--- nsaserefpolicy/policy/modules/services/ssh.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ssh.fc	2008-08-14 13:53:54.000000000 -0400
@@ -1,4 +1,4 @@
-HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ROLE_home_ssh_t,s0)
+HOME_DIR/\.ssh(/.*)?			gen_context(system_u:object_r:ssh_home_t,s0)
 
 /etc/ssh/primes			--	gen_context(system_u:object_r:sshd_key_t,s0)
 /etc/ssh/ssh_host_key 		--	gen_context(system_u:object_r:sshd_key_t,s0)
--- nsaserefpolicy/policy/modules/services/ssh.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ssh.if	2008-08-14 13:53:54.000000000 -0400
@@ -36,6 +36,7 @@
 	gen_require(`
 		attribute ssh_server;
 		type ssh_exec_t, sshd_key_t, sshd_tmp_t;
+		type ssh_home_t, ssh_tmp_t;
 	')
 
 	##############################
@@ -47,8 +48,9 @@
 	application_domain($1_ssh_t, ssh_exec_t)
 	role $3 types $1_ssh_t;
 
-	type $1_home_ssh_t;
-	files_type($1_home_ssh_t)
+	typealias ssh_home_t alias $1_ssh_home_t;
+	typealias ssh_home_t alias $1_home_ssh_t;
+	typealias ssh_tmp_t alias $1_ssh_tmp_t;
 
 	##############################
 	#
@@ -93,18 +95,18 @@
 	ps_process_pattern($2, $1_ssh_t)
 
 	# user can manage the keys and config
-	manage_files_pattern($2, $1_home_ssh_t, $1_home_ssh_t)
-	manage_lnk_files_pattern($2, $1_home_ssh_t, $1_home_ssh_t)
-	manage_sock_files_pattern($2, $1_home_ssh_t, $1_home_ssh_t)
+	manage_files_pattern($2, ssh_home_t, ssh_home_t)
+	manage_lnk_files_pattern($2, ssh_home_t, ssh_home_t)
+	manage_sock_files_pattern($2, ssh_home_t, ssh_home_t)
 
 	# ssh client can manage the keys and config
-	manage_files_pattern($1_ssh_t, $1_home_ssh_t, $1_home_ssh_t)
-	read_lnk_files_pattern($1_ssh_t, $1_home_ssh_t, $1_home_ssh_t)
+	manage_files_pattern($1_ssh_t, ssh_home_t, ssh_home_t)
+	read_lnk_files_pattern($1_ssh_t, ssh_home_t, ssh_home_t)
 
 	# ssh servers can read the user keys and config
-	allow ssh_server $1_home_ssh_t:dir list_dir_perms;
-	read_files_pattern(ssh_server, $1_home_ssh_t, $1_home_ssh_t)
-	read_lnk_files_pattern(ssh_server, $1_home_ssh_t, $1_home_ssh_t)
+	allow ssh_server ssh_home_t:dir list_dir_perms;
+	read_files_pattern(ssh_server, ssh_home_t, ssh_home_t)
+	read_lnk_files_pattern(ssh_server, ssh_home_t, ssh_home_t)
 
 	kernel_read_kernel_sysctls($1_ssh_t)
 
@@ -212,7 +214,7 @@
 
 	ssh_basic_client_template($1, $2, $3)
 
-	userdom_user_home_content($1, $1_home_ssh_t)
+	userdom_user_home_content($1, ssh_home_t)
 
 	type $1_ssh_agent_t;
 	application_domain($1_ssh_agent_t, ssh_agent_exec_t)
@@ -240,9 +242,9 @@
 	manage_sock_files_pattern($1_ssh_t, $1_ssh_tmpfs_t, $1_ssh_tmpfs_t)
 	fs_tmpfs_filetrans($1_ssh_t, $1_ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
-	manage_dirs_pattern($1_ssh_t, $1_home_ssh_t, $1_home_ssh_t)
-	manage_sock_files_pattern($1_ssh_t, $1_home_ssh_t, $1_home_ssh_t)
-	userdom_user_home_dir_filetrans($1, $1_ssh_t, $1_home_ssh_t, { dir sock_file })
+	manage_dirs_pattern($1_ssh_t, ssh_home_t, ssh_home_t)
+	manage_sock_files_pattern($1_ssh_t, ssh_home_t, ssh_home_t)
+	userdom_user_home_dir_filetrans($1, $1_ssh_t, ssh_home_t, { dir sock_file })
 
 	# Allow the ssh program to communicate with ssh-agent.
 	stream_connect_pattern($1_ssh_t, $1_ssh_agent_tmp_t, $1_ssh_agent_tmp_t, $1_ssh_agent_t)
@@ -413,6 +415,25 @@
 	')
 ')
 
