#
# Macros for ssh agent
#

#
# Author:  Russell Coker <russell@coker.com.au>
#

# 
# ssh_agent_domain(domain_prefix)
#
# Define a derived domain for the ssh program when executed
# by a user domain.
#
# The type declaration for the executable type for this program is
# provided separately in domains/program/ssh.te. 
#
define(`ssh_agent_domain',`
# Define a derived domain for the ssh-agent program when executed
# by a user domain.
# Derived domain based on the calling user domain and the program.
type $1_ssh_agent_t, domain, privlog;

# Transition from the user domain to the derived domain.
domain_auto_trans($1_t, ssh_agent_exec_t, $1_ssh_agent_t)

# The user role is authorized for this domain.
role $1_r types $1_ssh_agent_t;

allow $1_ssh_agent_t privfd:fd use;

# Write to the user domain tty.
allow $1_ssh_agent_t $1_tty_device_t:chr_file rw_file_perms;
allow $1_ssh_agent_t $1_devpts_t:chr_file rw_file_perms;

# Allow the user shell to signal the ssh program.
allow $1_t $1_ssh_agent_t:process signal;
# allow ps to show ssh
can_ps($1_t, $1_ssh_agent_t)

dontaudit $1_ssh_agent_t proc_t:dir { search };

can_ypbind($1_ssh_agent_t)
ifdef(`nfs_home_dirs', `
ifdef(`automount.te', `
allow $1_ssh_agent_t autofs_t:dir { search getattr };
')
rw_dir_create_file($1_ssh_agent_t, nfs_t)
can_exec($1_ssh_agent_t, nfs_t)
')dnl end nfs_home_dirs

uses_shlib($1_ssh_agent_t)
read_locale($1_ssh_agent_t)

# Access the ssh temporary files. Should we have an own type here
# to which only ssh, ssh-agent and ssh-add have access?
allow $1_ssh_agent_t $1_tmp_t:dir r_dir_perms;
file_type_auto_trans($1_ssh_agent_t, tmp_t, $1_tmp_t)
allow $1_ssh_agent_t self:unix_stream_socket create_stream_socket_perms;
allow $1_ssh_agent_t self:unix_dgram_socket create_socket_perms;

allow $1_ssh_agent_t self:process { fork sigchld setrlimit };

# access the random devices
allow $1_ssh_agent_t { random_device_t urandom_device_t }:chr_file read;

# for ssh-add
can_unix_connect($1_t, $1_ssh_agent_t)

# transition back to normal privs upon exec
domain_auto_trans($1_ssh_agent_t, { bin_t shell_exec_t }, $1_t)
allow $1_ssh_agent_t bin_t:dir search;

# allow reading of /usr/bin/X11 (is a symlink)
allow $1_ssh_agent_t bin_t:lnk_file read;

allow $1_ssh_agent_t { $1_ssh_agent_t $1_t }:process signull;

allow $1_ssh_agent_t { home_root_t $1_home_dir_t }:dir search;
allow $1_ssh_agent_t $1_home_t:file { getattr write append };

allow $1_ssh_t $1_tmp_t:sock_file write;
allow $1_ssh_t $1_t:unix_stream_socket connectto;
allow $1_ssh_t $1_ssh_agent_t:unix_stream_socket connectto;

# Allow the ssh program to communicate with ssh-agent.
allow $1_ssh_t $1_tmp_t:sock_file write;
allow $1_ssh_t $1_t:unix_stream_socket connectto;
allow $1_ssh_t sshd_t:unix_stream_socket connectto;
')dnl end if ssh_agent