Bug 694551

Summary: SSH login as sysadm_r is not allowed with ssh_sysadm_login SELinux boolean set in SELinux MLS policy
Product: Red Hat Enterprise Linux 6 Reporter: Ramon de Carvalho Valle <rcvalle>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: high    
Version: 6.1CC: dwalsh, ebenes, mmalik, mvadkert
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.7.19-84.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-05-19 12:27:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Ramon de Carvalho Valle 2011-04-07 16:02:31 UTC 
Description of problem:
SSH login as sysadm_r is not allowed with ssh_sysadm_login SELinux boolean set in SELinux MLS Policy.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 2 RHEL Program Management 2011-04-07 16:24:24 UTC 
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 3 Daniel Walsh 2011-04-07 16:44:02 UTC 
We need this modification in RHEL6 policy, to allow sshd to transition
to admin users if the boolean is turned on.

tunable_policy(`ssh_sysadm_login',`
	# Relabel and access ptys created by sshd
	# ioctl is necessary for logout() processing for utmp entry and for w to
	# display the tty.
	# some versions of sshd on the new SE Linux require setattr
	userdom_signal_all_users(sshd_t)
	userdom_spec_domtrans_all_users(sshd_t)
')
Comment 4 Miroslav Grepl 2011-04-11 10:11:17 UTC 
Fixed in selinux-policy-3.7.19-84.el6
Comment 7 errata-xmlrpc 2011-05-19 12:27:39 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0526.html