ssh_selinux(8)

1ssh_selinux(8)                SELinux Policy ssh                ssh_selinux(8)
2
3
4

NAME

6       ssh_selinux - Security Enhanced Linux Policy for the ssh processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the ssh processes via flexible manda‐
10       tory access control.
11
12       The ssh processes execute with the ssh_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ssh_t
19
20
21

ENTRYPOINTS

23       The ssh_t SELinux type can be entered via the ssh_exec_t file type.
24
25       The default entrypoint paths for the ssh_t domain are the following:
26
27       /usr/bin/ssh, /usr/libexec/nm-ssh-service
28

PROCESS TYPES

30       SELinux defines process types (domains) for each process running on the
31       system
32
33       You can see the context of a process using the -Z option to ps
34
35       Policy  governs  the  access confined processes have to files.  SELinux
36       ssh policy is very flexible allowing users to setup their ssh processes
37       in as secure a method as possible.
38
39       The following process types are defined for ssh:
40
41       sshd_t, sshd_sandbox_t, sshd_net_t, ssh_keygen_t, sshd_keygen_t, ssh_t, ssh_keysign_t
42
43       Note: semanage permissive -a ssh_t can be used to make the process type
44       ssh_t permissive. SELinux does not deny access  to  permissive  process
45       types, but the AVC (SELinux denials) messages are still generated.
46
47

BOOLEANS

49       SELinux  policy  is  customizable  based on least access required.  ssh
50       policy is extremely flexible and has several booleans that allow you to
51       manipulate the policy and run ssh with the tightest access possible.
52
53
54
55       If  you  want  to allow host key based authentication, you must turn on
56       the ssh_keysign boolean. Disabled by default.
57
58       setsebool -P ssh_keysign 1
59
60
61
62       If you want to allow users to resolve user passwd entries directly from
63       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
64       gin_nsswitch_use_ldap boolean. Disabled by default.
65
66       setsebool -P authlogin_nsswitch_use_ldap 1
67
68
69
70       If you want to deny any process from ptracing or  debugging  any  other
71       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
72       default.
73
74       setsebool -P deny_ptrace 1
75
76
77
78       If you want to allow any process  to  mmap  any  file  on  system  with
79       attribute  file_type,  you must turn on the domain_can_mmap_files bool‐
80       ean. Enabled by default.
81
82       setsebool -P domain_can_mmap_files 1
83
84
85
86       If you want to allow all domains write to kmsg_device, while kernel  is
87       executed  with  systemd.log_target=kmsg parameter, you must turn on the
88       domain_can_write_kmsg boolean. Disabled by default.
89
90       setsebool -P domain_can_write_kmsg 1
91
92
93
94       If you want to allow all domains to use other domains file descriptors,
95       you must turn on the domain_fd_use boolean. Enabled by default.
96
97       setsebool -P domain_fd_use 1
98
99
100
101       If  you  want to allow all domains to have the kernel load modules, you
102       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
103       default.
104
105       setsebool -P domain_kernel_load_modules 1
106
107
108
109       If you want to allow all domains to execute in fips_mode, you must turn
110       on the fips_mode boolean. Enabled by default.
111
112       setsebool -P fips_mode 1
113
114
115
116       If you want to enable reading of urandom for all domains, you must turn
117       on the global_ssp boolean. Disabled by default.
118
119       setsebool -P global_ssp 1
120
121
122
123       If  you  want  to allow confined applications to run with kerberos, you
124       must turn on the kerberos_enabled boolean. Enabled by default.
125
126       setsebool -P kerberos_enabled 1
127
128
129
130       If you want to allow system to run with  NIS,  you  must  turn  on  the
131       nis_enabled boolean. Disabled by default.
132
133       setsebool -P nis_enabled 1
134
135
136
137       If  you  want to allow confined applications to use nscd shared memory,
138       you must turn on the nscd_use_shm boolean. Disabled by default.
139
140       setsebool -P nscd_use_shm 1
141
142
143
144       If you want to allow regular users direct dri device access,  you  must
145       turn on the selinuxuser_direct_dri_enabled boolean. Enabled by default.
146
147       setsebool -P selinuxuser_direct_dri_enabled 1
148
149
150
151       If you want to allow users to run TCP servers (bind to ports and accept
152       connection from the same domain  and  outside  users)   disabling  this
153       forces  FTP  passive mode and may change other protocols, you must turn
154       on the selinuxuser_tcp_server boolean. Disabled by default.
155
156       setsebool -P selinuxuser_tcp_server 1
157
158
159
160       If you want to support ecryptfs home directories, you must turn on  the
161       use_ecryptfs_home_dirs boolean. Disabled by default.
162
163       setsebool -P use_ecryptfs_home_dirs 1
164
165
166
167       If  you  want  to support fusefs home directories, you must turn on the
168       use_fusefs_home_dirs boolean. Disabled by default.
169
170       setsebool -P use_fusefs_home_dirs 1
171
172
173
174       If you want to support NFS home  directories,  you  must  turn  on  the
175       use_nfs_home_dirs boolean. Disabled by default.
176
177       setsebool -P use_nfs_home_dirs 1
178
179
180
181       If  you  want  to  support SAMBA home directories, you must turn on the
182       use_samba_home_dirs boolean. Disabled by default.
183
184       setsebool -P use_samba_home_dirs 1
185
186
187
188       If you want to allows clients to write to the X  server  shared  memory
189       segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
190       abled by default.
191
192       setsebool -P xserver_clients_write_xshm 1
193
194
195
196       If you want to support X userspace object manager, you must turn on the
197       xserver_object_manager boolean. Enabled by default.
198
199       setsebool -P xserver_object_manager 1
200
201
202

