diff --git a/policy/modules/contrib/virt.te b/policy/modules/contrib/virt.te index d41ed65624..dafc98d4d6 100644 --- a/policy/modules/contrib/virt.te +++ b/policy/modules/contrib/virt.te @@ -2308,7 +2308,7 @@ optional_policy(` optional_policy(` ssh_domtrans_ssh(virtqemud_t) - ssh_signal(virtqemud_t) + ssh_signal_ssh(virtqemud_t) ') optional_policy(` diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if index 1855c59b05..7a2bb985b8 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if @@ -676,6 +676,24 @@ interface(`ssh_exec',` can_exec($1, ssh_exec_t) ') +######################################## +## +## Send a generic signal to the ssh client domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`ssh_signal_ssh',` + gen_require(` + type ssh_t, ssh_exec_t; + ') + + allow $1 ssh_t:process signal; +') + ######################################## ## ## Execute the ssh client in the ssh client domain.