ssh_selinux(8)

1ssh_selinux(8)                SELinux Policy ssh                ssh_selinux(8)
2
3
4

NAME

6       ssh_selinux - Security Enhanced Linux Policy for the ssh processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the ssh processes via flexible manda‐
10       tory access control.
11
12       The ssh processes execute with the ssh_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ssh_t
19
20
21

ENTRYPOINTS

23       The ssh_t SELinux type can be entered via the ssh_exec_t file type.
24
25       The default entrypoint paths for the ssh_t domain are the following:
26
27       /usr/bin/ssh, /usr/libexec/nm-ssh-service
28

PROCESS TYPES

30       SELinux defines process types (domains) for each process running on the
31       system
32
33       You can see the context of a process using the -Z option to ps
34
35       Policy  governs  the  access confined processes have to files.  SELinux
36       ssh policy is very flexible allowing users to setup their ssh processes
37       in as secure a method as possible.
38
39       The following process types are defined for ssh:
40
41       sshd_t, sshd_sandbox_t, sshd_net_t, ssh_keygen_t, sshd_keygen_t, ssh_t, ssh_keysign_t
42
43       Note: semanage permissive -a ssh_t can be used to make the process type
44       ssh_t permissive. SELinux does not deny access  to  permissive  process
45       types, but the AVC (SELinux denials) messages are still generated.
46
47

BOOLEANS

49       SELinux  policy  is  customizable  based on least access required.  ssh
50       policy is extremely flexible and has several booleans that allow you to
51       manipulate the policy and run ssh with the tightest access possible.
52
53
54
55       If  you  want  to allow host key based authentication, you must turn on
56       the ssh_keysign boolean. Disabled by default.
57
58       setsebool -P ssh_keysign 1
59
60
61
62       If you want to allow users to resolve user passwd entries directly from
63       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
64       gin_nsswitch_use_ldap boolean. Disabled by default.
65
66       setsebool -P authlogin_nsswitch_use_ldap 1
67
68
69
70       If you want to allow all domains to execute in fips_mode, you must turn
71       on the fips_mode boolean. Enabled by default.
72
73       setsebool -P fips_mode 1
74
75
76
77       If  you  want  to allow confined applications to run with kerberos, you
78       must turn on the kerberos_enabled boolean. Disabled by default.
79
80       setsebool -P kerberos_enabled 1
81
82
83
84       If you want to allow system to run with  NIS,  you  must  turn  on  the
85       nis_enabled boolean. Disabled by default.
86
87       setsebool -P nis_enabled 1
88
89
90
91       If  you  want to allow confined applications to use nscd shared memory,
92       you must turn on the nscd_use_shm boolean. Disabled by default.
93
94       setsebool -P nscd_use_shm 1
95
96
97
98       If you want to allow regular users direct dri device access,  you  must
99       turn   on   the  selinuxuser_direct_dri_enabled  boolean.  Disabled  by
100       default.
101
102       setsebool -P selinuxuser_direct_dri_enabled 1
103
104
105
106       If you want to allow users to run TCP servers (bind to ports and accept
107       connection  from  the  same  domain  and outside users)  disabling this
108       forces FTP passive mode and may change other protocols, you  must  turn
109       on the selinuxuser_tcp_server boolean. Disabled by default.
110
111       setsebool -P selinuxuser_tcp_server 1
112
113
114
115       If  you  want  to allows clients to write to the X server shared memory
116       segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
117       abled by default.
118
119       setsebool -P xserver_clients_write_xshm 1
120
121
122

PORT TYPES

124       SELinux defines port types to represent TCP and UDP ports.
125
126       You  can  see  the  types associated with a port by using the following
127       command:
128
129       semanage port -l
130
131
132       Policy governs the access  confined  processes  have  to  these  ports.
133       SELinux  ssh  policy is very flexible allowing users to setup their ssh
134       processes in as secure a method as possible.
135
136       The following port types are defined for ssh:
137
138
139       ssh_port_t
140
141
142
143       Default Defined Ports:
144                 tcp 22
145

