Hide Forgot
Ansible is a tool to manage remote server with ssh, and in order to speed up connexion, use ssh ControlMaster socket. Since the fix for CVE-2013-4259 , Ansible create its ssh socket file in $HOME/.ansible/cp and no longer in /tmp, but when ansible is run by a confined user, the socket is not correctly labeled ( see 987554 ). This in turn trigger various AVC : type=AVC msg=audit(1378130462.857:11603): avc: denied { write } for pid=666 comm="ssh" name="cp" dev="dm-3" ino=4226381 scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=dir type=AVC msg=audit(1378124017.022:11490): avc: denied { add_name } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root.TwUf7jkog91WSPpk" scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=dir type=AVC msg=audit(1378124017.022:11490): avc: denied { create } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root.TwUf7jkog91WSPpk" scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=sock_file type=AVC msg=audit(1378124017.120:11491): avc: denied { link } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root.TwUf7jkog91WSPpk" dev="dm-3" ino=4226338 scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=sock_file type=AVC msg=audit(1378124017.120:11492): avc: denied { remove_name } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root.TwUf7jkog91WSPpk" dev="dm-3" ino=4226338 scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=dir type=AVC msg=audit(1378124017.120:11492): avc: denied { unlink } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root.TwUf7jkog91WSPpk" dev="dm-3" ino=4226338 scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=sock_file type=AVC msg=audit(1378124017.120:11493): avc: denied { write } for pid=20216 comm="ssh" name="ansible-ssh-janedoe.usersys.example.com-22-root" dev="dm-3" ino=4226338 scontext=staff_u:staff_r:ssh_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=sock_file Could the socket in $HOME/.ansible/cp be correctly labelled to be used as ssh socket ?
Would it make sense to label it ssh_home_t? chcon -R -t ssh_home_t ~/.ansible
I doubt, since there is more than ssh socket there. For example the default remote temporary directory is in ~/.ansible/tmp and i suspect that upstream may start to add more stuff there.
Well should .ansible be under ~/.config
Or can we get ansible to create the socket in ~/.ssh/
Or can we label ~/.ansible/cp as ssh_home_t.
I vote for the 3rd option, no need to modify upstream configuration. .ansible is not configuration, there is ~/.ansible.cfg for that. It could be under .local, but I suspect they want to support platform that predate the convention. I can ask to upstream to take a look at that bug if you want.
98126e4da70c2cd2a4853197fc43b7adb2d4f863 in git adds a label for ssh_home_t in ansible subdir HOME_DIR/\.ansible/cp/.* -s gen_context(system_u:object_r:ssh_home_t,s0) Also allows ssh_t to create ssh_home_t sock_files in user_home_t directories.
back ported.
selinux-policy-3.12.1-74.2.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-74.2.fc19
Package selinux-policy-3.12.1-74.2.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-74.2.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-16231/selinux-policy-3.12.1-74.2.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-74.2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.