This bug was initially created as a copy of Bug #2053004 I am copying this bug because: Description of problem: The "unconfined_login" boolean is supposed to "allow users to login as an unconfined domain" (i.e. "unconfined_t"). Turning OFF this boolean doesn't seem to have any effect, at least on sshd: a user mapped to unconfined_u can still log in: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- $ ssh unconfined@vm-confined8 [unconfined@vm-confined8 ~]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- The policy shows the following rules being added when "unconfined_login" is enabled: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # sesearch -A -b unconfined_login allow unconfined_login_domain bin_t:dir { getattr ioctl lock open read search }; [ unconfined_login ]:True allow unconfined_login_domain bin_t:dir { getattr open search }; [ unconfined_login ]:True allow unconfined_login_domain bin_t:dir { getattr open search }; [ unconfined_login ]:True allow unconfined_login_domain bin_t:lnk_file { getattr read }; [ unconfined_login ]:True allow unconfined_login_domain shell_exec_t:file { execute execute_no_trans getattr ioctl map open read }; [ unconfined_login ]:True allow unconfined_login_domain unconfined_t:process transition; [ unconfined_login ]:True allow unconfined_t unconfined_login_domain:fd use; [ unconfined_login ]:True allow unconfined_t unconfined_login_domain:fifo_file { append getattr ioctl lock open read write }; [ unconfined_login ]:True allow unconfined_t unconfined_login_domain:process sigchld; [ unconfined_login ]:True # seinfo -a unconfined_login_domain -x Type Attributes: 1 attribute unconfined_login_domain; chroot_user_t crond_t local_login_t remote_login_t rshd_t sshd_t sulogin_t -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- From above, I'd expect when boolean is off, that shell services (e.g. sshd) cannot spawn a shell but ... there is an unconditional rule in the policy as well for sshd: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # sesearch -A -s sshd_t -t shell_exec_t [...] allow sshd_t shell_exec_t:file { execute execute_no_trans getattr ioctl map open read }; allow sshd_t shell_exec_t:file { execute execute_no_trans getattr ioctl map open read }; [ ssh_sysadm_login ]:True allow unconfined_login_domain shell_exec_t:file { execute execute_no_trans getattr ioctl map open read }; [ unconfined_login ]:True -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Stracing sshd with "--secontext" option shows the context change for the sshd user happens without issue: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 39754 [sshd_t] 13:13:41.865154 write(12</proc/39754/task/39754/attr/current> [sshd_t], "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\0", 54) = 54 <0.000142> 39754 [unconfined_t] 13:13:41.865324 close(12</proc/39754/task/39754/attr/current> [unconfined_t]) = 0 <0.000004> -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- What's wrong? Version-Release number of selected component (if applicable): selinux-policy-38.1.17-1.el9 How reproducible: Always Steps to Reproduce: 1. Map a user to "unconfined_u" # useradd -Z unconfined_u unconfined # echo "pass" | passwd --stdin unconfined 2. Disable the boolean # semanage boolean --modify --off unconfined_domain 3. Try ssh'ing # ssh unconfined@localhost Actual results: Works Expected results: Doesn't work Additional Information: See the following phase in TC#105816 (/CoreOS/selinux-policy/Regression/sshd-general): ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: unconfined_login boolean doesn't seem to have any effect on users, bz#2053004 :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 04:36:41 ] :: [ BEGIN ] :: Running 'semanage boolean -m --off unconfined_login' :: [ 04:36:43 ] :: [ PASS ] :: Command 'semanage boolean -m --off unconfined_login' (Expected 0, got 0) :: [ 04:36:43 ] :: [ BEGIN ] :: Running 'useradd -Z unconfined_u user23156' :: [ 04:36:44 ] :: [ PASS ] :: Command 'useradd -Z unconfined_u user23156' (Expected 0, got 0) :: [ 04:36:44 ] :: [ BEGIN ] :: Running 'echo s3kr3T2527 | passwd --stdin user23156' :: [ 04:36:45 ] :: [ PASS ] :: Command 'echo s3kr3T2527 | passwd --stdin user23156' (Expected 0, got 0) :: [ 04:36:45 ] :: [ BEGIN ] :: User login expected to fail. :: actually running './ssh.exp user23156 s3kr3T2527 localhost id -Z' spawn ssh -t user23156@localhost id -Z user23156@localhost's password: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Connection to localhost closed. :: [ 04:36:45 ] :: [ FAIL ] :: User login expected to fail. (Expected 1-255, got 0) :: [ 04:36:45 ] :: [ BEGIN ] :: Running 'userdel -rf user23156' userdel: user user23156 is currently used by process 51894 :: [ 04:36:45 ] :: [ PASS ] :: Command 'userdel -rf user23156' (Expected 0, got 0) :: [ 04:36:45 ] :: [ BEGIN ] :: Running 'semanage boolean -m --on unconfined_login' libsemanage.add_user: user user23156 not in password file :: [ 04:36:47 ] :: [ PASS ] :: Command 'semanage boolean -m --on unconfined_login' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 6s :: Assertions: 5 good, 1 bad :: RESULT: FAIL (unconfined_login boolean doesn't seem to have any effect on users, bz#2053004)