Attachment 605512 Details for Bug 849454 – File: description

File: description

description (text/plain), 4.03 KB, created by lhs on 2012-08-19 15:24:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: lhs

Created: 2012-08-19 15:24:34 UTC

Size: 4.03 KB

patch

obsolete

>SELinux is preventing /usr/sbin/sshd from 'open' accesses on the file /part2/lhs/.ssh/authorized_keys.
>
>*****  Plugin catchall_labels (83.8 confidence) suggests  ********************
>
>If you want to allow sshd to have open access on the authorized_keys file
>Then you need to change the label on /part2/lhs/.ssh/authorized_keys
>Do
># semanage fcontext -a -t FILE_TYPE '/part2/lhs/.ssh/authorized_keys'
>where FILE_TYPE is one of the following: xauth_exec_t, auth_cache_t, ecryptfs_t, screen_exec_t, mount_exec_t, shell_exec_t, ssh_agent_exec_t, crack_db_t, krb5_home_t, passwd_exec_t, rssh_exec_t, ssh_home_t, sshd_key_t, krb5_conf_t, oddjob_mkhomedir_exec_t, dbusd_etc_t, samba_var_t, systemd_systemctl_exec_t, security_t, sshd_exec_t, abrt_t, samba_etc_t, ld_so_t, fusermount_exec_t, lib_t, faillog_t, net_conf_t, pam_exec_t, cpu_online_t, nx_server_home_ssh_t, lastlog_t, abrt_helper_exec_t, proc_net_t, rssh_ro_t, proc_afs_t, chkpwd_exec_t, updpwd_exec_t, etc_runtime_t, condor_var_lib_t, user_home_type, configfile, openct_var_run_t, domain, initrc_var_run_t, samba_etc_t, pcscd_var_run_t, pam_var_run_t, sshd_var_run_t, textrel_shlib_t, systemd_logind_var_run_t, user_tmp_type, sysctl_kernel_t, rpm_script_tmp_t, mount_ecryptfs_exec_t, ld_so_cache_t, systemd_logind_sessions_t, system_dbusd_var_lib_t, etc_t, cert_t, selinux_config_t, machineid_t, gitosis_var_lib_t, sshd_tmpfs_t, ssh_home_t, default_context_t, sssd_public_t, abrt_var_run_t, rlogind_home_t, nx_server_exec_t, cgroup_t, locale_t, var_auth_t, etc_t, bin_t, cert_t, proc_t, init_t, sysfs_t, sshd_t, usr_t, krb5_keytab_t, wtmp_t, fail2ban_var_lib_t, sysctl_crypto_t, passwd_file_t, krb5_conf_t, user_tmp_t, sshd_keytab_t, auth_home_t, security_t, root_t, file_context_t, krb5_host_rcache_t, shell_exec_t. 
>Then execute: 
>restorecon -v '/part2/lhs/.ssh/authorized_keys'
>
>
>*****  Plugin catchall (17.1 confidence) suggests  ***************************
>
>If you believe that sshd should be allowed open access on the authorized_keys file by default.
>Then you should report this as a bug.
>You can generate a local policy module to allow this access.
>Do
>allow this access for now by executing:
># grep sshd /var/log/audit/audit.log | audit2allow -M mypol
># semodule -i mypol.pp
>
>Additional Information:
>Source Context                system_u:system_r:sshd_t:s0-s0:c0.c1023
>Target Context                system_u:object_r:default_t:s0
>Target Objects                /part2/lhs/.ssh/authorized_keys [ file ]
>Source                        sshd
>Source Path                   /usr/sbin/sshd
>Port                          <Unknown>
>Host                          (removed)
>Source RPM Packages           openssh-server-5.9p1-22.fc17.i686
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.10.0-145.fc17.noarch
>Selinux Enabled               True
>Policy Type                   targeted
>Enforcing Mode                Enforcing
>Host Name                     (removed)
>Platform                      Linux (removed) 3.5.2-1.fc17.i686.PAE #1 SMP Wed
>                              Aug 15 16:30:14 UTC 2012 i686 i686
>Alert Count                   1
>First Seen                    2012-08-19 23:21:03 SGT
>Last Seen                     2012-08-19 23:21:03 SGT
>Local ID                      3120be9f-3fda-470f-9042-84d125f2a68a
>
>Raw Audit Messages
>type=AVC msg=audit(1345389663.895:403): avc:  denied  { open } for  pid=9424 comm="sshd" path="/part2/lhs/.ssh/authorized_keys" dev="sda8" ino=1700931 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=file
>
>
>type=SYSCALL msg=audit(1345389663.895:403): arch=i386 syscall=open success=no exit=EACCES a0=b95c04a8 a1=8800 a2=0 a3=b95c04a8 items=0 ppid=664 pid=9424 auid=4294967295 uid=0 gid=0 euid=1000 suid=0 fsuid=1000 egid=1000 sgid=0 fsgid=1000 tty=(none) ses=4294967295 comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>
>Hash: sshd,sshd_t,default_t,file,open
>
>audit2allow
>
>#============= sshd_t ==============
>allow sshd_t default_t:file open;
>
>audit2allow -R
>
>#============= sshd_t ==============
>allow sshd_t default_t:file open;
>

Actions: View

Attachments on bug 849454: 605512