| Summary: | AVC denial when logging into ssh running on non-standard port | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Miroslav Vadkerti <mvadkert> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.1 | CC: | dwalsh, mgrepl |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-03-28 09:13:13 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
> Additional info:
> I think this worked without issues a few releases back. When connecting to port
> 22 this works just fine.
Are you sure?
# /usr/sbin/sshd -p133
causes the sshd service is running in the bad domain. You can check /var/log/secure and you will see
"Unable to get valid context for root"
So if you want to test it this way (without using a service script), you need to start the sshd service using
# runcon -r system_r -t initrc_t -- runcon -t sshd_t -- /usr/sbin/sshd -p133
|
Description of problem: When logging into openssh running on an non-standard port I fail to login as any user. I used semanage to add the non-standard port to selinux. The denial I see: time->Sat Mar 26 08:05:09 2011 type=SYSCALL msg=audit(1301141109.143:418): arch=c000003e syscall=59 success=yes exit=0 a0=7f5e74e90c78 a1=7fffe01b4310 a2=7f5e75096e88 a3=7 items=0 ppid=4960 pid=4962 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1301141109.143:418): avc: denied { noatsecure } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1301141109.143:418): avc: denied { siginh } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1301141109.143:418): avc: denied { rlimitinh } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-78.el6.noarch How reproducible: 100% Steps to Reproduce: # semanage port -a -t ssh_port_t -p tcp 133 # /usr/sbin/sshd -p133 # ssh -p133 tester@localhost Connection closed # ssh -p133 root@localhost Connection closed Actual results: Cannot connect Expected results: Connection succeeds as with disabled selinux Additional info: I think this worked without issues a few releases back. When connecting to port 22 this works just fine.