#

# Macros for ssh agent

#

#

# Author:  Thomas Bleher <ThomasBleher@gmx.de>

#

# 

# ssh_agent_domain(domain_prefix)

#

# The type declaration for the executable type for this program is

# provided separately in domains/program/ssh-agent.te. 

#

define(`ssh_agent_domain',`

# Define a derived domain for the ssh-agent program when executed

# by a user domain.

# Derived domain based on the calling user domain and the program.

type $1_ssh_agent_t, domain, privlog;

# Transition from the user domain to the derived domain.

domain_auto_trans($1_t, ssh_agent_exec_t, $1_ssh_agent_t)

# The user role is authorized for this domain.

role $1_r types $1_ssh_agent_t;

allow $1_ssh_agent_t privfd:fd use;

# Write to the user domain tty.

access_terminal($1_ssh_agent_t, $1)

# Allow the user shell to signal the ssh program.

allow $1_t $1_ssh_agent_t:process signal;

# allow ps to show ssh

can_ps($1_t, $1_ssh_agent_t)

can_ypbind($1_ssh_agent_t)

if (use_nfs_home_dirs) {

allow $1_ssh_agent_t autofs_t:dir { search getattr };

rw_dir_create_file($1_ssh_agent_t, nfs_t)

}

if (use_samba_home_dirs) {

rw_dir_create_file($1_ssh_agent_t, cifs_t)

}

uses_shlib($1_ssh_agent_t)

read_locale($1_ssh_agent_t)

allow $1_ssh_agent_t proc_t:dir search;

dontaudit $1_ssh_agent_t proc_t:{ lnk_file file } { getattr read };

dontaudit $1_ssh_agent_t selinux_config_t:dir search;

dontaudit $1_ssh_agent_t selinux_config_t:file { read getattr };

read_sysctl($1_ssh_agent_t)

# Access the ssh temporary files. Should we have an own type here

# to which only ssh, ssh-agent and ssh-add have access?

allow $1_ssh_agent_t $1_tmp_t:dir r_dir_perms;

file_type_auto_trans($1_ssh_agent_t, tmp_t, $1_tmp_t)

allow $1_ssh_agent_t self:unix_stream_socket create_stream_socket_perms;

allow $1_ssh_agent_t self:unix_dgram_socket create_socket_perms;

allow $1_ssh_agent_t self:process { fork sigchld setrlimit };

allow $1_ssh_agent_t self:capability setgid;

# access the random devices

allow $1_ssh_agent_t { random_device_t urandom_device_t }:chr_file { getattr read };

# for ssh-add

can_unix_connect($1_t, $1_ssh_agent_t)

# transition back to normal privs upon exec

domain_auto_trans($1_ssh_agent_t, { bin_t shell_exec_t $1_home_t }, $1_t)

if (use_nfs_home_dirs) {

domain_auto_trans($1_ssh_agent_t, nfs_t, $1_t)

}

if (use_samba_home_dirs) {

domain_auto_trans($1_ssh_agent_t, cifs_t, $1_t)

}

allow $1_ssh_agent_t bin_t:dir search;

# allow reading of /usr/bin/X11 (is a symlink)

allow $1_ssh_agent_t bin_t:lnk_file read;

allow $1_ssh_agent_t { $1_ssh_agent_t $1_t }:process signull;

allow $1_ssh_agent_t { home_root_t $1_home_dir_t }:dir search;

allow $1_ssh_t $1_tmp_t:sock_file write;

allow $1_ssh_t $1_t:unix_stream_socket connectto;

allow $1_ssh_t $1_ssh_agent_t:unix_stream_socket connectto;

ifdef(`xdm.te', `

can_pipe_xdm($1_ssh_agent_t)

# kdm: sigchld

allow $1_ssh_agent_t xdm_t:process sigchld;

')

#

# Allow command to ssh-agent > ~/.ssh_agent

#

allow $1_ssh_agent_t $1_home_t:file rw_file_perms;

allow $1_ssh_agent_t $1_tmp_t:file rw_file_perms;

allow $1_ssh_agent_t etc_runtime_t:file { getattr read };

allow $1_ssh_agent_t etc_t:file { getattr read };

allow $1_ssh_agent_t lib_t:file { getattr read };

allow $1_ssh_agent_t self:dir search;

allow $1_ssh_agent_t self:file { getattr read };

# Allow the ssh program to communicate with ssh-agent.

allow $1_ssh_t $1_tmp_t:sock_file write;

allow $1_ssh_t $1_t:unix_stream_socket connectto;

allow $1_ssh_t sshd_t:unix_stream_socket connectto;

')dnl end if ssh_agent