From: nicolas.iooss@m4x.org (Nicolas Iooss) Date: Sun, 20 Dec 2015 16:28:49 +0100 Subject: [refpolicy] [PATCH 2/3] Label OpenSSH files correctly on Arch Linux In-Reply-To: <1450625330-21892-1-git-send-email-nicolas.iooss@m4x.org> References: <1450625330-21892-1-git-send-email-nicolas.iooss@m4x.org> Message-ID: <1450625330-21892-2-git-send-email-nicolas.iooss@m4x.org> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On Arch Linux, OpenSSH installs these binary files in /usr/lib/ssh: * sftp-server (labeled with ssh_keysign_exec_t type in refpolicy) * ssh-askpass (symlink to x11-ssh-askpass) * ssh-keysign * ssh-pkcs11-helper * x11-ssh-askpass (from x11-ssh-askpass package) Label all these files but sftp-server as bin_t. --- policy/modules/kernel/corecommands.fc | 1 + policy/modules/services/ssh.fc | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc index 77d6a180285a..fed2613768ba 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -234,6 +234,7 @@ ifdef(`distro_gentoo',` /usr/lib/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/sftp-server -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/ssh(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/sudo/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/lib/systemd/system-generators(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/systemd/user-generators(/.*)? gen_context(system_u:object_r:bin_t,s0) diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc index 8168244583d0..fd6c2184a0c1 100644 --- a/policy/modules/services/ssh.fc +++ b/policy/modules/services/ssh.fc @@ -7,7 +7,8 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) /usr/bin/ssh-agent -- gen_context(system_u:object_r:ssh_agent_exec_t,s0) /usr/bin/ssh-keygen -- gen_context(system_u:object_r:ssh_keygen_exec_t,s0) -/usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) +/usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) +/usr/lib/ssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) /usr/libexec/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0) -- 2.6.4