Bug 2529069

Summary: selinux blocking podman remote ssh connections
Product: [Fedora] Fedora Reporter: Dusty Mabe <dustymabe>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 45CC: dwalsh, kparal, lvrabec, mmalik, omosnacek, pkoncity, travier, vmojzis, zpytela
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
URL: https://github.com/fedora-selinux/selinux-policy/issues/3392
Whiteboard: AcceptedFreezeException
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-30 11:37:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2406955    

Description Dusty Mabe 2026-09-05 14:16:17 UTC 
Some more details in: https://github.com/coreos/fedora-coreos-tracker/issues/2217

selinux-policy-45.14-1.fc45 podman-5:6.1.0-2.fc45

Can't connect via ssh to a podman socket:

```
06:30:04  Sep 05 06:30:02 qemu0 kola-runext-test.sh[2057]: type=AVC msg=audit(1788589801.875:635): avc:  denied  { write } for  pid=2055 comm="sshd-session" name="podman.sock" dev="tmpfs" ino=2593 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0
```

Reproducible: Always

Steps to Reproduce:
See the test steps in https://github.com/coreos/fedora-coreos-config/commit/96b60c5073af2b5edd3f51fe9173d5225c96bf76



sudo systemctl start podman.socket
ssh-keygen
cat ~/.ssh/id_ed25519.pub | sudo tee -a /root/.ssh/authorized_keys

export CONTAINER_HOST=ssh://root@localhost
export CONTAINER_SSHKEY="${HOME}/.ssh/id_ed25519"
podman info

> gives a failure "Cannot connect to Podman. Please verify your connection to the Linux system"
> where `ssh -i $CONTAINER_SSHKEY root@localhost id` works fine


Actual Results:

sudo ausearch -m avc gives:

```
time->Sat Sep  5 14:13:23 2026
type=AVC msg=audit(1788617603.543:620): avc:  denied  { write } for  pid=2323 comm="sshd-session" name="podman.sock" dev="tmpfs" ino=2978 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0
```


Expected Results:
Successful connection.
Comment 1 Fedora Blocker Bugs Application 2026-09-05 14:17:18 UTC 
Proposed as a Freeze Exception for 45-beta by Fedora user dustymabe using the blocker tracking app because:

 Would be good to get podman remote connections fixed before shipping F45 since some people rely on these workflows.
Comment 2 Lukas Ruzicka (Red Hat) 2026-09-07 17:44:28 UTC 
AGREED Delayed Decision (Punt)

Discussed at the 2026-09-07 (blocker / freeze exception) review meeting:

We're not sure why this needs to break the freeze. We've asked for more details.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-09-07/f45-blocker-review.2026-09-07-16.01.log.txt
Comment 3 Kamil Páral (Red Hat) 2026-09-08 06:52:23 UTC 
Switching to a Final freeze exception based on https://forge.fedoraproject.org/quality/blocker-review/issues/2171#issuecomment-1354347
Comment 4 Lukas Ruzicka (Red Hat) 2026-09-14 17:38:20 UTC 
AGREED AcceptedFinalFreezeException

Discussed at the 2026-09-14 (blocker / freeze exception) review meeting:

This is accepted as it affects functionality that may be used at release.

https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-09-14/f45-blocker-review.2026-09-14-16.01.log.txt
Comment 5 Zdenek Pytela 2026-09-16 14:59:51 UTC 
Should be fixed in container-selinux-2.251.0-1 for all supported releases

Refer to
https://bugzilla.redhat.com/show_bug.cgi?id=2407417
Comment 6 Timothée Ravier 2026-10-12 16:09:30 UTC 
I'm re-opening this one as it's not a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=2407417 and discussion is still in progress in https://github.com/fedora-selinux/selinux-policy/issues/3392.

https://github.com/containers/container-selinux/pull/486 sounds related but would not fix the issue.