PORT TYPES

204       SELinux defines port types to represent TCP and UDP ports.
205
206       You  can  see  the  types associated with a port by using the following
207       command:
208
209       semanage port -l
210
211
212       Policy governs the access  confined  processes  have  to  these  ports.
213       SELinux  ssh  policy is very flexible allowing users to setup their ssh
214       processes in as secure a method as possible.
215
216       The following port types are defined for ssh:
217
218
219       ssh_port_t
220
221
222
223       Default Defined Ports:
224                 tcp 22
225

MANAGED FILES

227       The SELinux process type ssh_t can manage files labeled with  the  fol‐
228       lowing  file  types.   The paths listed are the default paths for these
229       file types.  Note the processes UID still need to have DAC permissions.
230
231       cifs_t
232
233
234       ecryptfs_t
235
236            /home/[^/]+/.Private(/.*)?
237            /home/[^/]+/.ecryptfs(/.*)?
238
239       fusefs_t
240
241            /var/run/user/[^/]*/gvfs
242
243       nfs_t
244
245
246       ssh_home_t
247
248            /var/lib/[^/]+/.ssh(/.*)?
249            /root/.ssh(/.*)?
250            /var/lib/one/.ssh(/.*)?
251            /var/lib/pgsql/.ssh(/.*)?
252            /var/lib/openshift/[^/]+/.ssh(/.*)?
253            /var/lib/amanda/.ssh(/.*)?
254            /var/lib/stickshift/[^/]+/.ssh(/.*)?
255            /var/lib/gitolite/.ssh(/.*)?
256            /var/lib/nocpulse/.ssh(/.*)?
257            /var/lib/gitolite3/.ssh(/.*)?
258            /var/lib/openshift/gear/[^/]+/.ssh(/.*)?
259            /root/.shosts
260            /home/[^/]+/.ssh(/.*)?
261            /home/[^/]+/.ansible/cp/.*
262            /home/[^/]+/.shosts
263
264       ssh_tmpfs_t
265
266
267       user_fonts_cache_t
268
269            /root/.fontconfig(/.*)?
270            /root/.fonts/auto(/.*)?
271            /root/.fonts.cache-.*
272            /home/[^/]+/.fontconfig(/.*)?
273            /home/[^/]+/.fonts/auto(/.*)?
274            /home/[^/]+/.fonts.cache-.*
275
276       user_tmp_t
277
278            /dev/shm/mono.*
279            /var/run/user(/.*)?
280            /tmp/.X11-unix(/.*)?
281            /tmp/.ICE-unix(/.*)?
282            /dev/shm/pulse-shm.*
283            /tmp/.X0-lock
284            /tmp/hsperfdata_root
285            /var/tmp/hsperfdata_root
286            /home/[^/]+/tmp
287            /home/[^/]+/.tmp
288            /tmp/gconfd-[^/]+
289
290       user_tmp_type
291
292            all user tmp files
293
294       xserver_tmpfs_t
295
296
297

