Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Alexander Miroshnichenko <alex@millerson.name>
To:     selinux-refpolicy@vger.kernel.org
Cc:     Alexander Miroshnichenko <alex@millerson.name>
Subject: [PATCH v2 2/2] ssh: Add interface ssh_search_dir
Date:   Thu, 20 Jun 2019 17:41:38 +0300
Message-Id: <20190620144138.15172-3-alex@millerson.name>
In-Reply-To: <20190620144138.15172-1-alex@millerson.name>
References: <20190620144138.15172-1-alex@millerson.name>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Create interface ssh_search_dir to allow ssh_server search for keys in non-standard location.

Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
---
 policy/modules/services/ssh.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 0941f133711e..51c64ded00c4 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -680,6 +680,24 @@ interface(`ssh_agent_exec',`
 	can_exec($1, ssh_agent_exec_t)
 ')
 
+########################################
+## <summary>
+##      Search for keys in non-standard location
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ssh_search_dir',`
+        gen_require(`
+                type sshd_t;
+        ')
+
+	allow sshd_t $1:dir search_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Read ssh home directory content
-- 
2.21.0