ssh_selinux(8)

1ssh_selinux(8)                SELinux Policy ssh                ssh_selinux(8)
2
3
4

NAME

6       ssh_selinux - Security Enhanced Linux Policy for the ssh processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the ssh processes via flexible manda‐
10       tory access control.
11
12       The ssh processes execute with the ssh_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ssh_t
19
20
21

ENTRYPOINTS

23       The ssh_t SELinux type can be entered via the ssh_exec_t file type.
24
25       The default entrypoint paths for the ssh_t domain are the following:
26
27       /usr/bin/ssh
28

PROCESS TYPES

30       SELinux defines process types (domains) for each process running on the
31       system
32
33       You can see the context of a process using the -Z option to ps
34
35       Policy  governs  the  access confined processes have to files.  SELinux
36       ssh policy is very flexible allowing users to setup their ssh processes
37       in as secure a method as possible.
38
39       The following process types are defined for ssh:
40
41       ssh_keysign_t, ssh_keygen_t, ssh_t, sshd_t
42
43       Note: semanage permissive -a ssh_t can be used to make the process type
44       ssh_t permissive. SELinux does not deny access  to  permissive  process
45       types, but the AVC (SELinux denials) messages are still generated.
46
47

BOOLEANS

49       SELinux  policy  is  customizable  based on least access required.  ssh
50       policy is extremely flexible and has several booleans that allow you to
51       manipulate the policy and run ssh with the tightest access possible.
52
53
54
55       If you want to allow all domains to use other domains file descriptors,
56       you must turn on the allow_domain_fd_use boolean. Enabled by default.
57
58       setsebool -P allow_domain_fd_use 1
59
60
61
62       If you want to allow confined applications to run  with  kerberos,  you
63       must turn on the allow_kerberos boolean. Enabled by default.
64
65       setsebool -P allow_kerberos 1
66
67
68
69       If  you want to allow sysadm to debug or ptrace all processes, you must
70       turn on the allow_ptrace boolean. Disabled by default.
71
72       setsebool -P allow_ptrace 1
73
74
75
76       If you want to allow host key based authentication, you  must  turn  on
77       the allow_ssh_keysign boolean. Disabled by default.
78
79       setsebool -P allow_ssh_keysign 1
80
81
82
83       If  you  want  to allows clients to write to the X server shared memory
84       segments, you must turn on the allow_write_xshm  boolean.  Disabled  by
85       default.
86
87       setsebool -P allow_write_xshm 1
88
89
90
91       If  you  want  to  allow  system  to run with NIS, you must turn on the
92       allow_ypbind boolean. Disabled by default.
93
94       setsebool -P allow_ypbind 1
95
96
97
98       If you want to allow all domains to have the kernel load  modules,  you
99       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
100       default.
101
102       setsebool -P domain_kernel_load_modules 1
103
104
105
106       If you want to allow all domains to execute in fips_mode, you must turn
107       on the fips_mode boolean. Enabled by default.
108
109       setsebool -P fips_mode 1
110
111
112
113       If you want to enable reading of urandom for all domains, you must turn
114       on the global_ssp boolean. Disabled by default.
115
116       setsebool -P global_ssp 1
117
118
119
120       If you want to allow confined applications to use nscd  shared  memory,
121       you must turn on the nscd_use_shm boolean. Enabled by default.
122
123       setsebool -P nscd_use_shm 1
124
125
126
127       If  you  want  to support fusefs home directories, you must turn on the
128       use_fusefs_home_dirs boolean. Disabled by default.
129
130       setsebool -P use_fusefs_home_dirs 1
131
132
133
134       If you want to support NFS home  directories,  you  must  turn  on  the
135       use_nfs_home_dirs boolean. Disabled by default.
136
137       setsebool -P use_nfs_home_dirs 1
138
139
140
141       If  you  want  to  support SAMBA home directories, you must turn on the
142       use_samba_home_dirs boolean. Disabled by default.
143
144       setsebool -P use_samba_home_dirs 1
145
146
147
148       If you want to allow users to run TCP servers (bind to ports and accept
149       connection  from  the  same  domain  and outside users)  disabling this
150       forces FTP passive mode and may change other protocols, you  must  turn
151       on the user_tcp_server boolean. Disabled by default.
152
153       setsebool -P user_tcp_server 1
154
155
156
157       If you want to support X userspace object manager, you must turn on the
158       xserver_object_manager boolean. Disabled by default.
159
160       setsebool -P xserver_object_manager 1
161
162
163

