2015-07-19 17:48:28

by Mira Ressel

Subject: [refpolicy] [PATCH] Allow ssh-agent to send signals to itself

This is neccessary for "ssh-agent -k".
---
policy/modules/services/ssh.if | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index cbd0cdd..3fda887 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -346,7 +346,7 @@ template(`ssh_role_template',`
# SSH agent local policy
#

- allow $1_ssh_agent_t self:process setrlimit;
+ allow $1_ssh_agent_t self:process { setrlimit signal };
allow $1_ssh_agent_t self:capability setgid;

allow $1_ssh_agent_t { $1_ssh_agent_t $3 }:process signull;
--
2.4.5

2015-07-20 16:12:29

by cpebenito

Subject: [refpolicy] [PATCH] Allow ssh-agent to send signals to itself

On 7/19/2015 1:48 PM, Luis Ressel wrote:
> This is neccessary for "ssh-agent -k".
> ---
> policy/modules/services/ssh.if | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
> index cbd0cdd..3fda887 100644
> --- a/policy/modules/services/ssh.if
> +++ b/policy/modules/services/ssh.if
> @@ -346,7 +346,7 @@ template(`ssh_role_template',`
> # SSH agent local policy
> #
>
> - allow $1_ssh_agent_t self:process setrlimit;
> + allow $1_ssh_agent_t self:process { setrlimit signal };
> allow $1_ssh_agent_t self:capability setgid;
>
> allow $1_ssh_agent_t { $1_ssh_agent_t $3 }:process signull;

Merged.

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com