From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC8B3C43613 for ; Thu, 20 Jun 2019 14:46:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 91E3F2083B for ; Thu, 20 Jun 2019 14:46:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lAlbK60V" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726654AbfFTOqn (ORCPT ); Thu, 20 Jun 2019 10:46:43 -0400 Received: from mail-ed1-f65.google.com ([209.85.208.65]:43239 "EHLO mail-ed1-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726491AbfFTOqn (ORCPT ); Thu, 20 Jun 2019 10:46:43 -0400 Received: by mail-ed1-f65.google.com with SMTP id e3so5053213edr.10 for ; Thu, 20 Jun 2019 07:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=5Jbq9ACLIK1sr5IjVOJ9ey3xZBCuBWP6UOoVHjeklww=; b=lAlbK60VXrvY4bJ0ZDfHHMgEjBWIJN97c1E3lOC5mKh6M56adZUofMohojSMabbo8H MBpnTJVX239TyWCUAMgIpTu96Na4iizuvRPgete8MTKQSb29c+YpvhcjgpIelOWjL+ak cFzNLuYRmHEoK0rQIVUwxy4tq7R+Iq6Xzpnd/slb9dstHr32ZYee+gltWKhVxfrSKA/U d3JJ6OVsZJ7i47hjxs9SUvsCEeExY7Ah9t7A0MPCEblQkkBOsQYZCsMiTUaKOuSGLZq8 Gq+HTYZ4VbTZDPIiBB2fJBszV1M5iD9mjDkPlekt9znD215hho7qElCgIOoNlUUopOQF m3Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=5Jbq9ACLIK1sr5IjVOJ9ey3xZBCuBWP6UOoVHjeklww=; b=kFdf0/fCxOQC3oIjPIzWQ6shdaGAeZfSg+6XwAqwi4DuKOtRlIbK586vkA9RYmkbVR F/nM8KoIjpiZXtboqrAJW/Qfa6vQcQ9cQzLatYTDHJ2dllXnn3mZsNzoNAQDI5T1Sj4j LqsUK/IOE0dpkJNTW4HIOa65jrX5iu3EmXEfFcMAxlQPyaduP7gLYJivTwgeoD658lib Z3gWAuWyVfRoiydAERPpK5Sma4j6h+o28noVQng9PeKOOW9vp/fkfivNV/U2pC2cb3uq sAwm5E7l9DG3Dtz4EnbzMtMIuYn0dEvglOyF9gPOmHDxLWbIdCwAUjhGbMZeto/VazO+ TRMg== X-Gm-Message-State: APjAAAV+Mt4+UAnjPReJkxuGloeTqa0LevMlEbf1fiEtWRadi0gMY9XE ct5za4mF8OuXB8thJeIx1BhurzFQ X-Google-Smtp-Source: APXvYqykY+CAZJK5CDY9u7zKPkxIFLZeuaPqNSfttBcZOx7mOrsXoXMpTXdd7TfG7mecV94mevaoTQ== X-Received: by 2002:a50:a3ec:: with SMTP id t41mr81096155edb.43.1561042001737; Thu, 20 Jun 2019 07:46:41 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id y2sm7112720edc.26.2019.06.20.07.46.40 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Thu, 20 Jun 2019 07:46:40 -0700 (PDT) Date: Thu, 20 Jun 2019 16:46:39 +0200 From: Dominick Grift To: Alexander Miroshnichenko Cc: selinux-refpolicy@vger.kernel.org Subject: Re: [PATCH v2 1/2] ssh: Add ssh_exec_keygen interface Message-ID: <20190620144639.GB2647@brutus.lan> Mail-Followup-To: Alexander Miroshnichenko , selinux-refpolicy@vger.kernel.org References: <20190620144138.15172-1-alex@millerson.name> <20190620144138.15172-2-alex@millerson.name> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="oLBj+sq0vYjzfsbl" Content-Disposition: inline In-Reply-To: <20190620144138.15172-2-alex@millerson.name> User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --oLBj+sq0vYjzfsbl Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 20, 2019 at 05:41:37PM +0300, Alexander Miroshnichenko wrote: > Signed-off-by: Alexander Miroshnichenko > --- > policy/modules/services/ssh.if | 19 +++++++++++++++++++ > 1 file changed, 19 insertions(+) >=20 > diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh= =2Eif > index b5bd2762ef96..0941f133711e 100644 > --- a/policy/modules/services/ssh.if > +++ b/policy/modules/services/ssh.if > @@ -701,6 +701,25 @@ interface(`ssh_read_user_home_files',` > userdom_search_user_home_dirs($1) > ') > =20 > +######################################## > +## > +## Execute the ssh key generator in the caller domain. > +## > +## > +## > +## Domain allowed to transition. "Domain allowed access." Its not a transition. I suppose you have a use for= this interface? > +## > +## > +# > +interface(`ssh_exec_keygen',` > + gen_require(` > + type ssh_keygen_exec_t; > + ') > + > + corecmd_search_bin($1) > + can_exec($1, ssh_keygen_exec_t) > +') > + > ######################################## > ## > ## Execute the ssh key generator in the ssh keygen domain. > --=20 > 2.21.0 >=20 --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --oLBj+sq0vYjzfsbl Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0LnEoACgkQJXSOVTf5 R2lgBgv+NK4ZoVZaPTPMcMpF8Ri65Dxu7fQgvvfkWAPZiK3Reik15+8IGyUSdmZ2 oOlaZg0yMxZUu6B4anKOH4MZvaYRnaGqCXGNbGYHkko4e187uYjsgMi+5xt02ivf k1kaelBdRSOObzzY8dFLCXyFY305iX6C7YtNem72qRUaiYSwqvb/YssXKB7spQel 2nGQT/e1b36uCjSGHHZ3c6AOMjBEl5w67Z0wrQHu7jTVaCGtwBw8rl5DhcbHIO7A e6750G5OyhX8ofP3YbVEwAt4PmNqcv0T8mbiWvc53bHCgmcTzRpzxuFogJChN8YD ARmKbiOjEkYBnB7LC0bh6vojABbbxGoZB14WAXar/2cAM5/v9RNolqdAPL1Xf+VI 5cXVsz15OQpFFfo/ekABfLsXoAxuTpmoEKm6lcZgaAdhZb5d3BLAlqscRtR/iRsW 4CC7cJOCv7xaSnpjbZqAvRVo8fxYD7NFx4atP5ZerdQgFilp0skzTtKt81wopWOL 1SGUYBPC =afpu -----END PGP SIGNATURE----- --oLBj+sq0vYjzfsbl--