run/rsyslogd\.pid	--	gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
 
 /var/spool/audit(/.*)?		gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
 /var/spool/bacula/log(/.*)? 	gen_context(system_u:object_r:var_log_t,s0)

This should be added between the metalog.pid and syslogd.pid lines.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#3 lore raw

PATCH 1/2 Add fcontext for sshd pidfile and directory used for privsep

In reply to Laurent Bigonville

policy/modules/services/ssh.te ssh_server_template(sshd) · line 39

Quoted 11 lines · Laurent Bigonville
policy/modules/services/ssh.te +1 -0
index 30726f2..a19c9f9 100644
@@ -34,6 +34,7 @@ ssh_server_template(sshd)
 init_daemon_domain(sshd_t, sshd_exec_t)
 
 ifdef(`distro_debian',`
+	allow sshd_t sshd_var_run_t:dir { getattr search };
 	init_daemon_run_dir(sshd_var_run_t, "sshd")
 ')

This looks like it should be in ssh_server_template(). Also please use search_dir_perms permission set.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#4 lore raw

PATCH 1/2 Add fcontext for sshd pidfile and directory used for privsep

Le Mon, 27 Jan 2014 13:23:02 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :

Quoted 8 lines · Laurent Bigonville
Quoted 7 lines
(quoted diff) +0 -0

b/policy/modules/services/ssh.te index 30726f2..a19c9f9 100644

policy/modules/services/ssh.te +0 -0
@@ -34,6 +34,7 @@ ssh_server_template(sshd)
 init_daemon_domain(sshd_t, sshd_exec_t)
Quoted 8 lines

policy/modules/services/ssh.te ssh_server_template(sshd) · line 39

Quoted 4 lines
policy/modules/services/ssh.te +1 -0
 ifdef(`distro_debian',`
+	allow sshd_t sshd_var_run_t:dir { getattr search };
 	init_daemon_run_dir(sshd_var_run_t, "sshd")
 ')

This looks like it should be in ssh_server_template(). Also please use search_dir_perms permission set.

Shouldn't the complete ifdef moved to this then?

#5 lore raw

PATCH 1/2 Add fcontext for sshd pidfile and directory used for privsep

Quoted 20 lines · Laurent Bigonville

Le Mon, 27 Jan 2014 13:23:02 -0500,
"Christopher J. PeBenito" <[email protected]> a ?crit :

Quoted 8 lines · Laurent Bigonville
Quoted 7 lines
(quoted diff) +0 -0

b/policy/modules/services/ssh.te index 30726f2..a19c9f9 100644

policy/modules/services/ssh.te +0 -0
@@ -34,6 +34,7 @@ ssh_server_template(sshd)
 init_daemon_domain(sshd_t, sshd_exec_t)
Quoted 8 lines

policy/modules/services/ssh.te ssh_server_template(sshd) · line 39

Quoted 4 lines
policy/modules/services/ssh.te +1 -0
 ifdef(`distro_debian',`
+	allow sshd_t sshd_var_run_t:dir { getattr search };
 	init_daemon_run_dir(sshd_var_run_t, "sshd")
 ')

This looks like it should be in ssh_server_template(). Also please use search_dir_perms permission set.

Quoted 1 line

Shouldn't the complete ifdef moved to this then?

The init_daemon_run_dir() pairs up with the sshd_var_run_t declaration inside the ssh_server_template(), so no. However, it should probably move to the end of the declarations block.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com