← Back to branch summary

~ubuntu-branches/ubuntu/wily/apparmor/wily

« back to all changes in this revision

Viewing changes to profiles/extras/usr.sbin.sshd

  • Committer: Bazaar Package Importer
  • Author(s): Kees Cook
  • Date: 2011-04-27 10:38:07 UTC
  • mfrom: (5.1.118 natty)
  • Revision ID: james.westby@ubuntu.com-20110427103807-ym3rhwys6o84ith0
Tags: 2.6.1-2
debian/copyright: clarify for some full organization names.

Show diffs side-by-side

added added

removed removed

Lines of Context:
profiles/extras/usr.sbin.sshd
1
 
# $Id: usr.sbin.sshd 290 2007-01-05 13:02:25Z seth_arnold $
2
 
# ------------------------------------------------------------------
3
 
#
4
 
#    Copyright (C) 2002-2005 Novell/SUSE
5
 
#
6
 
#    This program is free software; you can redistribute it and/or
7
 
#    modify it under the terms of version 2 of the GNU General Public
8
 
#    License published by the Free Software Foundation.
9
 
#
10
 
# ------------------------------------------------------------------
11
 
# will need to revalidate this profile once we finish re-architecting
12
 
# the change_hat patch.
13
 
#
14
 
# vim:syntax=apparmor
15
 
 
16
 
#include <tunables/global>
17
 
 
18
 
/usr/sbin/sshd {
19
 
  #include <abstractions/authentication>
20
 
  #include <abstractions/base>
21
 
  #include <abstractions/consoles>
22
 
  #include <abstractions/nameservice>
23
 
  #include <abstractions/wutmp>
24
 
 
25
 
  capability sys_chroot,
26
 
  capability sys_tty_config,
27
 
  capability net_bind_service,
28
 
  capability chown,
29
 
  capability fowner,
30
 
  capability kill,
31
 
  capability setgid,
32
 
  capability setuid,
33
 
 
34
 
  /dev/ptmx rw,
35
 
  /dev/urandom r,
36
 
  /etc/environment r,
37
 
  /etc/hosts.allow r,
38
 
  /etc/hosts.deny r,
39
 
  /etc/modules.conf r,
40
 
  /etc/ssh/* r,
41
 
  /usr/sbin/sshd mrix,
42
 
  /var/run w,
43
 
  /var/run/sshd{,.init}.pid wl,
44
 
 
45
 
  /proc/[0-9]*/fd r,
46
 
  /proc/[0-9]*/loginuid w,
47
 
 
48
 
# should only be here for use in non-change-hat openssh
49
 
# duplicated from EXEC hat
50
 
  /bin/ash Ux,
51
 
  /bin/bash Ux,
52
 
  /bin/bash2 Ux,
53
 
  /bin/bsh Ux,
54
 
  /bin/csh Ux,
55
 
  /bin/ksh Ux,
56
 
  /bin/sh Ux,
57
 
  /bin/tcsh Ux,
58
 
  /bin/zsh Ux,
59
 
  /sbin/nologin Ux,
60
 
 
61
 
# Call passwd for password change when expired
62
 
#  /usr/bin/passwd Px,
63
 
 
64
 
 
65
 
# stuff duplicated from PRIVSEP_MONITOR
66
 
  @{HOME}/.ssh/authorized_keys{,2}         r,
67
 
 
68
 
  /dev/pts/[0-9]* rw,
69
 
  /etc/ssh/moduli r,
70
 
  /proc/sys/kernel/ngroups_max r,
71
 
  /proc/[0-9]*/mounts r,
72
 
 
73
 
# duplicated from AUTHENTICATED
74
 
  /etc/motd r,
75
 
  /tmp/ssh-*/agent.[0-9]* rwl,
76
 
 
77
 
  /tmp/ssh-*[0-9]* w,
78
 
 
79
 
#
80
 
# default subprofile for when sshd has authenticated the user
81
 
#
82
 
  ^EXEC {
83
 
    #include <abstractions/base>
84
 
 
85
 
    /bin/ash Ux,
86
 
    /bin/bash Ux,
87
 
    /bin/bash2 Ux,
88
 
    /bin/bsh Ux,
89
 
    /bin/csh Ux,
90
 
    /bin/ksh Ux,
91
 
    /bin/sh Ux,
92
 
    /bin/tcsh Ux,
93
 
    /bin/zsh Ux,
94
 
    /sbin/nologin Ux,
95
 
 
96
 
# for debugging
97
 
#  /dev/pts/[0-9]*                                              rw,
98
 
  }
99
 
 
100
 
#
101
 
# subprofile for handling network input (privilege seperated child)
102
 
#
103
 
  ^PRIVSEP {
104
 
    #include <abstractions/base>
105
 
    #include <abstractions/nameservice>
106
 
 
107
 
    capability sys_chroot,
108
 
    capability setuid,
109
 
    capability setgid,
110
 
 
111
 
# for debugging
112
 
#  /dev/pts/[0-9]*                                              rw,
113
 
  }
114
 
 
115
 
#
116
 
# subprofile that handles authentication requests from the privilege
117
 
# seperated child
118
 
#
119
 
  ^PRIVSEP_MONITOR {
120
 
    #include <abstractions/authentication>
121
 
    #include <abstractions/base>
122
 
    #include <abstractions/nameservice>
123
 
    #include <abstractions/wutmp>
124
 
 
125
 
 
126
 
    capability setuid,
127
 
    capability setgid,
128
 
    capability chown,
129
 
 
130
 
    @{HOME}/.ssh/authorized_keys{,2}         r,
131
 
    /dev/ptmx rw,
132
 
    /dev/pts/[0-9]* rw,
133
 
    /dev/urandom r,
134
 
    /etc/hosts.allow r,
135
 
    /etc/hosts.deny r,
136
 
    /etc/ssh/moduli r,
137
 
    /proc/sys/kernel/ngroups_max r,
138
 
    /proc/[0-9]*/mounts r,
139
 
 
140
 
# for debugging
141
 
#  /dev/pts/[0-9]*                                              rw,
142
 
  }
143
 
 
144
 
#
145
 
# subprofile for post-authentication period until the user's shell is spawned
146
 
#
147
 
  ^AUTHENTICATED {
148
 
    #include <abstractions/authentication>
149
 
    #include <abstractions/consoles>
150
 
    #include <abstractions/nameservice>
151
 
    #include <abstractions/wutmp>
152
 
 
153
 
    capability sys_tty_config,
154
 
    capability setgid,
155
 
    capability setuid,
156
 
 
157
 
    /dev/log  w,
158
 
    /dev/ptmx rw,
159
 
    /etc/default/passwd r,
160
 
    /etc/localtime r,
161
 
    /etc/login.defs r,
162
 
    /etc/motd r,
163
 
    /proc/sys/kernel/ngroups_max r,
164
 
    /tmp/ssh-*/agent.[0-9]* rwl,
165
 
 
166
 
# for debugging
167
 
#  /dev/pts/[0-9]*                                              rw,
168
 
  }
169
 
}