Bug 2525528
| Summary: | SELinux denies sshd_session_t name_connect to ephemeral_port_t, breaking SSH dynamic port forwarding | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Elias <elias.skogevall.alt> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | dwalsh, edgar.hoch, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-44.9-1.fc44 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-09-16 00:54:28 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
See also bug 2507582. FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892 FEDORA-2026-1413268892 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1413268892` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: After updating to selinux-policy-44.7-1.fc44 (which removed the permissive setting for sshd_auth_t and sshd_session_t), SSH dynamic port forwarding (ssh -D) stopped working. This breaks tools that rely on dynamic forwarding, including VS Code's Remote-SSH extension. Version-Release number of selected component (if applicable): selinux-policy-44.7-1.fc44 / selinux-policy-targeted-44.7-1.fc44 How reproducible: Always. Steps to Reproduce: 1. On Fedora 44 with selinux-policy-targeted-44.7-1 or later, start an SSH connection using dynamic port forwarding: ssh -D <port> <host> 2. Have the remote side attempt to bind/connect out on an ephemeral port (e.g. a remote dev server or, in my case, VS Code Server's own listener) via the forwarded SOCKS tunnel 3. The connection through the tunnel fails with channel <N>: open failed: connect failed: open failed Actual results: The forwarded connection is silently blocked at the SELinux layer. sshd itself is correctly configured (AllowTcpForwarding yes, confirmed via sshd -T), and no relevant boolean exists to toggle this (checked getsebool -a | grep ssh). Expected results: Dynamic port forwarding should succeed, as it did before this policy update. Additional info: AVC denials: type=AVC msg=audit(1787912637.360:1469): avc: denied { name_connect } for pid=78097 comm="sshd-session" dest=44717 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0 From selinux-policy-targeted changelog - Remove permissive setting for sshd_auth_t and sshd_session_t Workaround: sudo ausearch -m avc -ts recent | audit2allow -M ssh_dynamic_forward sudo semodule -i ssh_dynamic_forward.pp Generated .te file: module ssh_dynamic_forward 1.0; require { type sshd_session_t; type ephemeral_port_t; class tcp_socket name_connect; } #============= sshd_session_t ============== #!!!! This avc can be allowed using the boolean 'nis_enabled' allow sshd_session_t ephemeral_port_t:tcp_socket name_connect;