Description of problem:
After updating to selinux-policy-44.7-1.fc44 (which removed the permissive setting for sshd_auth_t and sshd_session_t), SSH dynamic port forwarding (ssh -D) stopped working. This breaks tools that rely on dynamic forwarding, including VS Code's Remote-SSH extension.

Version-Release number of selected component (if applicable):
selinux-policy-44.7-1.fc44 / selinux-policy-targeted-44.7-1.fc44

How reproducible:
Always.

Steps to Reproduce:
1. On Fedora 44 with selinux-policy-targeted-44.7-1 or later, start an SSH connection using dynamic port forwarding: ssh -D <port> <host>
2. Have the remote side attempt to bind/connect out on an ephemeral port (e.g. a remote dev server or, in my case, VS Code Server's own listener) via the forwarded SOCKS tunnel
3. The connection through the tunnel fails with channel <N>: open failed: connect failed: open failed

Actual results:
The forwarded connection is silently blocked at the SELinux layer. sshd itself is correctly configured (AllowTcpForwarding yes, confirmed via sshd -T), and no relevant boolean exists to toggle this (checked getsebool -a | grep ssh).

Expected results:
Dynamic port forwarding should succeed, as it did before this policy update.

Additional info:

AVC denials:
    type=AVC msg=audit(1787912637.360:1469): avc:  denied  { name_connect } for  pid=78097 comm="sshd-session" dest=44717 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0

From selinux-policy-targeted changelog
    - Remove permissive setting for sshd_auth_t and sshd_session_t

Workaround:
    sudo ausearch -m avc -ts recent | audit2allow -M ssh_dynamic_forward
    sudo semodule -i ssh_dynamic_forward.pp

Generated .te file:
    module ssh_dynamic_forward 1.0;
    
    require {
            type sshd_session_t;
            type ephemeral_port_t;
            class tcp_socket name_connect;
    }
    
    #============= sshd_session_t ==============
    
    #!!!! This avc can be allowed using the boolean 'nis_enabled'
    allow sshd_session_t ephemeral_port_t:tcp_socket name_connect;