SELinux is preventing /usr/sbin/sshd from 'search' accesses on the directory /var/lib/amanda. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that sshd should be allowed search access on the amanda directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep /usr/sbin/sshd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 Target Context system_u:object_r:amanda_var_lib_t:s0 Target Objects /var/lib/amanda [ dir ] Source sshd Source Path /usr/sbin/sshd Port <Unknown> Host (removed) Source RPM Packages openssh-server-5.5p1-24.fc14.2 Target RPM Packages amanda-3.1.3-1.fc14 Policy RPM selinux-policy-3.9.7-19.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 2.6.35.10-74.fc14.x86_64 #1 SMP Thu Dec 23 16:04:50 UTC 2010 x86_64 x86_64 Alert Count 17 First Seen Sat 01 Jan 2011 07:21:22 PM EST Last Seen Sun 02 Jan 2011 09:40:34 AM EST Local ID d477003b-6568-4441-95d8-60bda5a6c0e5 Raw Audit Messages type=AVC msg=audit(1293979234.748:40134): avc: denied { search } for pid=14048 comm="sshd" name="amanda" dev=dm-0 ino=1312834 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:amanda_var_lib_t:s0 tclass=dir sshd,sshd_t,amanda_var_lib_t,dir,search type=SYSCALL msg=audit(1293979234.748:40134): arch=x86_64 syscall=open success=no exit=EACCES a0=7f79373e1b50 a1=800 a2=1 a3=16 items=0 ppid=2062 pid=14048 auid=4294967295 uid=0 gid=0 euid=33 suid=0 fsuid=33 egid=6 sgid=0 fsgid=6 tty=(none) ses=4294967295 comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) sshd,sshd_t,amanda_var_lib_t,dir,search #============= sshd_t ============== allow sshd_t amanda_var_lib_t:dir search;
Some context: This is triggered on an Amanda client machine by amaddclient, which uses key-based SSH to copy configuration information from the server to the client. The access is for user amandabackup, whose home directory is /var/lib/amanda, so the keys are stored in /var/lib/amanda/.ssh/authorized_keys.
You can allow it using # semanage permissive -a sshd_t Test it. # grep sshd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp # semanage permissive -d sshd_t
Lets add /var/lib/amanda/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) to ssh.fc for F13,F14.
Yes, I was also thinking about that. But the directory does not exist by default. So people will need to run restorecon.
Yes but we have that problem with .ssh directories everywhere.
Yes, unfortunately. I am fine with the label. Fixed in F13 and F14 policy. Fixed in selinux-policy-3.9.7-20.fc14
selinux-policy-3.9.7-20.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-20.fc14
selinux-policy-3.9.7-20.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.7-20.fc14
selinux-policy-3.9.7-20.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.