Re: [gentoo-hardened] sshd not working in enforcing mode

[Michael Ihde]

> So is there anything I can do about this error message? E.g. can I
> adjust the access rights somehow to make it accessible for the source
> countext? (I repeat I'm new to SELinux so please tell me if I'm saying
> something stupid.)

Yes! In /etc/security/selinux/src/policy/domains/misc/ add a file
local.te 

In this file you can define all your local security policies.   Add the
line:

allow { sshd_t } sysadm_tty_device_t:chr_file { read write };

I'll let you find the correlation between this and the avc message :)
You can follow a similar process for all other messages you receive.

~Michael 
>
> --jd
>
> Michael Ihde wrote:
> > Jan,
> >
> > I've had the same problem.  However, I get quite a few dmesg outputs.
> > ~From what I can tell SELinux caches the avc messages and only prints out
> > unique ones.  When I reload the policy it clears the cache and the
> > messages are printed out again.
> >
> > I've been adding some policies to domains/misc/local.te to try and get
> > it to work.  With all the local.te policies removed these are the
> > messages I get using these commands
> >
> > $ dmesg -c
> > $ make reload
> > $ run_init /etc/init.d/sshd restart
> >
> > (From remote machine)
> > ssh <selinux_host>
> >
> > This was run in permissive mode so it did allow a log-in.  I've added
> >
> >
> > ~Michael
> >
> >
> > avc:  denied  { read } for  pid=1215 exe=/usr/bin/checkpolicy
> > name=urandom dev=03:47 ino=575343 scontext=root:sysadm_r:checkpolicy_t
> > tcontext=system_u:object_r:random_device_t tclass=chr_file
> >
> > avc:  denied  { read } for  pid=1229 exe=/usr/sbin/load_policy
> > name=urandom dev=03:47 ino=575343 scontext=root:sysadm_r:load_policy_t
> > tcontext=system_u:object_r:random_device_t tclass=chr_file
> >
> > avc:  granted  { load_policy } for  pid=1229 exe=/usr/sbin/load_policy
> > scontext=root:sysadm_r:load_policy_t
> > tcontext=system_u:object_r:security_t tclass=security
> > security:  3 users, 6 roles, 356 types
> > security:  30 classes, 21122 rules
> >
> > avc:  denied  { append } for  pid=839 exe=/usr/sbin/syslog-ng
> > path=/dev/tty12 dev=03:47 ino=575428
> > scontext=system_u:system_r:syslogd_t
> > tcontext=system_u:object_r:tty_device_t tclass=chr_file
> >
> > avc:  denied  { read } for  pid=1232 exe=/usr/sbin/run_init name=urandom
> > dev=03:47 ino=575343 scontext=root:sysadm_r:run_init_t
> > tcontext=system_u:object_r:random_device_t tclass=chr_file
> >
> > avc:  denied  { read write } for  pid=1281 exe=/usr/sbin/sshd
> > path=/dev/tty1 dev=03:47 ino=575461 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:sysadm_tty_device_t tclass=chr_file
> >
> > avc:  denied  { read } for  pid=1284 exe=/sbin/insmod name=urandom
> > dev=03:47 ino=575343 scontext=system_u:system_r:insmod_t
> > tcontext=system_u:object_r:random_device_t tclass=chr_file
> >
> > avc:  denied  { read write } for  pid=1291 exe=/usr/sbin/sshd name=ptyp0
> > dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> > tcontext=system_u:object_r:device_t tclass=chr_file
> >
> > avc:  denied  { ioctl } for  pid=1291 exe=/usr/sbin/sshd path=/dev/ptyp0
> > dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> > tcontext=system_u:object_r:device_t tclass=chr_file
> >
> > avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ptyp0
> > dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> > tcontext=system_u:object_r:device_t tclass=chr_file
> >
> > avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:staff_tty_device_t tclass=chr_file
> >
> > avc:  denied  { setattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:staff_tty_device_t tclass=chr_file
> >
> > avc:  denied  { read write } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:staff_tty_device_t tclass=chr_file
> >
> > avc:  denied  { ioctl } for  pid=1291 exe=/usr/sbin/sshd path=/dev/ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:staff_tty_device_t tclass=chr_file
> >
> > avc:  denied  { relabelfrom } for  pid=1291 exe=/usr/sbin/sshd
> > name=ttyp0 dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=root:object_r:staff_tty_device_t tclass=chr_file
> >
> > avc:  denied  { relabelto } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
> >
> > avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
> >
> > avc:  denied  { setattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
> >
> > avc:  denied  { read write } for  pid=1293 exe=/usr/sbin/sshd
> > path=/dev/ttyp0 dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
> >
> > avc:  denied  { ioctl } for  pid=1293 exe=/usr/sbin/sshd path=/dev/ttyp0
> > dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> > tcontext=user_u:object_r:user_tty_device_t tclass=chr_file