From: "Jason Zaman" <perfinion@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/
Date: Sat, 30 Jan 2016 17:21:17 +0000 (UTC) [thread overview]
Message-ID: <1454174216.8796183777154929efc6b058e462cc7037eb0817.perfinion@gentoo> (raw)
commit: 8796183777154929efc6b058e462cc7037eb0817
Author: Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org>
AuthorDate: Sun Dec 20 15:28:50 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Jan 30 17:16:56 2016 +0000
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=87961837
Label OpenSSH systemd unit files
On Arch Linux, OpenSSH unit files are:
/usr/lib/systemd/system/sshdgenkeys.service
/usr/lib/systemd/system/sshd.service
/usr/lib/systemd/system/sshd@.service
/usr/lib/systemd/system/sshd.socket
On Debian jessie, the unit files are:
/lib/systemd/system/ssh.service
/lib/systemd/system/ssh@.service
/lib/systemd/system/ssh.socket
On Fedora 22, the unit files are:
/usr/lib/systemd/system/sshd-keygen.service
/usr/lib/systemd/system/sshd.service
/usr/lib/systemd/system/sshd@.service
/usr/lib/systemd/system/sshd.socket
Use a pattern which matches every sshd unit and introduce an other type
for ssh-keygen units.
policy/modules/services/ssh.fc | 4 ++++
policy/modules/services/ssh.te | 6 ++++++
2 files changed, 10 insertions(+)
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
index fd6c218..027c8a8 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -10,6 +10,10 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
/usr/lib/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
/usr/lib/ssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
+/usr/lib/systemd/system/ssh.* -- gen_context(system_u:object_r:sshd_unit_t,s0)
+/usr/lib/systemd/system/sshdgenkeys.* -- gen_context(system_u:object_r:sshd_keygen_unit_t,s0)
+/usr/lib/systemd/system/sshd-keygen.* -- gen_context(system_u:object_r:sshd_keygen_unit_t,s0)
+
/usr/libexec/openssh/ssh-keysign -- gen_context(system_u:object_r:ssh_keysign_exec_t,s0)
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index d83662a..917187a 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -47,6 +47,12 @@ type sshd_tmp_t;
files_tmp_file(sshd_tmp_t)
files_poly_parent(sshd_tmp_t)
+type sshd_keygen_unit_t;
+init_unit_file(sshd_keygen_unit_t)
+
+type sshd_unit_t;
+init_unit_file(sshd_unit_t)
+
ifdef(`enable_mcs',`
init_ranged_daemon_domain(sshd_t, sshd_exec_t, s0 - mcs_systemhigh)
')
next reply other threads:[~2016-01-30 17:21 UTC|newest]
Thread overview: 289+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-30 17:21 Jason Zaman [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-05-14 19:42 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/ Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2023-10-20 22:05 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-03-31 23:07 Kenton Groombridge
2023-03-31 23:07 Kenton Groombridge
2023-03-31 23:07 Kenton Groombridge
2023-03-31 23:07 Kenton Groombridge
2023-02-13 15:35 Kenton Groombridge
2023-02-13 15:35 Kenton Groombridge
2023-02-13 15:35 Kenton Groombridge
2023-02-13 15:35 Kenton Groombridge
2023-02-13 15:35 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-12-13 20:55 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-09-03 20:04 Kenton Groombridge
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:54 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-09-03 19:10 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-04-09 19:28 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-07 2:14 Jason Zaman
2022-02-07 2:14 Jason Zaman
2022-02-07 2:14 Jason Zaman
2022-01-31 19:31 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2022-01-30 1:22 Jason Zaman
