Bug 560217

Summary:

SELinux is preventing the sshd from using potentially mislabeled files
(authorized_keys).

Detailed Description:

SELinux has denied sshd access to potentially mislabeled file(s)
(authorized_keys). This means that SELinux will not allow sshd to use these
files. It is common for users to edit files in their home directory or tmp
directories and then move (mv) them to system directories. The problem is that
the files end up with the wrong file context which confined applications are not
allowed to access.

Allowing Access:

If you want sshd to access this files, you need to relabel them using restorecon
-v 'authorized_keys'. You might want to relabel the entire directory using
restorecon -R -v ''.

Additional Information:

Source Context                system_u:system_r:sshd_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:admin_home_t:s0
Target Objects                authorized_keys [ file ]
Source                        sshd
Source Path                   /usr/sbin/sshd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           openssh-server-5.2p1-2.fc11
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.12-83.fc11
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   home_tmp_bad_labels
Host Name                     (removed)
Platform                      Linux (removed) 2.6.30.5-43.fc11.x86_64 #1 SMP Thu
                              Aug 27 21:39:52 EDT 2009 x86_64 x86_64
Alert Count                   3
First Seen                    Tue 29 Sep 2009 10:50:11 PM CEST
Last Seen                     Tue 29 Sep 2009 10:52:41 PM CEST
Local ID                      19203ba8-60e8-46b0-8297-c8bc4cc756cb
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1254257561.455:30652): avc:  denied  { read } for  pid=14233 comm="sshd" name="authorized_keys" dev=dm-1 ino=9454 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file

node=(removed) type=SYSCALL msg=audit(1254257561.455:30652): arch=c000003e syscall=2 success=no exit=-13 a0=7fd8704a7660 a1=800 a2=1 a3=7fd86fb5e7b0 items=0 ppid=1776 pid=14233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.6.12-83.fc11,home_tmp_bad_labels,sshd,sshd_t,admin_home_t,file,read
audit2allow suggests:

#============= sshd_t ==============
allow sshd_t admin_home_t:file read;