Confine systemd system-ssh-generator

Resolves: RHEL-72549
zpytela · Jan 8, 2025 · 0e49553 · 0e49553
1 parent a767c76
commit 0e49553
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
@@ -79,6 +79,7 @@ HOME_DIR/\.config/systemd/user(/.*)?		gen_context(system_u:object_r:systemd_unit
 /usr/lib/systemd/system-generators/systemd-fstab-generator	--	gen_context(system_u:object_r:systemd_fstab_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-gpt-auto-generator	--	gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-rc-local-generator	--	gen_context(system_u:object_r:systemd_rc_local_generator_exec_t,s0)
+/usr/lib/systemd/system-generators/systemd-ssh-generator	--	gen_context(system_u:object_r:systemd_ssh_generator_exec_t,s0)
 /usr/lib/systemd/system-generators/systemd-sysv-generator	--	gen_context(system_u:object_r:systemd_sysv_generator_exec_t,s0)
 /usr/lib/systemd/systemd-resolve(d|-host)			gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
 /usr/lib/systemd/systemd-importd		--	gen_context(system_u:object_r:systemd_importd_exec_t,s0)

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
@@ -201,6 +201,8 @@ systemd_generator_template(systemd_fstab_generator)
 
 #domain for rc-local-generator
 systemd_generator_template(systemd_rc_local_generator)
+# ssh-generator
+systemd_generator_template(systemd_ssh_generator)
 
 #domain for sysv-generator
 systemd_generator_template(systemd_sysv_generator)
@@ -1288,6 +1290,19 @@ systemd_manage_all_unit_files(systemd_fstab_generator_t)
 
 init_exec_script_files(systemd_rc_local_generator_t)
 
+### ssh generator
+allow systemd_ssh_generator_t self:vsock_socket create;
+allow systemd_ssh_generator_t vsock_device_t:chr_file { read_chr_file_perms };
+
+kernel_read_sysctl(systemd_ssh_generator_t)
+
+dev_read_sysfs(systemd_ssh_generator_t)
+
+optional_policy(`
+	ssh_domtrans(systemd_ssh_generator_t)
+	ssh_getattr_unit_file(systemd_ssh_generator_t)
+')
+
 #######################################
 #
 # systemd_sysv_generator_t