Hi,
I did a fresh installation of FC5 and upgraded to the strict policy.
After creating a new user via "adduser" I get the following avc
denials when I try to login via ssh.
audit(1150198407.761:2862): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:sshd_exec_t:s0 tclass=process
audit(1150198411.552:2863): avc: denied { getattr } for pid=3717
comm="sshd" name="stefan" dev=hda2 ino=58667
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir
audit(1150198411.624:2864): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=process
audit(1150198411.624:2865): avc: denied { execute_no_trans } for
pid=3721 comm="sshd" name="bash" dev=hda2 ino=29283
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:shell_exec_t:s0 tclass=file
audit(1150198411.628:2866): avc: denied { execute } for pid=3721
comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.628:2867): avc: denied { read } for pid=3722
comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.628:2868): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.628:2869): avc: denied { execute_no_trans } for
pid=3723 comm="bash" name="id" dev=hda7 ino=1846199
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=file
audit(1150198411.632:2870): avc: denied { execute } for pid=3725
comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.632:2871): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=process
audit(1150198411.632:2872): avc: denied { execute_no_trans } for
pid=3725 comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.632:2873): avc: denied { read } for pid=3725
comm="bash" name="hostname" dev=hda2 ino=29286
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
audit(1150198411.636:2874): avc: denied { execute } for pid=3721
comm="bash" name="colorls.sh" dev=hda2 ino=175700
scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:etc_t:s0 tclass=file
audit(1150198411.636:2875): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.640:2876): avc: denied { read } for pid=3721
comm="bash" name="stefan" dev=hda2 ino=58667
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_dir_t:s0 tclass=dir
audit(1150198411.640:2877): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.644:2878): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.644:2879): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.648:2880): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.652:2881): avc: denied { read } for pid=3721
comm="bash" name=".bash_profile" dev=hda2 ino=58595
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_t:s0 tclass=file
audit(1150198411.652:2882): avc: denied { getattr } for pid=3721
comm="bash" name=".bash_profile" dev=hda2 ino=58595
scontext=staff_u:system_r:sshd_t:s0
tcontext=user_u:object_r:user_home_t:s0 tclass=file
audit(1150198411.656:2883): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
audit(1150198411.660:2884): security_compute_sid: invalid context
staff_u:system_r:sshd_t:s0 for scontext=staff_u:system_r:sshd_t:s0
tcontext=system_u:object_r:bin_t:s0 tclass=process
I know that the strict policy is quiet not perfect but I thought a
ssh login should went fine, shouldn't it? My question is, is this the
default behaviour or did I something wrong? I get also a lot of avc
denials after a reboot with the strict policy. Shouldn't the strict
policy work quiet fine with a default installation (I know it's not
perfect but ... ;-))?
Best regards,
Stefan
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