FILE CONTEXTS

299       SELinux requires files to have an extended attribute to define the file
300       type.
301
302       You can see the context of a file using the -Z option to ls
303
304       Policy  governs  the  access  confined  processes  have to these files.
305       SELinux ssh policy is very flexible allowing users to setup  their  ssh
306       processes in as secure a method as possible.
307
308       STANDARD FILE CONTEXT
309
310       SELinux  defines  the  file context types for the ssh, if you wanted to
311       store files with these types in a diffent paths, you  need  to  execute
312       the  semanage  command  to  sepecify  alternate  labeling  and then use
313       restorecon to put the labels on disk.
314
315       semanage fcontext -a -t sshd_var_run_t '/srv/myssh_content(/.*)?'
316       restorecon -R -v /srv/myssh_content
317
318       Note: SELinux often uses regular expressions  to  specify  labels  that
319       match multiple files.
320
321       The following file types are defined for ssh:
322
323
324
325       ssh_agent_exec_t
326
327       -  Set  files with the ssh_agent_exec_t type, if you want to transition
328       an executable to the ssh_agent_t domain.
329
330
331
332       ssh_agent_tmp_t
333
334       - Set files with the ssh_agent_tmp_t type, if you  want  to  store  ssh
335       agent temporary files in the /tmp directories.
336
337
338
339       ssh_exec_t
340
341       - Set files with the ssh_exec_t type, if you want to transition an exe‐
342       cutable to the ssh_t domain.
343
344
345       Paths:
346            /usr/bin/ssh, /usr/libexec/nm-ssh-service
347
348
349       ssh_home_t
350
351       - Set files with the ssh_home_t type, if you want to store ssh files in
352       the users home directory.
353
354
355       Paths:
356            /var/lib/[^/]+/.ssh(/.*)?,                       /root/.ssh(/.*)?,
357            /var/lib/one/.ssh(/.*)?, /var/lib/pgsql/.ssh(/.*)?, /var/lib/open‐
358            shift/[^/]+/.ssh(/.*)?,                /var/lib/amanda/.ssh(/.*)?,
359            /var/lib/stickshift/[^/]+/.ssh(/.*)?,               /var/lib/gito‐
360            lite/.ssh(/.*)?,    /var/lib/nocpulse/.ssh(/.*)?,   /var/lib/gito‐
361            lite3/.ssh(/.*)?,        /var/lib/openshift/gear/[^/]+/.ssh(/.*)?,
362            /root/.shosts, /home/[^/]+/.ssh(/.*)?, /home/[^/]+/.ansible/cp/.*,
363            /home/[^/]+/.shosts
364
365
366       ssh_keygen_exec_t
367
368       - Set files with the ssh_keygen_exec_t type, if you want to  transition
369       an executable to the ssh_keygen_t domain.
370
371
372
373       ssh_keygen_tmp_t
374
375       -  Set  files  with the ssh_keygen_tmp_t type, if you want to store ssh
376       keygen temporary files in the /tmp directories.
377
378
379
380       ssh_keysign_exec_t
381
382       - Set files with the ssh_keysign_exec_t type, if you want to transition
383       an executable to the ssh_keysign_t domain.
384
385
386       Paths:
387            /usr/lib/openssh/ssh-keysign, /usr/libexec/openssh/ssh-keysign
388
389
390       ssh_tmpfs_t
391
392       -  Set  files with the ssh_tmpfs_t type, if you want to store ssh files
393       on a tmpfs file system.
394
395
396
397       sshd_exec_t
398
399       - Set files with the sshd_exec_t type, if you  want  to  transition  an
400       executable to the sshd_t domain.
401
402
403       Paths:
404            /usr/sbin/sshd, /usr/sbin/gsisshd
405
406
407       sshd_initrc_exec_t
408
409       - Set files with the sshd_initrc_exec_t type, if you want to transition
410       an executable to the sshd_initrc_t domain.
411
412
413
414       sshd_key_t
415
416       - Set files with the sshd_key_t type, if you want to treat the files as
417       sshd key data.
418
419
420       Paths:
421            /etc/ssh/ssh_host.*_key,              /etc/ssh/ssh_host.*_key.pub,
422            /etc/ssh/primes
423
424
425       sshd_keygen_exec_t
426
427       - Set files with the sshd_keygen_exec_t type, if you want to transition
428       an executable to the sshd_keygen_t domain.
429
430
431
432       sshd_keygen_unit_file_t
433
434       - Set files with the sshd_keygen_unit_file_t type, if you want to treat
435       the files as sshd keygen unit content.
436
437
438
439       sshd_keytab_t
440
441       - Set files with the sshd_keytab_t type, if you want to treat the files
442       as kerberos keytab files.
443
444
445
446       sshd_tmpfs_t
447
448       - Set files with the sshd_tmpfs_t type, if you want to store sshd files
449       on a tmpfs file system.
450
451
452
453       sshd_unit_file_t
454
455       - Set files with the sshd_unit_file_t type, if you want  to  treat  the
456       files as sshd unit content.
457
458
459
460       sshd_var_run_t
461
462       - Set files with the sshd_var_run_t type, if you want to store the sshd
463       files under the /run or /var/run directory.
464
465
466       Paths:
467            /var/run/sshd.pid, /var/run/sshd.init.pid
468
469
470       Note: File context can be temporarily modified with the chcon  command.
471       If  you want to permanently change the file context you need to use the
472       semanage fcontext command.  This will modify the SELinux labeling data‐
473       base.  You will need to use restorecon to apply the labels.
474
475

COMMANDS

477       semanage  fcontext  can also be used to manipulate default file context
478       mappings.
479
480       semanage permissive can also be used to manipulate  whether  or  not  a
481       process type is permissive.
482
483       semanage  module can also be used to enable/disable/install/remove pol‐
484       icy modules.
485
486       semanage port can also be used to manipulate the port definitions
487
488       semanage boolean can also be used to manipulate the booleans
489
490
491       system-config-selinux is a GUI tool available to customize SELinux pol‐
492       icy settings.
493
494

AUTHOR

496       This manual page was auto-generated using sepolicy manpage .
497
498