Bug 691046

Summary: AVC denial when logging into ssh running on non-standard port
Product: Red Hat Enterprise Linux 6 Reporter: Miroslav Vadkerti <mvadkert>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: high    
Version: 6.1CC: dwalsh, mgrepl
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-28 09:13:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Miroslav Vadkerti 2011-03-26 12:09:54 UTC
Description of problem:
When logging into openssh running on an non-standard port I fail to login as any user. I used semanage to add the non-standard port to selinux.

The denial I see:
time->Sat Mar 26 08:05:09 2011
type=SYSCALL msg=audit(1301141109.143:418): arch=c000003e syscall=59 success=yes exit=0 a0=7f5e74e90c78 a1=7fffe01b4310 a2=7f5e75096e88 a3=7 items=0 ppid=4960 pid=4962 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1301141109.143:418): avc:  denied  { noatsecure } for  pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process
type=AVC msg=audit(1301141109.143:418): avc:  denied  { siginh } for  pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process
type=AVC msg=audit(1301141109.143:418): avc:  denied  { rlimitinh } for  pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-78.el6.noarch

How reproducible:
100%

Steps to Reproduce:
# semanage port -a -t ssh_port_t -p tcp 133
# /usr/sbin/sshd -p133
# ssh -p133 tester@localhost
Connection closed
# ssh -p133 root@localhost
Connection closed
  
Actual results:
Cannot connect

Expected results:
Connection succeeds as with disabled selinux

Additional info:
I think this worked without issues a few releases back. When connecting to port 22 this works just fine.

Comment 1 Miroslav Grepl 2011-03-28 09:13:13 UTC
> Additional info:
> I think this worked without issues a few releases back. When connecting to port
> 22 this works just fine.

Are you sure?

# /usr/sbin/sshd -p133

causes the sshd service is running in the bad domain. You can check /var/log/secure and you will see

"Unable to get valid context for root"

So if you want to test it this way (without using a service script), you need to start the sshd service using

# runcon -r system_r -t initrc_t -- runcon -t sshd_t -- /usr/sbin/sshd -p133