Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 437440 - =sec-policy/selinux-*-9999 blocks ssh as user
Summary: =sec-policy/selinux-*-9999 blocks ssh as user
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
Whiteboard: sec-policy r6
Depends on:
Reported: 2012-10-06 18:15 UTC by Alex Brandt (RETIRED)
Modified: 2012-11-18 15:25 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

/etc/ssh/sshd_config (file_437440.txt,3.79 KB, text/plain)
2012-10-06 21:35 UTC, Alex Brandt (RETIRED)
/etc/ssh/ssh_config (file_437440.txt,1.57 KB, text/plain)
2012-10-06 21:36 UTC, Alex Brandt (RETIRED)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Brandt (RETIRED) gentoo-dev 2012-10-06 18:15:59 UTC
With selinux-*-9999 policies a normal user cannot run SSH.

Reproducible: Always

Steps to Reproduce:
1.Install sec-policy/selinux-*-9999
2. Login as normal user (no role changes) while system is enforcing strict
3. Try to ssh to another system
Actual Results:  
alunduil@selinux ~ $ ssh
Auto configuration failed
118260437468864:error:0200100D:system library:fopen:Permission denied:bss_file.c:169:fopen('/etc/ssl/openssl.cnf','rb')
118260437468864:error:2006D002:BIO routines:BIO_new_file:system lib:bss_file.c:174:
118260437468864:error:0E078002:configuration file routines:DEF_LOAD:system lib:conf_def.c:199:

Audit log:

type=AVC msg=audit(1349546929.695:392): avc:  denied  { search } for  pid=1481 comm="ssh" name="ssl" dev="xvda1" ino=32802 ipaddr= scontext=alunduil_u:staff_r:ssh_t tcontext=system_u:object_r:cert_t tclass=dir

Expected Results:  
Working outgoing ssh connections as regular users.

audit2allow -R suggests the following modification to ssh_t due to the addition of cert_t:


I have added the above as a localssh policy and it does fix the issue:

alunduil@selinux ~ $ ssh
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2012-10-06 20:52:14 UTC
Can you (safely ;) show the ssh client & server configuration? I can't reproduce this, and the "Auto configuration failed" message seems somewhat weird.

Not that I don't think it's needed, but I'd like to know when it is needed in case I have to "defend" it upstream.
Comment 2 Alex Brandt (RETIRED) gentoo-dev 2012-10-06 21:30:57 UTC
It's a mostly stock set of configs (I've attached them for your review).  I'm not sure why it's auto-configuring either.  Like I said this is pretty stock.  Let me know if the configs help or if you need anything else.  These are the configs from the system I'm SSH'ing _from_ (the one exhibiting this behavior).
Comment 3 Alex Brandt (RETIRED) gentoo-dev 2012-10-06 21:35:42 UTC
Created attachment 325842 [details]
Comment 4 Alex Brandt (RETIRED) gentoo-dev 2012-10-06 21:36:10 UTC
Created attachment 325844 [details]
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2012-10-11 18:38:18 UTC
So it's because (open)ssh links with libcrypto, offered by openssl. And that part wants to read the openssl.cnf file.
Comment 6 Sven Vermeulen (RETIRED) gentoo-dev 2012-10-11 18:52:08 UTC

Cause of the failure is a commit from the Debian folks to label /etc/ssl as cert_t completely (whereas it previously was etc_t).

Two ways can be used to handle this.

(1.) Allow ssh_t to read generic certificates, as you suggested. Since it is because ssh linked with libcrypto, this is not a weird suggestion, and imo doesn't impact security.
(2.) Label /etc/ssl and /etc/ssl/openssl.cnf as etc_t, and use cert_t for /etc/ssl/certs* and other

I submitted the first one upstream, but if the second option is better we'll use that.
Comment 7 Sven Vermeulen (RETIRED) gentoo-dev 2012-10-28 13:49:30 UTC
Well, upstream found that openssl.cnf should remain etc_t, but the second patch on that hasn't been committed upstream (just silence). I assume it'll be done though, so I already committed it to our repository.

Should be in the live ebuilds available already, and in r6 when it comes out.
Comment 8 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-03 17:34:15 UTC
In hardened-dev, r6 release
Comment 9 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-18 15:25:21 UTC
In main tree, ~arch'ed