Bug 224437
| Summary: | AVC denials prevent remote SSH logins | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel Berrangé <berrange> |
| Component: | selinux-policy-targeted | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED RAWHIDE | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-08-01 18:52:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Fixed in selinux-policy-2.5.2-1.fc7 Was fixed a while ago... |
Description of problem: ssh root@[removed hostname] /bin/bash: Permission denied Connection to [removed hostname] closed. Looking in the /var/log/audit/audit.log file after this failure I see: type=AVC msg=audit(1169748817.951:110): avc: denied { entrypoint } for pid=2671 comm="sshd" name="bash" dev=dm-0 ino=17305623 scontext=root:system_r:system_chkpwd_t:s0-s0:c0.c255 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file type=AVC_PATH msg=audit(1169748817.951:110): path="/bin/bash" I am logging in using SSH agent, but logging in with passwords fails too. Version-Release number of selected component (if applicable): checkpolicy-1.33.1-2.fc7 policycoreutils-1.34.1-3.fc7 selinux-policy-2.5.1-5.fc7 selinux-policy-targeted-2.5.1-5.fc7 The rest of the machine is updated to rawhide as of 11 EST Jan 25 How reproducible: All remote ssh logins Steps to Reproduce: 1. Boot host with SELinux enabled & sshd running 2. Attempt to login in remotely with SSH 3. Actual results: The connection is dropped Expected results: Login completes Additional info: I have checked the SSH daemon is running in the sshd_t domain: system_u:system_r:sshd_t:SystemLow-SystemHigh root 2028 0.0 0.0 44296 1096 ? Ss 13:12 0:00 /usr/sbin/sshd And have rebooted & done a full filesystem re-label several times over.