MANAGED FILES

147       The SELinux process type ssh_t can manage files labeled with  the  fol‐
148       lowing  file  types.   The paths listed are the default paths for these
149       file types.  Note the processes UID still need to have DAC permissions.
150
151       cifs_t
152
153
154       ecryptfs_t
155
156            /home/[^/]+/.Private(/.*)?
157            /home/[^/]+/.ecryptfs(/.*)?
158
159       fusefs_t
160
161            /var/run/user/[^/]*/gvfs
162
163       nfs_t
164
165
166       ssh_home_t
167
168            /var/lib/[^/]+/.ssh(/.*)?
169            /root/.ssh(/.*)?
170            /var/lib/one/.ssh(/.*)?
171            /var/lib/pgsql/.ssh(/.*)?
172            /var/lib/openshift/[^/]+/.ssh(/.*)?
173            /var/lib/amanda/.ssh(/.*)?
174            /var/lib/stickshift/[^/]+/.ssh(/.*)?
175            /var/lib/gitolite/.ssh(/.*)?
176            /var/lib/nocpulse/.ssh(/.*)?
177            /var/lib/gitolite3/.ssh(/.*)?
178            /var/lib/openshift/gear/[^/]+/.ssh(/.*)?
179            /root/.shosts
180            /home/[^/]+/.ssh(/.*)?
181            /home/[^/]+/.ansible/cp/.*
182            /home/[^/]+/.shosts
183
184       ssh_tmpfs_t
185
186
187       user_fonts_cache_t
188
189            /root/.fontconfig(/.*)?
190            /root/.fonts/auto(/.*)?
191            /root/.fonts.cache-.*
192            /root/.cache/fontconfig(/.*)?
193            /home/[^/]+/.fontconfig(/.*)?
194            /home/[^/]+/.fonts/auto(/.*)?
195            /home/[^/]+/.fonts.cache-.*
196            /home/[^/]+/.cache/fontconfig(/.*)?
197
198       user_tmp_t
199
200            /dev/shm/mono.*
201            /var/run/user(/.*)?
202            /tmp/.ICE-unix(/.*)?
203            /tmp/.X11-unix(/.*)?
204            /dev/shm/pulse-shm.*
205            /tmp/.X0-lock
206            /tmp/hsperfdata_root
207            /var/tmp/hsperfdata_root
208            /home/[^/]+/tmp
209            /home/[^/]+/.tmp
210            /tmp/gconfd-[^/]+
211
212       user_tmp_type
213
214            all user tmp files
215
216       xserver_tmpfs_t
217
218
219

