Created attachment 267751 [details]
spec changes for policy module

Created attachment 267761 [details]
source for policy module

I sort of understand the spec file patch, but I don't understand at all
the selinux policy file. To avoid me losing time in verifying your 
credentials could it be possible for you to commit?

I can rebuild and go through bodhi myself (now that there is the bodhi 
command line interface), or you can also do it if want to, just tell
me.

Will such change need to be done in EPEL (EL-5) too?

Sure, no problem. You should be aware I'm no selinux expert though - this is my
first policy module. I 'wrote' it mostly by running audit2allow on the AVC
denials in the audit log file.

I tried to get some validation from the fedora-selinux-list, but unfortunately
no-one responded:
https://www.redhat.com/archives/fedora-selinux-list/2007-November/msg00077.html

I'll briefly run through my understanding of what it does just so you know:

allow local_login_t ssh_agent_exec_t:file { read execute execute_no_trans };
- enable read and execute of the ssh-agent binary

allow local_login_t user_home_ssh_t:file { read getattr };
- enable read/stat of users' ssh key files

allow local_login_t var_run_t:dir { write add_name };
- enable writing of /var/run directory and creating a new entry

allow local_login_t var_run_t:file { create read getattr };
- enable writing to and creating a file in /var/run

allow local_login_t local_login_tmp_t:sock_file create;
- enable creating a socket in /tmp (used for communication with ssh-agent)

local_login_t is for console login. Then this is repeated for ssh login and
gdm/kdm/xdm login.

Committed and tagged pam_ssh-1_92-3_fc8
Built: http://koji.fedoraproject.org/koji/taskinfo?taskID=256232

Committed and tagged pam_ssh-1_92-3_fc9
Built: http://koji.fedoraproject.org/koji/taskinfo?taskID=256244

Regarding EPEL-5, I think that was branched from FC6? Unless RH tighten the
policy in RHEL5 it won't be necessary, and I doubt they'll do that. Presumably
will be necessary for RHEL6 but that will be branched from F9/F10?

pam_ssh-1.92-3.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update pam_ssh'

*** Bug 381811 has been marked as a duplicate of this bug. ***

No most of the policy problems above are caused by putting pam_ssh in the wrong
place in the pam.d files.

session optional pam_ssh.so 

should not be in the sysatem_auth file.  It should be in all of the login pam.d
files after the pam_selinux.so files.

This will cause ssh-agent to run under the  user context and to create the
proper files with the proper context.  I have updated selinux policy to allow
this to work.

If one want to use session optional pam_ssh.so in all the
pam stacks, it should be in system-auth, though. Duplicating
an entry in many files just renders system-auth unuseful.
Maybe this points out a deficiency in the default pam 
configuration?

I don't have pam_ssh in system-auth (which would cause it to be used for a bunch
of things I don't want my ssh key unlocked with), instead I have a
system-auth-ssh which is used instead where appropriate.

I take your point about putting pam_ssh after pam_selinux. Unfortunately pam has
always been a black art to configure and dangerous when you get it wrong, with
these extra requirements it's bordering on impossible. pam_selinux(8) doesn't
really clear the confusion up either.

I agree with Patrice that the whole point of system-auth is to centralise the
config and make it easier to manage.

It is also a shame that no-one responded to my fedora-selinux-list post:
https://www.redhat.com/archives/fedora-selinux-list/2007-November/msg00077.html
as this could have avoided wasting time and saved some confusion.

for comment #8 :

> I have updated selinux policy to allow this to work.

Does it mean that we can get rid of the recent SELinux addons for pam_ssh?

(and add a comment somewhere about properly placing of pam_ssh.so after the
pam_seliinux.so).


for comment #9 :

> If one want to use session optional pam_ssh.so in all the
> pam stacks, it should be in system-auth, though. Duplicating
> an entry in many files just renders system-auth unuseful.

Actually, pam_ssh is useful for some kind of a "shell" service. Personally, I
use pam_ssh for "login", "gdm" and "sshd" only, i.e. 3 services at all. I prefer
even not to create a "system-auth-ssh", it is more easy to add one line in all 3
files, rather than create an additional file (and then add a line in those 3
files anyway).

Thus IMHO pam_ssh.so is not suitable for the system-wide common auth pam config,
it is mostly for particular services rather than for *all* the services.

(In reply to comment #11)
> for comment #8 :
> 
> > If one want to use session optional pam_ssh.so in all the
> > pam stacks, it should be in system-auth, though. Duplicating
> > an entry in many files just renders system-auth unuseful.
> 
> Actually, pam_ssh is useful for some kind of a "shell" service. Personally, I
> use pam_ssh for "login", "gdm" and "sshd" only, i.e. 3 services at all. I prefer
> even not to create a "system-auth-ssh", it is more easy to add one line in all 3
> files, rather than create an additional file (and then add a line in those 3
> files anyway).
> 
> Thus IMHO pam_ssh.so is not suitable for the system-wide common auth pam config,
> it is mostly for particular services rather than for *all* the services.

The current state of pam config seems to be quite a mess in fact.
Not all relevant services have selinux and there should certainly be
some factoring out of things that are done as user. Not the place here
in any case.

What is the selinux package having pam_ssh policy in and what version 
is it?

I get that error when updating in devel:

  Updating  : selinux-policy-targeted      ##################### [ 51/139]
libsepol.print_missing_requirements: pam_ssh's global requirements were not met:
type/attribute user_home_ssh_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!

It may also be related with Bug 407891

> It may also be related with Bug 407891

Nope, since you do not use triggers, pam_ssh is not touched when you update
selinux-policy-targeted .

What if you install the previous version of pam_ssh (yet without SELinux addons)
and try to update selinux-policy-targeted then?

I am still waiting for a definitive explanation of what 
package is needed for pam_ssh to properly function, when
somebody has put pam_ssh at the right place (that is after
pam_selinux, if I understand well).

Daniel?..

(In reply to comment #14)
> > It may also be related with Bug 407891
> 
> Nope, since you do not use triggers, pam_ssh is not touched when you update
> selinux-policy-targeted .
> 
> What if you install the previous version of pam_ssh (yet without SELinux addons)
> and try to update selinux-policy-targeted then?

I haven't tried, but I have fixed Bug 407891.

The error message is there on install:

# rpm -Uvh i386/pam_ssh-1.92-5.fc9.i386.rpm 
Préparation...              ########################################### [100%]
   1:pam_ssh                ########################################### [100%]
libsepol.print_missing_requirements: pam_ssh's global requirements were not met:
type/attribute user_home_ssh_t
libsemanage.semanage_link_sandbox: Link packages failed
semodule:  Failed!

However now, with pam_ssh already installed (or not), there is no
pam_ssh related error message when installing selinux-policy-targeted: 
# yum install selinux-policy-targeted 
...
  Installing: selinux-policy-targeted      ######################### [1/1] 
/usr/sbin/semanage: range not supported on Non MLS machines
/usr/sbin/semanage: Préfixe invalide guest
/usr/sbin/semanage: Préfixe invalide xguest

As this has now been fixed directly in the targeted policy we should drop the
semodule additions.

I have removed the selinux module stuff, and added a
Conflicts: selinux-policy-targeted < 3.0.8-55
and built in devel.

Does that seems right?

Yes, fine!

pam_ssh-1.92-6.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update pam_ssh'

It would be nice to have people using selinux test this update in 
testing (the last one, of course, pam_ssh-1.92-6.fc8).

pam_ssh-1.92-6.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.