+########################################
+## <summary>
+##	Execute the ssh agent client in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_agent_exec',`
+	gen_require(`
+		type ssh_agent_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, ssh_agent_exec_t)
+')
+
 #######################################
 ## <summary>
 ##	The template to define a ssh server.
@@ -443,13 +464,14 @@
 	type $1_var_run_t;
 	files_pid_file($1_var_run_t)
 
-	allow $1_t self:capability { kill sys_chroot sys_resource chown dac_override fowner fsetid setgid setuid sys_tty_config };
+	allow $1_t self:capability { kill sys_chroot sys_resource chown dac_override fowner fsetid net_admin setgid setuid sys_tty_config };
 	allow $1_t self:fifo_file rw_fifo_file_perms;
 	allow $1_t self:process { signal setsched setrlimit setexec };
 	allow $1_t self:tcp_socket create_stream_socket_perms;
 	allow $1_t self:udp_socket create_socket_perms;
 	# ssh agent connections:
 	allow $1_t self:unix_stream_socket create_stream_socket_perms;
+	allow $1_t self:shm create_shm_perms;
 
 	allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr getattr relabelfrom };
 	term_create_pty($1_t,$1_devpts_t)
@@ -479,6 +501,10 @@
 	corenet_tcp_bind_ssh_port($1_t)
 	corenet_tcp_connect_all_ports($1_t)
 	corenet_sendrecv_ssh_server_packets($1_t)
+	# -R qualifier
+	corenet_sendrecv_ssh_server_packets($1_t)
+	# tunnel feature and -w (net_admin capability also)
+	corenet_rw_tun_tap_dev($1_t)
 
 	fs_dontaudit_getattr_all_fs($1_t)
 
@@ -506,9 +532,14 @@
 
 	userdom_dontaudit_relabelfrom_unpriv_users_ptys($1_t)
 	userdom_search_all_users_home_dirs($1_t)
+	userdom_read_all_users_home_content_files($1_t)
+
+	# Allow checking users mail at login
+	mta_getattr_spool($1_t)
 
 	tunable_policy(`use_nfs_home_dirs',`
 		fs_read_nfs_files($1_t)
+		fs_read_nfs_symlinks($1_t)
 	')
 
 	tunable_policy(`use_samba_home_dirs',`
@@ -517,11 +548,7 @@
 
 	optional_policy(`
 		kerberos_use($1_t)
-	')
-
-	optional_policy(`
-		# Allow checking users mail at login
-		mta_getattr_spool($1_t)
+		kerberos_manage_host_rcache($1_t)
 	')
 
 	optional_policy(`
@@ -710,3 +737,22 @@
 
 	dontaudit $1 sshd_key_t:file { getattr read };
 ')
+
+#######################################
+## <summary>
+##	Delete from the ssh temp files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`ssh_delete_tmp',`
+	gen_require(`
+		type ssh_tmp_t;
+	')
+
+	files_search_tmp($1)
+	delete_files_pattern($1, ssh_tmp_t, ssh_tmp_t)
+')
--- nsaserefpolicy/policy/modules/services/ssh.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/ssh.te	2008-08-14 13:53:54.000000000 -0400
@@ -24,7 +24,7 @@
 
 # Type for the ssh-agent executable.
 type ssh_agent_exec_t;
-files_type(ssh_agent_exec_t)
+application_executable_file(ssh_agent_exec_t)
 
 # ssh client executable.
 type ssh_exec_t;
@@ -57,6 +57,12 @@
 	init_ranged_daemon_domain(sshd_t,sshd_exec_t,s0 - mcs_systemhigh)
 ')
 
+type ssh_home_t;
+userdom_user_home_content(user, ssh_home_t)
+
+type ssh_tmp_t;
+files_tmp_file(ssh_tmp_t)
+
 #################################
 #
 # sshd local policy
@@ -80,6 +86,9 @@
 corenet_tcp_bind_xserver_port(sshd_t)
 corenet_sendrecv_xserver_server_packets(sshd_t)
 
+userdom_read_all_users_home_content_files(sshd_t)
+userdom_read_all_users_home_content_symlinks(sshd_t)
+
 tunable_policy(`ssh_sysadm_login',`
 	# Relabel and access ptys created by sshd
 	# ioctl is necessary for logout() processing for utmp entry and for w to
@@ -101,6 +110,14 @@
 ')
 
 optional_policy(`
+	kerberos_keytab_template(sshd, sshd_t)
+')
+
+optional_policy(`
+	xserver_getattr_xauth(sshd_t)
+')
+
+optional_policy(`
 	daemontools_service_domain(sshd_t, sshd_exec_t)
 ')
 
@@ -119,7 +136,11 @@
 ')
 
 optional_policy(`
-	unconfined_domain(sshd_t)
+	usermanage_domtrans_passwd(sshd_t)
+	usermanage_read_crack_db(sshd_t)
+')
+
+optional_policy(`
 	unconfined_shell_domtrans(sshd_t)
 ')
 