FILE CONTEXTS

221       SELinux requires files to have an extended attribute to define the file
222       type.
223
224       You can see the context of a file using the -Z option to ls
225
226       Policy  governs  the  access  confined  processes  have to these files.
227       SELinux ssh policy is very flexible allowing users to setup  their  ssh
228       processes in as secure a method as possible.
229
230       STANDARD FILE CONTEXT
231
232       SELinux  defines  the  file context types for the ssh, if you wanted to
233       store files with these types in a diffent paths, you  need  to  execute
234       the  semanage  command  to  sepecify  alternate  labeling  and then use
235       restorecon to put the labels on disk.
236
237       semanage fcontext -a -t ssh_home_t '/srv/myssh_content(/.*)?'
238       restorecon -R -v /srv/myssh_content
239
240       Note: SELinux often uses regular expressions  to  specify  labels  that
241       match multiple files.
242
243       The following file types are defined for ssh:
244
245
246
247       ssh_agent_exec_t
248
249       -  Set  files with the ssh_agent_exec_t type, if you want to transition
250       an executable to the ssh_agent_t domain.
251
252
253
254       ssh_agent_tmp_t
255
256       - Set files with the ssh_agent_tmp_t type, if you  want  to  store  ssh
257       agent temporary files in the /tmp directories.
258
259
260
261       ssh_exec_t
262
263       - Set files with the ssh_exec_t type, if you want to transition an exe‐
264       cutable to the ssh_t domain.
265
266
267       Paths:
268            /usr/bin/ssh, /usr/libexec/nm-ssh-service
269
270
271       ssh_home_t
272
273       - Set files with the ssh_home_t type, if you want to store ssh files in
274       the users home directory.
275
276
277       Paths:
278            /var/lib/[^/]+/.ssh(/.*)?,                       /root/.ssh(/.*)?,
279            /var/lib/one/.ssh(/.*)?, /var/lib/pgsql/.ssh(/.*)?, /var/lib/open‐
280            shift/[^/]+/.ssh(/.*)?,                /var/lib/amanda/.ssh(/.*)?,
281            /var/lib/stickshift/[^/]+/.ssh(/.*)?,               /var/lib/gito‐
282            lite/.ssh(/.*)?,    /var/lib/nocpulse/.ssh(/.*)?,   /var/lib/gito‐
283            lite3/.ssh(/.*)?,        /var/lib/openshift/gear/[^/]+/.ssh(/.*)?,
284            /root/.shosts, /home/[^/]+/.ssh(/.*)?, /home/[^/]+/.ansible/cp/.*,
285            /home/[^/]+/.shosts
286
287
288       ssh_keygen_exec_t
289
290       - Set files with the ssh_keygen_exec_t type, if you want to  transition
291       an executable to the ssh_keygen_t domain.
292
293
294
295       ssh_keygen_tmp_t
296
297       -  Set  files  with the ssh_keygen_tmp_t type, if you want to store ssh
298       keygen temporary files in the /tmp directories.
299
300
301
302       ssh_keysign_exec_t
303
304       - Set files with the ssh_keysign_exec_t type, if you want to transition
305       an executable to the ssh_keysign_t domain.
306
307
308       Paths:
309            /usr/lib/openssh/ssh-keysign, /usr/libexec/openssh/ssh-keysign
310
311
312       ssh_tmpfs_t
313
314       -  Set  files with the ssh_tmpfs_t type, if you want to store ssh files
315       on a tmpfs file system.
316
317
318
319       sshd_exec_t
320
321       - Set files with the sshd_exec_t type, if you  want  to  transition  an
322       executable to the sshd_t domain.
323
324
325       Paths:
326            /usr/sbin/sshd, /usr/sbin/gsisshd
327
328
329       sshd_initrc_exec_t
330
331       - Set files with the sshd_initrc_exec_t type, if you want to transition
332       an executable to the sshd_initrc_t domain.
333
334
335
336       sshd_key_t
337
338       - Set files with the sshd_key_t type, if you want to treat the files as
339       sshd key data.
340
341
342       Paths:
343            /etc/ssh/ssh_host.*_key,              /etc/ssh/ssh_host.*_key.pub,
344            /etc/ssh/primes
345
346
347       sshd_keygen_exec_t
348
349       - Set files with the sshd_keygen_exec_t type, if you want to transition
350       an executable to the sshd_keygen_t domain.
351
352
353       Paths:
354            /usr/sbin/sshd-keygen, /usr/libexec/openssh/sshd-keygen
355
356
357       sshd_keygen_unit_file_t
358
359       - Set files with the sshd_keygen_unit_file_t type, if you want to treat
360       the files as sshd keygen unit content.
361
362
363
364       sshd_keytab_t
365
366       - Set files with the sshd_keytab_t type, if you want to treat the files
367       as kerberos keytab files.
368
369
370
371       sshd_tmpfs_t
372
373       - Set files with the sshd_tmpfs_t type, if you want to store sshd files
374       on a tmpfs file system.
375
376
377
378       sshd_unit_file_t
379
380       - Set files with the sshd_unit_file_t type, if you want  to  treat  the
381       files as sshd unit content.
382
383
384
385       sshd_var_run_t
386
387       - Set files with the sshd_var_run_t type, if you want to store the sshd
388       files under the /run or /var/run directory.
389
390
391       Paths:
392            /var/run/sshd.pid, /var/run/sshd.init.pid
393
394
395       Note: File context can be temporarily modified with the chcon  command.
396       If  you want to permanently change the file context you need to use the
397       semanage fcontext command.  This will modify the SELinux labeling data‐
398       base.  You will need to use restorecon to apply the labels.
399
400

COMMANDS

402       semanage  fcontext  can also be used to manipulate default file context
403       mappings.
404
405       semanage permissive can also be used to manipulate  whether  or  not  a
406       process type is permissive.
407
408       semanage  module can also be used to enable/disable/install/remove pol‐
409       icy modules.
410
411       semanage port can also be used to manipulate the port definitions
412
413       semanage boolean can also be used to manipulate the booleans
414
415
416       system-config-selinux is a GUI tool available to customize SELinux pol‐
417       icy settings.
418
419

AUTHOR

421       This manual page was auto-generated using sepolicy manpage .
422
423