[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/

[Kenton Groombridge]

commit:     b2ceb53d4b7b1df545f740ae9b4ed2e77f640dca
Author:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
AuthorDate: Mon May  6 19:53:46 2024 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Tue May 14 17:41:31 2024 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b2ceb53d

init: allow systemd to use sshd pidfds

Without this, a lengthy 2 minute delay can be observed SSHing into a
system while pam_systemd tries to create a login session.

May 06 14:22:08 megumin.fuwafuwatime.moe sshd[29384]: 
pam_systemd(sshd:session): Failed to create session: Connection timed out

type=AVC msg=audit(1715019897.540:13855): avc:  denied  { use } for  pid=1 
comm="systemd" path="anon_inode:[pidfd]" dev="anon_inodefs" ino=10 
scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:sshd_t:s0 
tclass=fd permissive=1

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/services/ssh.if | 19 +++++++++++++++++++
 policy/modules/system/init.te  |  4 ++++
 2 files changed, 23 insertions(+)

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index dcbabf6b0..4b5fd5d33 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -535,6 +535,25 @@ interface(`ssh_signull',`
        allow $1 sshd_t:process signull;
 ')
 
+########################################
+## <summary>
+##     Use PIDFD file descriptors from the
+##     ssh server.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`ssh_use_sshd_pidfds',`
+       gen_require(`
+               type sshd_t;
+       ')
+
+       allow $1 sshd_t:fd use;
+')
+
 ########################################
 ## <summary>
 ##     Read a ssh server unnamed pipe.

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 8f3772dcb..03d0de8ed 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -630,6 +630,10 @@ ifdef(`init_systemd',`
                fs_rw_rpc_named_pipes(initrc_t)
        ')
 
+       optional_policy(`
+               ssh_use_sshd_pidfds(init_t)
+       ')
+
        optional_policy(`
                # for systemd --user:
                unconfined_search_keys(init_t)