[gentoo-hardened] SELinux policy rules concerning access to /etc/shadow

[Bill McCarty]

Hi all,

I'm having some minor difficulty with SSHD under SELinux. I'm using 
selinux-base-policy-20040225, which contains the constraint:

neverallow ~{ auth auth_write } shadow_t:file ~getattr;

To log in via SSH and become the system administrator, I find that I must 
add the following permissions, which contradict the constraint:

allow sshd_t shadow_t:file { getattr read };
allow sysadm_su_t shadow_t:file { getattr read };

I tried to investigate the auth type, but can't find where it's defined.

I also find that I must:

1. enable reading of random_device_t:chr_file for a variety of subjects.
2. enable i/o to device_t:chr_file and *tty_device_t:chr file for a variety 
of subjects.

I've verified that UsePAM is specified in /etc/ssh/sshd_config, and have 
relabeled the openssh files--and the entire system <g>--several times, 
restarting sshd after each relabeling operation.

What am I missing? Could I be using the wrong versions of some 
SELinux-related ebuilds? I've tried both the stable and ~x86 versions.

Cheers,

---------------------------------------------------
Bill McCarty

--
gentoo-hardened@g.o mailing list