From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <SRS0=+6c8=UT=vger.kernel.org=selinux-refpolicy-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
X-Spam-Level: 
X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT
	autolearn=ham autolearn_force=no version=3.4.0
Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
	by smtp.lore.kernel.org (Postfix) with ESMTP id D6D11C43613
	for <selinux-refpolicy@archiver.kernel.org>; Thu, 20 Jun 2019 14:43:02 +0000 (UTC)
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by mail.kernel.org (Postfix) with ESMTP id A2E8E2083B
	for <selinux-refpolicy@archiver.kernel.org>; Thu, 20 Jun 2019 14:43:02 +0000 (UTC)
Authentication-Results: mail.kernel.org;
	dkim=pass (1024-bit key) header.d=millerson.name header.i=@millerson.name header.b="jskiM5UV"
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1731560AbfFTOnC (ORCPT
        <rfc822;selinux-refpolicy@archiver.kernel.org>);
        Thu, 20 Jun 2019 10:43:02 -0400
Received: from host89-222-249-147.netorn.net ([89.222.249.147]:48118 "EHLO
        mail.millerson.name" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org
        with ESMTP id S1726428AbfFTOnC (ORCPT
        <rfc822;selinux-refpolicy@vger.kernel.org>);
        Thu, 20 Jun 2019 10:43:02 -0400
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
        d=millerson.name; s=mail; h=MIME-Version:In-Reply-To:Message-Id:Date:Subject:
        To:From:user-agent; bh=776Pl2rIgQQ8UwAlWeQ3J7FUWgXrSkmKwy8A72+80aI=; b=jskiM5
        UVB720WhkvYkexMcxK1er6vgzIr4qyrNviC8va4Vp9m00A7sOrudtNapuXn2EPhhKZEvtD4TgLxD+
        AQPGTGDkn2BMJGlfDKqVrXyJWZrbIRfFpXs9RI0kGidwcGMhr5/7A8hvKjy//M5yzZCY7Ij++3Ln7
        R1fI7ZXK7qs=;
Received: from localhost ([127.0.0.1] helo=mail.millerson.name)
        by mail.millerson.name with esmtpsa id 1hdyHE-00067L-KH
        (envelope-from <alex@millerson.name>); Thu, 20 Jun 2019 17:43:00 +0300
Received: from alex-office-laptop.msad.rbkmoney.com ([2a04:4a00:5:966:a55:5884:e3f8:8906])
        by mail.millerson.name with ESMTPSA
        id COWFBXSbC13cWwAAXPwaFA
        (envelope-from <alex@millerson.name>); Thu, 20 Jun 2019 17:43:00 +0300
From:   Alexander Miroshnichenko <alex@millerson.name>
To:     selinux-refpolicy@vger.kernel.org
Cc:     Alexander Miroshnichenko <alex@millerson.name>
Subject: [PATCH v2 2/2] ssh: Add interface ssh_search_dir
Date:   Thu, 20 Jun 2019 17:41:38 +0300
Message-Id: <20190620144138.15172-3-alex@millerson.name>
X-Mailer: git-send-email 2.21.0
In-Reply-To: <20190620144138.15172-1-alex@millerson.name>
References: <20190620144138.15172-1-alex@millerson.name>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-GIT-Signature: 79d865a1b3eb853a0dcbe8bc8fe5602b
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

Create interface ssh_search_dir to allow ssh_server search for keys in non-standard location.

Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
---
 policy/modules/services/ssh.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 0941f133711e..51c64ded00c4 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -680,6 +680,24 @@ interface(`ssh_agent_exec',`
 	can_exec($1, ssh_agent_exec_t)
 ')
 
+########################################
+## <summary>
+##      Search for keys in non-standard location
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`ssh_search_dir',`
+        gen_require(`
+                type sshd_t;
+        ')
+
+	allow sshd_t $1:dir search_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Read ssh home directory content
-- 
2.21.0