| Summary: | .ssh/authorized_keys labeling problem | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Honggang LI <honli> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | Milos Malik <mmalik> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 6.1 | CC: | dwalsh, mmalik | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-10-12 18:24:24 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Attachments: |
|
||||||
|
Description
Honggang LI
2011-10-11 02:10:19 UTC
I don't see how /root/.ssh dir is created from the attached xml. If you create it by hand # mkdir /root/.ssh then you need to run restorecon. Hi, Miroslav /root/.ssh was created by the kickstart script, not the attached xml. /sbin/restorecon -R -v /root fix the issue. However, even without run restorecon ,these is no avc error when I run the test manually. Then this kickstart should contain [ -x /sbin/restorecon ] && /sbin/restorecon /root/.ssh in the %post. How do you run it manually? Which steps? In fact, the error message arose when the test script setup passwordless ssh-connections with an auto-expect script. But there is no avc error when I executed 'ssh_copy_id_exp rdma1' manually.
###### script trigger avc error #########
function ssh_copy_id_exp {
TARGET_HOST=$1 # $1=rdma1
/usr/bin/expect << EOF
set force_conservative 0 ;# set to 1 to force conservative mode even if
;# script wasn't run conservatively originally
if {\$force_conservative} {
set send_slow {1 .1}
proc send {ignore arg} {
sleep .1
exp_send -s -- \$arg
}
}
set timeout -1
spawn ssh-copy-id ${TARGET_HOST}
match_max 100000
expect -exact "root@${TARGET_HOST}'s password: "
send -- "xxxxxx\r"
expect eof
EOF
}
ssh_copy_id_exp rdma1
Sorry for the typo, I executed manually 'ssh_copy_id rdma1', not 'ssh_copy_id_exp rdma1'. ssh-copy-id contains "restorecon" so this is reason why it works. However, as comment #5 saying, the auto-expect script call ssh-copy-id too. As the avc error message can be eliminated with '/sbin/restorecon', it is ok to close the bug. I will run restorecon with the kickstart post script, when I run multi-hosts test which need ssh-connections. Are we talking about the same host? Yes, all of the automatic tests run on rdma1.rhts.eng.bos.redhat.com and rdma2.rhts.eng.bos.redhat.com. Ok, I would say to leave restorecon in the %post. Could you send the kickstart? the main kickstart file: http://download.lab.bos.redhat.com/qa/rhts/lookaside/rdma-testing/rdma-setup.sh And I attached a few kickstart statement in the beaker job xml file. |