[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/

["Kenton Groombridge" <concord@gentoo.org>]

commit:     b2ceb53d4b7b1df545f740ae9b4ed2e77f640dca
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May  6 19:53:46 2024 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue May 14 17:41:31 2024 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b2ceb53d

init: allow systemd to use sshd pidfds

Without this, a lengthy 2 minute delay can be observed SSHing into a
system while pam_systemd tries to create a login session.

May 06 14:22:08 megumin.fuwafuwatime.moe sshd[29384]: pam_systemd(sshd:session): Failed to create session: Connection timed out

type=AVC msg=audit(1715019897.540:13855): avc:  denied  { use } for  pid=1 comm="systemd" path="anon_inode:[pidfd]" dev="anon_inodefs" ino=10 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:sshd_t:s0 tclass=fd permissive=1

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/services/ssh.if | 19 +++++++++++++++++++
 policy/modules/system/init.te  |  4 ++++
 2 files changed, 23 insertions(+)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index dcbabf6b0..4b5fd5d33 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -535,6 +535,25 @@ interface(`ssh_signull',`
 	allow $1 sshd_t:process signull;
 ')
 
+########################################
+## <summary>
+##	Use PIDFD file descriptors from the
+##	ssh server.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_use_sshd_pidfds',`
+	gen_require(`
+		type sshd_t;
+	')
+
+	allow $1 sshd_t:fd use;
+')
+
 ########################################
 ## <summary>
 ##	Read a ssh server unnamed pipe.

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 8f3772dcb..03d0de8ed 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -630,6 +630,10 @@ ifdef(`init_systemd',`
 		fs_rw_rpc_named_pipes(initrc_t)
 	')
 
+	optional_policy(`
+		ssh_use_sshd_pidfds(init_t)
+	')
+
 	optional_policy(`
 		# for systemd --user:
 		unconfined_search_keys(init_t)