Layer: services

Module: ssh

Tunables Interfaces Templates

Description:

Secure shell client and server policy.

Tunables:

allow_ssh_keysign

Default value

false

Description

allow host key based authentication

ssh_sysadm_login

Default value

true

Description

Allow ssh logins as sysadm_r:sysadm_t

ssh_use_gpg_agent

Default value

false

Description

Allow ssh to use gpg-agent

Return

Interfaces:

ssh_agent_exec(
	
		domain
		
	)

Summary

Execute the ssh agent client in the caller domain.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_client_domtrans(
	
		domain
		
	)

Summary

Execute the ssh client in the ssh client domain.

Parameters

Parameter:	Description:
domain	Domain allowed to transition.

ssh_create_home_dirs(
	
		domain
		
	)

Summary

Create ssh home directory (~/.ssh)

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_delete_tmp(
	
		domain
		
	)

Summary

Delete from the ssh temp files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_domtrans(
	
		domain
		
	)

Summary

Execute the ssh daemon sshd domain.

Parameters

Parameter:	Description:
domain	Domain allowed to transition.

ssh_domtrans_keygen(
	
		domain
		
	)

Summary

Execute the ssh key generator in the ssh keygen domain.

Parameters

Parameter:	Description:
domain	Domain allowed to transition.

ssh_dontaudit_agent_tmp(
	
		domain
		
	)

Summary

dontaudit access to ssh agent tmp dirs

Parameters

Parameter:	Description:
domain	Domain not to audit.

ssh_dontaudit_read_server_keys(
	
		domain
		
	)

Summary

Do not audit denials on reading ssh server keys

Parameters

Parameter:	Description:
domain	Domain to not audit.

ssh_dontaudit_rw_tcp_sockets(
	
		domain
		
	)

Summary

Do not audit attempts to read and write ssh server TCP sockets.

Parameters

Parameter:	Description:
domain	Domain to not audit.

ssh_exec(
	
		domain
		
	)

Summary

Execute the ssh client in the caller domain.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_exec_sshd(
	
		domain
		
	)

Summary

Execute the ssh daemon in the caller domain.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_manage_home_files(
	
		domain
		
	)

Summary

Manage ssh home directory content

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_read_pipes(
	
		domain
		
	)

Summary

Read a ssh server unnamed pipe.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_read_server_keys(
	
		domain
		
	)

Summary

Read ssh server keys

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_read_user_home_files(
	
		domain
		
	)

Summary

Read ssh home directory content

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_rw_pipes(
	
		domain
		
	)

Summary

Read and write a ssh server unnamed pipe.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_rw_stream_sockets(
	
		domain
		
	)

Summary

Read and write ssh server unix domain stream sockets.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_rw_tcp_sockets(
	
		domain
		
	)

Summary

Read and write ssh server TCP sockets.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_setattr_home_dirs(
	
		domain
		
	)

Summary

Set the attributes of ssh home directory (~/.ssh)

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_setattr_key_files(
	
		domain
		
	)

Summary

Set the attributes of sshd key files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_sigchld(
	
		domain
		
	)

Summary

Send a SIGCHLD signal to the ssh server.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_signal(
	
		domain
		
	)

Summary

Send a generic signal to the ssh server.

Parameters

Parameter:	Description:
domain	Domain allowed access.

ssh_signull(
	
		domain
		
	)

Summary

Send a null signal to sshd processes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

Return

Templates:

ssh_basic_client_template(
	
		userdomain_prefix
		
			,
		
		user_domain
		
			,
		
		user_role
		
	)

Summary

Basic SSH client template.

Description

This template creates a derived domains which are used for ssh client sessions. A derived type is also created to protect the user ssh keys.

This template was added for NX.

Parameters

Parameter:	Description:
userdomain_prefix	The prefix of the domain (e.g., user is the prefix for user_t).
user_domain	The type of the domain.
user_role	The role associated with the user domain.

ssh_role_template(
	
		role_prefix
		
			,
		
		user_domain
		
			,
		
		user_exec_domain
		
			,
		
		role
		
	)

Summary

Role access for ssh

Parameters

Parameter:	Description:
role_prefix	The prefix of the user role (e.g., user is the prefix for user_r).
user_domain	User domain for the role.
user_exec_domain	User exec domain for execute and transition access.
role	Role allowed access

ssh_server_template(
	
		userdomain_prefix
		
	)

Summary

The template to define a ssh server.

Description

This template creates a domains to be used for creating a ssh server. This is typically done to have multiple ssh servers of different sensitivities, such as for an internal network-facing ssh server, and a external network-facing ssh server.

Parameters

Parameter:	Description:
userdomain_prefix	The prefix of the server domain (e.g., sshd is the prefix for sshd_t).

Return