2021-11-21 23:02 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-03-22 0:21 Jason Zaman
2021-03-21 22:10 Jason Zaman
2021-03-21 22:10 Jason Zaman
2021-03-21 22:10 Jason Zaman
2021-03-21 22:10 Jason Zaman
2021-02-07 3:21 Jason Zaman
2021-02-07 3:21 Jason Zaman
2021-02-07 3:21 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2021-02-01 2:10 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-11-28 23:09 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-10-13 3:02 Jason Zaman
2020-02-15 7:33 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-07-13 7:01 Jason Zaman
2019-07-13 7:01 Jason Zaman
2019-07-13 7:01 Jason Zaman
2019-03-26 10:17 Jason Zaman
2019-03-26 10:17 Jason Zaman
2019-03-26 10:17 Jason Zaman
2019-03-26 10:17 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-02-10 4:14 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-07-12 14:37 Jason Zaman
2018-06-25 5:33 Jason Zaman
2018-06-24 8:46 Jason Zaman
2017-12-14 5:15 Jason Zaman
2017-12-12 7:59 Jason Zaman
2017-12-12 7:59 Jason Zaman
2017-12-12 7:59 Jason Zaman
2017-11-17 14:59 Jason Zaman
2017-10-29 20:42 Jason Zaman
2017-02-05 6:29 Jason Zaman
2017-01-26 3:32 Jason Zaman
2017-01-13 18:43 Sven Vermeulen
2017-01-13 18:43 Sven Vermeulen
2017-01-01 16:37 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2017-01-01 16:36 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2017-01-01 16:36 Jason Zaman
2017-01-01 16:36 Jason Zaman
2016-12-06 14:24 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2016-12-06 13:39 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2016-12-06 13:39 Jason Zaman
2016-12-06 13:39 Jason Zaman
2016-12-06 13:39 Jason Zaman
2016-12-06 13:39 Jason Zaman
2016-08-17 16:59 Jason Zaman
2016-01-30 17:21 Jason Zaman
2016-01-30 17:21 Jason Zaman
2016-01-30 17:21 Jason Zaman
2015-10-10 16:11 Jason Zaman
2015-08-02 19:26 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2015-08-02 19:23 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2015-08-02 19:26 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2015-08-02 19:23 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2015-05-27 20:00 Jason Zaman
2015-03-04 17:03 [gentoo-commits] proj/hardened-refpolicy:next " Sven Vermeulen
2015-03-04 16:45 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2014-08-21 17:31 Sven Vermeulen
2014-08-21 17:31 Sven Vermeulen
2014-08-21 17:31 Sven Vermeulen
2014-08-13 20:02 Sven Vermeulen
2014-08-13 20:02 Sven Vermeulen
2014-06-10 18:17 Sven Vermeulen
2014-06-10 18:17 Sven Vermeulen
2014-04-18 20:06 Sven Vermeulen
2014-04-17 19:04 Sven Vermeulen
2014-04-17 19:04 Sven Vermeulen
2014-03-25 20:41 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-02-09 10:54 Sven Vermeulen
2014-01-19 19:01 Sven Vermeulen
2014-01-19 19:01 Sven Vermeulen
2013-12-09 14:37 Sven Vermeulen
2013-12-06 17:33 Sven Vermeulen
2013-09-27 13:27 Sven Vermeulen
2013-09-27 13:27 Sven Vermeulen
2013-09-27 13:27 Sven Vermeulen
2013-09-27 13:27 Sven Vermeulen
2013-09-24 17:10 Sven Vermeulen
2013-09-24 17:10 Sven Vermeulen
2013-07-23 12:02 Sven Vermeulen
2013-01-03 16:49 Sven Vermeulen
2012-12-07 15:36 Sven Vermeulen
2012-12-07 15:36 Sven Vermeulen
2012-12-07 15:36 Sven Vermeulen
2012-11-27 19:14 Sven Vermeulen
2012-11-27 19:14 Sven Vermeulen
2012-11-25 21:39 Sven Vermeulen
2012-10-19 15:06 Sven Vermeulen
2012-10-19 15:06 Sven Vermeulen
2012-10-19 15:06 Sven Vermeulen
2012-10-19 15:06 Sven Vermeulen
2012-10-10 19:52 Sven Vermeulen
2012-08-21 17:52 Sven Vermeulen
2012-08-21 17:52 Sven Vermeulen
2012-05-28 12:39 Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1454174216.8796183777154929efc6b058e462cc7037eb0817.perfinion@gentoo \
--to=perfinion@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox