Bug 64393 – basepolicy: sysadm_r can't exec ssh-keygen

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Sören Lorenz 2004-09-17 06:14:34 UTC]

Permission is denied for ssh-keygen when I try to execute it as root:sysadm_t.

Reproducible: Always
Steps to Reproduce:

Actual Results:  
avc:  denied  { read } for  pid=22529 exe=/bin/bash name=ssh-keygen dev=hda2
ino=73040 scontext=root:sysadm_r:sysadm_t
tcontext=system_u:object_r:ssh_keygen_exec_t tclass=file

Expected Results:  
No denials.

[Comment 1 petre rodan (RETIRED) 2004-09-19 05:44:34 UTC]

Created attachment 39911 [details, diff]
policy patch that includes a user domain macro for ssh_keygen_exec_t

diff based on selinux-base-policy-20040906

[Comment 2 Sören Lorenz 2004-09-23 09:29:46 UTC]

Your patch works, the keys are created. Though it produces this denial two times:

avc:  denied  { read write } for  pid=32144 exe=/usr/bin/ssh-keygen name=tty dev=hda2 ino=176660 scontext=root:sysadm_r:sysadm_ssh_keygen_t tcontext=system_u:object_r:devtty_t tclass=chr_file

Good work!

Regards,

S

[Comment 3 Sören Lorenz 2004-09-23 09:29:46 UTC]

Your patch works, the keys are created. Though it produces this denial two times:

avc:  denied  { read write } for  pid=32144 exe=/usr/bin/ssh-keygen name=tty dev=hda2 ino=176660 scontext=root:sysadm_r:sysadm_ssh_keygen_t tcontext=system_u:object_r:devtty_t tclass=chr_file

Good work!

Regards,

Sören Lorenz

[Comment 4 petre rodan (RETIRED) 2004-09-23 12:29:18 UTC]

the newest version is on the devspace:
http://dev.gentoo.org/~kaiowas/policy/macros/program/ssh_macros.te
http://dev.gentoo.org/~kaiowas/policy/domains/program/ssh.te

[Comment 5 Chris PeBenito (RETIRED) 2004-10-01 10:03:14 UTC]

fixed in policy cvs a different way