PORT TYPES

165       SELinux defines port types to represent TCP and UDP ports.
166
167       You can see the types associated with a port  by  using  the  following
168       command:
169
170       semanage port -l
171
172
173       Policy  governs  the  access  confined  processes  have to these ports.
174       SELinux ssh policy is very flexible allowing users to setup  their  ssh
175       processes in as secure a method as possible.
176
177       The following port types are defined for ssh:
178
179
180       ssh_port_t
181
182
183
184       Default Defined Ports:
185                 tcp 22
186

MANAGED FILES

188       The  SELinux  process type ssh_t can manage files labeled with the fol‐
189       lowing file types.  The paths listed are the default  paths  for  these
190       file types.  Note the processes UID still need to have DAC permissions.
191
192       cifs_t
193
194
195       fusefs_t
196
197
198       initrc_tmp_t
199
200
201       mnt_t
202
203            /mnt(/[^/]*)
204            /mnt(/[^/]*)?
205            /rhev(/[^/]*)?
206            /media(/[^/]*)
207            /media(/[^/]*)?
208            /etc/rhgb(/.*)?
209            /media/.hal-.*
210            /net
211            /afs
212            /rhev
213            /misc
214
215       nfs_t
216
217
218       ssh_home_t
219
220            /root/.ssh(/.*)?
221            /var/lib/gitolite(3)?/.ssh(/.*)?
222            /var/lib/pgsql/.ssh(/.*)?
223            /var/lib/openshift/[^/]+/.ssh(/.*)?
224            /var/lib/amanda/.ssh(/.*)?
225            /var/lib/stickshift/[^/]+/.ssh(/.*)?
226            /root/.shosts
227            /home/[^/]*/.ssh(/.*)?
228            /home/[^/]*/.shosts
229            /home/staff/.ssh(/.*)?
230            /home/staff/.shosts
231
232       ssh_tmpfs_t
233
234
235       tmp_t
236
237            /tmp
238            /usr/tmp
239            /var/tmp
240            /tmp-inst
241            /var/tmp-inst
242            /var/tmp/vi.recover
243
244       user_fonts_cache_t
245
246            /home/[^/]*/.fonts/auto(/.*)?
247            /home/[^/]*/.fontconfig(/.*)?
248            /home/[^/]*/.fonts.cache-.*
249            /home/staff/.fonts/auto(/.*)?
250            /home/staff/.fontconfig(/.*)?
251            /home/staff/.fonts.cache-.*
252
253       user_tmp_t
254
255            /tmp/gconfd-.*
256            /tmp/gconfd-staff
257
258       xserver_tmpfs_t
259
260
261

