Skip to content

Instantly share code, notes, and snippets.

@alpozcan

alpozcan/vault-otp.te

Last active July 12, 2019 00:36
Show Gist options
  • Save alpozcan/cbe15d2b085f56090dff6da7a2b73587 to your computer and use it in GitHub Desktop.
Save alpozcan/cbe15d2b085f56090dff6da7a2b73587 to your computer and use it in GitHub Desktop.
Download ZIP
selinux-vault-otp
Raw
vault-otp.te
module vault-otp 1.0;
require {
type var_log_t;
type sshd_t;
type http_port_t;
class file open;
class file create;
class tcp_socket name_connect;
}
allow sshd_t var_log_t:file open;
allow sshd_t var_log_t:file create;
allow sshd_t http_port_t:tcp_socket name_connect;
# references:
# https://github.com/hashicorp/vault-ssh-helper/issues/31#issuecomment-335565489
# http://www.admin-magazine.com/Articles/Credential-management-with-HashiCorp-Vault/(offset)/3
@alpozcan
Copy link
Author

Compile and install as follows:

yum -y install selinux-policy-devel
make -f /usr/share/selinux/devel/Makefile vault-otp.pp
semodule -i vault-otp.pp

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment