1 |
Hi all, |
2 |
|
3 |
I'm having some minor difficulty with SSHD under SELinux. I'm using |
4 |
selinux-base-policy-20040225, which contains the constraint: |
5 |
|
6 |
neverallow ~{ auth auth_write } shadow_t:file ~getattr; |
7 |
|
8 |
To log in via SSH and become the system administrator, I find that I must |
9 |
add the following permissions, which contradict the constraint: |
10 |
|
11 |
allow sshd_t shadow_t:file { getattr read }; |
12 |
allow sysadm_su_t shadow_t:file { getattr read }; |
13 |
|
14 |
I tried to investigate the auth type, but can't find where it's defined. |
15 |
|
16 |
I also find that I must: |
17 |
|
18 |
1. enable reading of random_device_t:chr_file for a variety of subjects. |
19 |
2. enable i/o to device_t:chr_file and *tty_device_t:chr file for a variety |
20 |
of subjects. |
21 |
|
22 |
I've verified that UsePAM is specified in /etc/ssh/sshd_config, and have |
23 |
relabeled the openssh files--and the entire system <g>--several times, |
24 |
restarting sshd after each relabeling operation. |
25 |
|
26 |
What am I missing? Could I be using the wrong versions of some |
27 |
SELinux-related ebuilds? I've tried both the stable and ~x86 versions. |
28 |
|
29 |
Cheers, |
30 |
|
31 |
--------------------------------------------------- |
32 |
Bill McCarty |
33 |
|
34 |
-- |
35 |
gentoo-hardened@g.o mailing list |