FILE CONTEXTS

263       SELinux requires files to have an extended attribute to define the file
264       type.
265
266       You can see the context of a file using the -Z option to ls
267
268       Policy governs the access  confined  processes  have  to  these  files.
269       SELinux  ssh  policy is very flexible allowing users to setup their ssh
270       processes in as secure a method as possible.
271
272       STANDARD FILE CONTEXT
273
274       SELinux defines the file context types for the ssh, if  you  wanted  to
275       store  files  with  these types in a diffent paths, you need to execute
276       the semanage command  to  sepecify  alternate  labeling  and  then  use
277       restorecon to put the labels on disk.
278
279       semanage fcontext -a -t sshd_var_run_t '/srv/myssh_content(/.*)?'
280       restorecon -R -v /srv/myssh_content
281
282       Note:  SELinux  often  uses  regular expressions to specify labels that
283       match multiple files.
284
285       The following file types are defined for ssh:
286
287
288
289       ssh_agent_exec_t
290
291       - Set files with the ssh_agent_exec_t type, if you want  to  transition
292       an executable to the ssh_agent_t domain.
293
294
295
296       ssh_agent_tmp_t
297
298       -  Set  files  with  the ssh_agent_tmp_t type, if you want to store ssh
299       agent temporary files in the /tmp directories.
300
301
302
303       ssh_exec_t
304
305       - Set files with the ssh_exec_t type, if you want to transition an exe‐
306       cutable to the ssh_t domain.
307
308
309
310       ssh_home_t
311
312       - Set files with the ssh_home_t type, if you want to store ssh files in
313       the users home directory.
314
315
316       Paths:
317            /root/.ssh(/.*)?,                /var/lib/gitolite(3)?/.ssh(/.*)?,
318            /var/lib/pgsql/.ssh(/.*)?,    /var/lib/openshift/[^/]+/.ssh(/.*)?,
319            /var/lib/amanda/.ssh(/.*)?,  /var/lib/stickshift/[^/]+/.ssh(/.*)?,
320            /root/.shosts,     /home/[^/]*/.ssh(/.*)?,    /home/[^/]*/.shosts,
321            /home/staff/.ssh(/.*)?, /home/staff/.shosts
322
323
324       ssh_keygen_exec_t
325
326       - Set files with the ssh_keygen_exec_t type, if you want to  transition
327       an executable to the ssh_keygen_t domain.
328
329
330
331       ssh_keysign_exec_t
332
333       - Set files with the ssh_keysign_exec_t type, if you want to transition
334       an executable to the ssh_keysign_t domain.
335
336
337
338       ssh_tmpfs_t
339
340       - Set files with the ssh_tmpfs_t type, if you want to store  ssh  files
341       on a tmpfs file system.
342
343
344
345       sshd_exec_t
346
347       -  Set  files  with  the sshd_exec_t type, if you want to transition an
348       executable to the sshd_t domain.
349
350
351
352       sshd_initrc_exec_t
353
354       - Set files with the sshd_initrc_exec_t type, if you want to transition
355       an executable to the sshd_initrc_t domain.
356
357
358
359       sshd_key_t
360
361       - Set files with the sshd_key_t type, if you want to treat the files as
362       sshd key data.
363
364
365       Paths:
366            /etc/ssh/ssh_host_key.pub,          /etc/ssh/ssh_host_dsa_key.pub,
367            /etc/ssh/ssh_host_rsa_key.pub,                    /etc/ssh/primes,
368            /etc/ssh/ssh_host_key,                  /etc/ssh/ssh_host_dsa_key,
369            /etc/ssh/ssh_host_rsa_key
370
371
372       sshd_keytab_t
373
374       - Set files with the sshd_keytab_t type, if you want to treat the files
375       as kerberos keytab files.
376
377
378
379       sshd_tmpfs_t
380
381       - Set files with the sshd_tmpfs_t type, if you want to store sshd files
382       on a tmpfs file system.
383
384
385
386       sshd_var_run_t
387
388       - Set files with the sshd_var_run_t type, if you want to store the sshd
389       files under the /run or /var/run directory.
390
391
392
393       Note: File context can be temporarily modified with the chcon  command.
394       If  you want to permanently change the file context you need to use the
395       semanage fcontext command.  This will modify the SELinux labeling data‐
396       base.  You will need to use restorecon to apply the labels.
397
398

COMMANDS

400       semanage  fcontext  can also be used to manipulate default file context
401       mappings.
402
403       semanage permissive can also be used to manipulate  whether  or  not  a
404       process type is permissive.
405
406       semanage  module can also be used to enable/disable/install/remove pol‐
407       icy modules.
408
409       semanage port can also be used to manipulate the port definitions
410
411       semanage boolean can also be used to manipulate the booleans
412
413
414       system-config-selinux is a GUI tool available to customize SELinux pol‐
415       icy settings.
416
417

AUTHOR

419       This manual page was auto-generated using sepolicy manpage .
420
421