From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Tue, 5 Jan 2016 13:38:42 -0500
Subject: [refpolicy] [PATCH 2/3] Label OpenSSH files correctly on Arch
 Linux
In-Reply-To: <1450625330-21892-2-git-send-email-nicolas.iooss@m4x.org>
References: <1450625330-21892-1-git-send-email-nicolas.iooss@m4x.org>
	<1450625330-21892-2-git-send-email-nicolas.iooss@m4x.org>
Message-ID: <568C0DB2.8040607@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 12/20/2015 10:28 AM, Nicolas Iooss wrote:
> On Arch Linux, OpenSSH installs these binary files in /usr/lib/ssh:
> 
> * sftp-server (labeled with ssh_keysign_exec_t type in refpolicy)
> * ssh-askpass (symlink to x11-ssh-askpass)
> * ssh-keysign
> * ssh-pkcs11-helper
> * x11-ssh-askpass (from x11-ssh-askpass package)
> 
> Label all these files but sftp-server as bin_t.
> ---
>  policy/modules/kernel/corecommands.fc | 1 +
>  policy/modules/services/ssh.fc        | 3 ++-
>  2 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
> index 77d6a180285a..fed2613768ba 100644
> --- a/policy/modules/kernel/corecommands.fc
> +++ b/policy/modules/kernel/corecommands.fc
> @@ -234,6 +234,7 @@ ifdef(`distro_gentoo',`
>  /usr/lib/rpm/rpmq		-- 	gen_context(system_u:object_r:bin_t,s0)
>  /usr/lib/rpm/rpmv		-- 	gen_context(system_u:object_r:bin_t,s0)
>  /usr/lib/sftp-server		--	gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/ssh(/.*)?			gen_context(system_u:object_r:bin_t,s0)
>  /usr/lib/sudo/sesh		--	gen_context(system_u:object_r:shell_exec_t,s0)
>  /usr/lib/systemd/system-generators(/.*)? gen_context(system_u:object_r:bin_t,s0)
>  /usr/lib/systemd/user-generators(/.*)?	gen_context(system_u:object_r:bin_t,s0)
> diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
> index 8168244583d0..fd6c2184a0c1 100644
> --- a/policy/modules/services/ssh.fc
> +++ b/policy/modules/services/ssh.fc
> @@ -7,7 +7,8 @@ HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
>  /usr/bin/ssh-agent		--	gen_context(system_u:object_r:ssh_agent_exec_t,s0)
>  /usr/bin/ssh-keygen		--	gen_context(system_u:object_r:ssh_keygen_exec_t,s0)
>  
> -/usr/lib/openssh/ssh-keysign	 --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
> +/usr/lib/openssh/ssh-keysign	--	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
> +/usr/lib/ssh/ssh-keysign	--	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
>  
>  /usr/libexec/openssh/ssh-keysign --	gen_context(system_u:object_r:ssh_keysign_exec_t,s0)

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com