Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp2011485ybi; Thu, 20 Jun 2019 07:42:59 -0700 (PDT) X-Google-Smtp-Source: APXvYqxphUXeQq7okvvyM7TDAtINoCYiL9LKZIJMCEBzOd9E2rfe6/tUuUB9xBjp8lW1z8KnJ8Qt X-Received: by 2002:a17:90a:a116:: with SMTP id s22mr3444245pjp.47.1561041779613; Thu, 20 Jun 2019 07:42:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1561041779; cv=none; d=google.com; s=arc-20160816; b=if/IdG9ZukZfMLHCx6lVHJ8Rb9Zk5zbn/bAiPCnzPuTnZg++KR2DVubKdwekoGzJ4I tc9gTB1GTUo8KMq/ZgQ3pFF7KzhKCDqOcr/xRMoFCUBx8ukhgMZfc39T/lr1Pktf9jhG 5jU4VAzC/Hyrlaw1+1v74IGOa4RpbXmxf4Zn/APivekdJc6oU958JBSgsmdFA1/emT23 S5znkvLtiEfddP9EOrDOJKa2R98zvQbI0zm/xnBt5ejxtahU9Pz8zhagpmX4ztXR50rW 763JHJy2ddMH3JxwWRya0xbsbLjcwAw1x9lwuqSnUg2iE4gE0iOF0wl+VBg5j0eup6rU GsIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=xyPlsLPbf4Xi5QbzkQpWvarFRPE+K2OI0FcI1nmRhQk=; b=XZaiJh9UnxTd/TeBlURC/ZVa9E9MX6DM8yrynQ4ejR05KwUXshjVq/yKGBdERZwbxr Ga6a6hXsuio3mgEr5H56kJgyPE5E3eANao/+ZD+NO/v0RCXLBDn+zl63kR9Cqw6r1fbb lw5ChFugyBWMGqkR8Hcxn17FDyXgO6pvrOFJ1GFet/+fZZLIqSxlReEMoMaYD6gOS5J8 WS6+XiWJilmDr6fFEpF5tq23rHXd4/NOsL97XULhZvYlJhxGoXXr//EyJkWdnUsjPvJS YIKdOZlzzJk7CYuf+dIRn7xeJonswmHl5JzMjRkOtLR3ZKs/KRj+Cfl7zR2pVQtgAr3I //vQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@millerson.name header.s=mail header.b=qWkT5nY4; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=millerson.name Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id b25si6054082pgb.121.2019.06.20.07.42.56; Thu, 20 Jun 2019 07:42:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@millerson.name header.s=mail header.b=qWkT5nY4; spf=pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=selinux-refpolicy-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=millerson.name Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726796AbfFTOmz (ORCPT + 11 others); Thu, 20 Jun 2019 10:42:55 -0400 Received: from host89-222-249-147.netorn.net ([89.222.249.147]:48072 "EHLO mail.millerson.name" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1726428AbfFTOmz (ORCPT ); Thu, 20 Jun 2019 10:42:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=millerson.name; s=mail; h=MIME-Version:In-Reply-To:Message-Id:Date:Subject: To:From:user-agent; bh=xyPlsLPbf4Xi5QbzkQpWvarFRPE+K2OI0FcI1nmRhQk=; b=qWkT5n Y40GXLpDwmB769FPxL4UUIJnC3CX132dh+R9NpJYqfuBziAjwHfvDOh1ab9sqn+mHnTY/HutXAbpf aysP9QaMUS35E8tTiwqm/+VqC10rdLhwPQtkEK5zxWSqeIdW4LzeW/6Kslbc8wctA14KK/sLF+TZc fHFtm9DIug4=; Received: from localhost ([127.0.0.1] helo=mail.millerson.name) by mail.millerson.name with esmtpsa id 1hdyH7-00067L-C0 (envelope-from ); Thu, 20 Jun 2019 17:42:53 +0300 Received: from alex-office-laptop.msad.rbkmoney.com ([2a04:4a00:5:966:a55:5884:e3f8:8906]) by mail.millerson.name with ESMTPSA id +I38MWybC13cWwAAXPwaFA (envelope-from ); Thu, 20 Jun 2019 17:42:52 +0300 From: Alexander Miroshnichenko To: selinux-refpolicy@vger.kernel.org Cc: Alexander Miroshnichenko Subject: [PATCH v2 1/2] ssh: Add ssh_exec_keygen interface Date: Thu, 20 Jun 2019 17:41:37 +0300 Message-Id: <20190620144138.15172-2-alex@millerson.name> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190620144138.15172-1-alex@millerson.name> References: <20190620144138.15172-1-alex@millerson.name> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit X-GIT-Signature: 87d3ff1db9a643b7f0b1b55f4fb6bee2 X-Spam-Score: -3.1 (---) X-Spam-Status: No Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Signed-off-by: Alexander Miroshnichenko --- policy/modules/services/ssh.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if index b5bd2762ef96..0941f133711e 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if @@ -701,6 +701,25 @@ interface(`ssh_read_user_home_files',` userdom_search_user_home_dirs($1) ') +######################################## +## +## Execute the ssh key generator in the caller domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ssh_exec_keygen',` + gen_require(` + type ssh_keygen_exec_t; + ') + + corecmd_search_bin($1) + can_exec($1, ssh_keygen_exec_t) +') + ######################################## ## ## Execute the ssh key generator in the ssh keygen domain. -- 2.21.0