Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1046025 - /etc/ssh/ssh_host_ecdsa_key* have a worng etc_t type
Summary: /etc/ssh/ssh_host_ecdsa_key* have a worng etc_t type
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 18
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
Depends On: 1023945
TreeView+ depends on / blocked
Reported: 2013-12-23 09:16 UTC by Petr Lautrbach
Modified: 2014-02-05 23:25 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 1023945
Last Closed: 2014-02-05 23:25:24 UTC
Type: Bug

Attachments (Terms of Use)

Description Petr Lautrbach 2013-12-23 09:16:26 UTC
+++ This bug was initially created as a clone of Bug #1023945 +++

As of openssh-6.3p1-4.fc20.x86_64, we have EC activated and creating user keys works. But the host wide key /etc/ssh/ssh_host_ecdsa_key hasn't been created. 

--- Additional comment from Michal Jaegermann on 2013-12-22 00:48:09 CET ---

As an extra attraction I just updated a laptop which so far did not have ssh_host_ecdsa_key and ssh_host_ecdsa_key.pub files.  All *_key* files ended up with system_u:object_r:sshd_key_t:s0 selinux labels with a notable exception of ssh_host_ecdsa_key.pub.  The last one was created with system_u:object_r:etc_t:s0 for a lablel.  Is that really intended?


# rpm -q selinux-policy

# matchpathcon /etc/ssh/ssh_host_ecdsa_key*
/etc/ssh/ssh_host_ecdsa_key     system_u:object_r:etc_t:s0
/etc/ssh/ssh_host_ecdsa_key.pub system_u:object_r:etc_t:s0

Comment 1 Tom Hughes 2013-12-23 09:27:30 UTC
Well both things are true I think - it doesn't create it if the RSA and DSA keys already exist because of the conditions in the keygen unit and if the other reports are correct then when it does create it the label is wrong.

Comment 2 Lukas Vrabec 2013-12-23 13:57:47 UTC

I made fix for this.

commit f456fe2a952a9208927cad5a306bc27d87ffd014
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Mon Dec 23 14:54:24 2013 +0100

    Fixed labels for sshd keys

# matchpathcon /etc/ssh/ssh_host_ecdsa_key*
/etc/ssh/ssh_host_ecdsa_key     system_u:object_r:sshd_key_t:s0
/etc/ssh/ssh_host_ecdsa_key.pub system_u:object_r:sshd_key_t:s0

Comment 3 Fedora Update System 2014-01-09 19:08:11 UTC
selinux-policy-3.11.1-109.fc18 has been submitted as an update for Fedora 18.

Comment 4 Fedora Update System 2014-01-10 07:44:40 UTC
Package selinux-policy-3.11.1-109.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-109.fc18'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).

Comment 5 Fedora End Of Life 2014-02-05 23:25:24 UTC
Fedora 18 changed to end-of-life (EOL) status on 2014-01-14. Fedora 18 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.