From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=cIXj=UR=vger.kernel.org=selinux-refpolicy-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-8.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham
	autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 84FB7C31E51
	for <selinux-refpolicy@archiver.kernel.org>; Tue, 18 Jun 2019 12:29:58 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.kernel.org (Postfix) with ESMTP id 22D152082C
	for <selinux-refpolicy@archiver.kernel.org>; Tue, 18 Jun 2019 12:29:58 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=millerson.name header.i=@millerson.name header.b="iSjp7lnn"
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1725919AbfFRM35 (ORCPT
        <rfc822;selinux-refpolicy@archiver.kernel.org>);
        Tue, 18 Jun 2019 08:29:57 -0400
Received: from host89-222-249-147.netorn.net ([89.222.249.147]:41478 "EHLO
        mail.millerson.name" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org
        with ESMTP id S1725913AbfFRM35 (ORCPT
        <rfc822;selinux-refpolicy@vger.kernel.org>);
        Tue, 18 Jun 2019 08:29:57 -0400
X-Greylist: delayed 1263 seconds by postgrey-1.27 at vger.kernel.org; Tue, 18 Jun 2019 08:29:57 EDT
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
        d=millerson.name; s=mail; h=MIME-Version:Message-Id:Date:Subject:To:From:
        user-agent:in-reply-to; bh=8VyZSCrLEqG8TRyJGRZqr95lhQkOpHMMLnKBrRLfeZ8=; b=iS
        jp7lnn6WMLXDNkvl/KFjnWZq2YOmQeYAPp+/en6Jh5+CAo8IbQq4uyiNOZ6ZZWXqEHzLpr4oE+Wl0
        OHYt4yyuB95u1nTUt9XoWFggWhNFgqsBXFy2UEftg5m6XlVVMMB5A8Bi8WahkjC7wUNviMKaG7L79
        /tdF4yA6bSqiks0=;
Received: from localhost ([127.0.0.1] helo=mail.millerson.name)
        by mail.millerson.name with esmtpsa id 1hdCuz-0003xJ-A8
        (envelope-from <alex@millerson.name>); Tue, 18 Jun 2019 15:08:53 +0300
Received: from alex-desktop.home ([2a04:4a00:5:1014::1072])
        by mail.millerson.name with ESMTPSA
        id 9jEYL1TUCF1nOwAAXPwaFA
        (envelope-from <alex@millerson.name>); Tue, 18 Jun 2019 15:08:52 +0300
From:   Alexander Miroshnichenko <alex@millerson.name>
To:     selinux-refpolicy@vger.kernel.org
Cc:     Alexander Miroshnichenko <alex@millerson.name>
Subject: [PATCH] Add interface ssh_search_dir
Date:   Tue, 18 Jun 2019 15:08:15 +0300
Message-Id: <20190618120814.17182-1-alex@millerson.name>
X-Mailer: git-send-email 2.21.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-GIT-Signature: 79d865a1b3eb853a0dcbe8bc8fe5602b
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

Create interface ssh_search_dir to allow ssh_server search for keys in non-standard location.

Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
---
 policy/modules/services/ssh.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index b5bd2762ef96..7eb1cee2ef76 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -680,6 +680,24 @@ interface(`ssh_agent_exec',`
 	can_exec($1, ssh_agent_exec_t)
 ')
 
+########################################
+## <summary>
+##      Search for keys in non-standard location
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ssh_search_dir',`
+        gen_require(`
+                type sshd_t;
+        ')
+
+        search_dirs_pattern(sshd_t, $1, $2)
+')
+
 ########################################
 ## <summary>
 ##	Read ssh home directory content
-- 
2.21.0