Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sun, 1 Sep 2019 13:36:34 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Nicolas Iooss <nicolas.iooss@m4x.org>
Cc:     Chris PeBenito <pebenito@ieee.org>,
        selinux-refpolicy@vger.kernel.org
Subject: Re: [RFC] ssh: remove unconfined_shell_domtrans(sshd_t)
Message-ID: <20190901113634.GA152026@brutus.lan>
Mail-Followup-To: Nicolas Iooss <nicolas.iooss@m4x.org>,
        Chris PeBenito <pebenito@ieee.org>,
        selinux-refpolicy@vger.kernel.org
References: <20190831172713.140005-1-dac.override@gmail.com>
 <21a95013-0147-63fa-77ab-471ef24b0eb8@ieee.org>
 <CAJfZ7=nT+Q+Oy10T4ooPioOMuk=-57G6-2o1Wa5PeokOxaZ8vA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="qDbXVdCdHGoSgWSk"
Content-Disposition: inline
In-Reply-To: <CAJfZ7=nT+Q+Oy10T4ooPioOMuk=-57G6-2o1Wa5PeokOxaZ8vA@mail.gmail.com>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--qDbXVdCdHGoSgWSk
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 01, 2019 at 01:19:56PM +0200, Nicolas Iooss wrote:
> On Sat, Aug 31, 2019 at 10:54 PM Chris PeBenito <pebenito@ieee.org> wrote:
> >
> > On 8/31/19 1:27 PM, Dominick Grift wrote:
> > > This call allows sshd_t associated processes with run shell with an a=
utomatic domain transition to unconfined_t.
> > > I was unable to make sense of the commit that added this:
> > >
> > > https://github.com/SELinuxProject/refpolicy/commit/708aab13932bb8830a=
2d37850cc0a5c72a5d4df4
> > >
> > > Debian's motd dynamic pam module makes sshd run a shell, we want this=
 shell to run with sshd_t instead of unconfined_t
> > >
> > > This patch will make the ssh_sysadm_login boolean apply to unconfined=
 ssh logins.
> > > To me this makes sense, as unconfined_t is targeted equivalent to the=
 strict sysadm_t.
> > > The boolean could however be renamed to the more generic ssh_priv_log=
in name.
> > >
> > > Signed-off-by: Dominick Grift <dac.override@gmail.com>
> > > ---
> > >   policy/modules/services/ssh.te | 4 ----
> > >   1 file changed, 4 deletions(-)
> > >
> > > diff --git a/policy/modules/services/ssh.te b/policy/modules/services=
/ssh.te
> > > index 4e75b6e1..a99ad912 100644
> > > --- a/policy/modules/services/ssh.te
> > > +++ b/policy/modules/services/ssh.te
> > > @@ -328,10 +328,6 @@ optional_policy(`
> > >       systemd_dbus_chat_logind(sshd_t)
> > >   ')
> > >
> > > -optional_policy(`
> > > -     unconfined_shell_domtrans(sshd_t)
> > > -')
> > > -
> > >   optional_policy(`
> > >       xserver_domtrans_xauth(sshd_t)
> > >       xserver_link_xdm_keys(sshd_t)
> >
> > I don't have any objections to this.
>=20
> Would it be possible to extend this patch to other callers of
> unconfined_shell_domtrans, like the patch below? It will help fix
> issues with Debian's PAM module that generates the MOTD (Message Of
> The Day) in a dynamic way, using shell commands (cf.
> https://wiki.debian.org/motd for more information: calling system()
> triggers a transition to system_u:system_r:unconfined_t because of
> unconfined_shell_domtrans).

Not sure about remotelogin and rshd (are people still using this?), but I d=
o believe one should be able to remove it from local_login_t.

>=20
> diff --git a/policy/modules/services/remotelogin.te
> b/policy/modules/services/remotelogin.te
> index bc2292e37892..c7c9c5646785 100644
> --- a/policy/modules/services/remotelogin.te
> +++ b/policy/modules/services/remotelogin.te
> @@ -91,10 +91,6 @@ optional_policy(`
>   telnet_use_ptys(remote_login_t)
>  ')
>=20
> -optional_policy(`
> - unconfined_shell_domtrans(remote_login_t)
> -')
> -
>  optional_policy(`
>   usermanage_read_crack_db(remote_login_t)
>  ')
> diff --git a/policy/modules/services/rshd.te b/policy/modules/services/rs=
hd.te
> index 0f4caffc4f33..196ed2848e4b 100644
> --- a/policy/modules/services/rshd.te
> +++ b/policy/modules/services/rshd.te
> @@ -74,6 +74,5 @@ optional_policy(`
>  ')
>=20
>  optional_policy(`
> - unconfined_shell_domtrans(rshd_t)
>   unconfined_signal(rshd_t)
>  ')
> diff --git a/policy/modules/system/locallogin.te
> b/policy/modules/system/locallogin.te
> index a56f3d1fbe16..632d2542972d 100644
> --- a/policy/modules/system/locallogin.te
> +++ b/policy/modules/system/locallogin.te
> @@ -200,10 +200,6 @@ optional_policy(`
>   systemd_write_inherited_logind_sessions_pipes(local_login_t)
>  ')
>=20
> -optional_policy(`
> - unconfined_shell_domtrans(local_login_t)
> -')
> -
>  optional_policy(`
>   usermanage_read_crack_db(local_login_t)
>  ')
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--qDbXVdCdHGoSgWSk
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl1rrT4ACgkQJXSOVTf5
R2lNxAv9EWjf7buIe9hm6VQS+1Kg2YN/QPIMX8B5t3iHQE6x3xwnDqYZQ434BBj8
O+1DCAc9sEMjPE7W2gMwdD8+LDdlPaHlDMGeIQUF7NMFE+4xkQRFA9ZM7fQZv0P0
rXFu5rlX0gJhDFeT4S2ygpfVZLXB41H3kMi8RqD3Ht8K0XJam/CkZNjcLNfYfr46
TVxO7EMD1yCJms2ll50H09HR1XchkfFb2MqgGEKP5aMnr9tkKVVK8urfFTbqKy6T
H0pOaRNwwEICncgRLNg685KZ7Y3FkXupyUYedmCvDZ26zy/FVtMCNTMhZIHCFHfz
GV6cxucCTnYvcvIbs5HIlkpgdS73YihM0vduNFlrxWJHe+EvnDFIPIq3rrSsyc2Y
DYp1ZNwiaKlCQIWl2i0JCeH8LxZiSsF9+oXCgsyEpU3HxiPWnYKI02xXP7xTtjAn
ii9eArnDAw8NjFLggainUmCuFB4JEfh+rUX1Wf3FPon+jDXj09Et2CCZbf6dok8j
engH1CbW
=YgCy
-----END PGP SIGNATURE-----

--qDbXVdCdHGoSgWSk--