Layer: services

Module: ssh

Tunables Interfaces Templates

Description:

Secure shell client and server policy.

Tunables:

allow_ssh_keysign
Default value

false

Description

allow host key based authentication

ssh_connect_any_port
Default value

false

Description

Allow ssh to connect to arbitrary port

ssh_connect_x11_port
Default value

false

Description

Allow ssh to connect to X11 port

ssh_sysadm_login
Default value

true

Description

Allow ssh logins as sysadm_r:sysadm_t

ssh_use_gpg_agent
Default value

false

Description

Allow ssh to use gpg-agent

sshd_port_forwarding
Default value

false

Description

Allow sshd to use remote port forwarding (bind to any TCP port)

Return

Interfaces:

ssh_agent_exec( domain )
Summary

Execute the ssh agent client in the caller domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_client_domtrans( domain )
Summary

Execute the ssh client in the ssh client domain.

Parameters
Parameter:Description:
domain

Domain allowed to transition.

ssh_create_home_dirs( domain )
Summary

Create ssh home directory (~/.ssh)

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_delete_tmp( domain )
Summary

Delete from the ssh temp files.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_domtrans( domain )
Summary

Execute the ssh daemon sshd domain.

Parameters
Parameter:Description:
domain

Domain allowed to transition.

ssh_domtrans_keygen( domain )
Summary

Execute the ssh key generator in the ssh keygen domain.

Parameters
Parameter:Description:
domain

Domain allowed to transition.

ssh_dontaudit_agent_tmp( domain )
Summary

dontaudit access to ssh agent tmp dirs

Parameters
Parameter:Description:
domain

Domain not to audit.

ssh_dontaudit_read_server_keys( domain )
Summary

Do not audit denials on reading ssh server keys

Parameters
Parameter:Description:
domain

Domain to not audit.

ssh_dontaudit_rw_tcp_sockets( domain )
Summary

Do not audit attempts to read and write ssh server TCP sockets.

Parameters
Parameter:Description:
domain

Domain to not audit.

ssh_exec( domain )
Summary

Execute the ssh client in the caller domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_exec_sshd( domain )
Summary

Execute the ssh daemon in the caller domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_manage_home_files( domain )
Summary

Manage ssh home directory content

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_read_pipes( domain )
Summary

Read a ssh server unnamed pipe.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_read_server_keys( domain )
Summary

Read ssh server keys

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_read_user_home_files( domain )
Summary

Read ssh home directory content

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_run_keygen( domain , role )
Summary

Execute the ssh key generator in the ssh keygen domain, and allow the specified role the ssh keygen domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

role

Role allowed access.

ssh_rw_pipes( domain )
Summary

Read and write a ssh server unnamed pipe.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_rw_stream_sockets( domain )
Summary

Read and write ssh server unix domain stream sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_rw_tcp_sockets( domain )
Summary

Read and write ssh server TCP sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_search_sshd_runtime( domain )
Summary

allow search the ssh runtime dir

Parameters
Parameter:Description:
domain

Domain to permit

ssh_setattr_home_dirs( domain )
Summary

Set the attributes of ssh home directory (~/.ssh)

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_setattr_key_files( domain )
Summary

Set the attributes of sshd key files.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_sigchld( domain )
Summary

Send a SIGCHLD signal to the ssh server.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_signal( domain )
Summary

Send a generic signal to the ssh server.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_signull( domain )
Summary

Send a null signal to sshd processes.

Parameters
Parameter:Description:
domain

Domain allowed access.

ssh_use_sshd_pidfds( domain )
Summary

Use PIDFD file descriptors from the ssh server.

Parameters
Parameter:Description:
domain

Domain allowed access.

Return

Templates:

ssh_basic_client_template( userdomain_prefix , user_domain , user_role )
Summary

Basic SSH client template.

Description

This template creates a derived domains which are used for ssh client sessions. A derived type is also created to protect the user ssh keys.

This template was added for NX.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the domain (e.g., user is the prefix for user_t).

user_domain

The type of the domain.

user_role

The role associated with the user domain.

ssh_role_template( role_prefix , user_domain , user_exec_domain , role )
Summary

Role access for ssh

Parameters
Parameter:Description:
role_prefix

The prefix of the user role (e.g., user is the prefix for user_r).

user_domain

User domain for the role.

user_exec_domain

User exec domain for execute and transition access.

role

Role allowed access

ssh_server_template( userdomain_prefix )
Summary

The template to define a ssh server.

Description

This template creates a domains to be used for creating a ssh server. This is typically done to have multiple ssh servers of different sensitivities, such as for an internal network-facing ssh server, and a external network-facing ssh server.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the server domain (e.g., sshd is the prefix for sshd_t).

Return