Re: [gentoo-hardened] Ssh client

[fanfan]

  
  




  

thx for your interest BILL :

I work with OLUVE I'm his "PADAWAN"

Bill McCarty wrote:


Hi 01uv3, 
  
--On Friday, April 02, 2004 10:57 AM +0200 "01uv3." <oluve@××××.org>
wrote: 
  
  
      got a strange problem.  Sshd access works
fine  but once
connected 
to the SELinux I can't establish any Ssh connection nor outside nor to 
localhost : 
    
    
  
  
What sort of AVC messages show up in syslog? More particularly, if you
do: 
  
    cd /etc/security/selinux/src/policy; make reload 
  

Apr  2 09:37:55 selinux kernel:

Apr  2 09:37:55 selinux kernel: avc:  denied  { read write } for 
pid=24477 exe=/usr/bin/checkpolicy path=/dev/tty1 dev=08:03 ino=97974
scontext=root:sysadm_r:checkpolicy_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

Apr  2 09:37:55 selinux kernel:

Apr  2 09:37:55 selinux kernel: avc:  denied  { read } for  pid=24477
exe=/usr/bin/checkpolicy name=urandom dev=08:03 ino=99021
scontext=root:sysadm_r:checkpolicy_t
tcontext=system_u:object_r:random_device_t tclass=chr_file

Apr  2 09:37:58 selinux kernel:

Apr  2 09:37:58 selinux kernel: avc:  denied  { getattr } for 
pid=24484 exe=/usr/bin/checkpolicy name=tty1 dev=08:03 ino=97974
scontext=root:sysadm_r:checkpolicy_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

Apr  2 09:37:58 selinux kernel:

Apr  2 09:37:58 selinux kernel: avc:  denied  { ioctl } for  pid=24484
exe=/usr/bin/checkpolicy path=/dev/tty1 dev=08:03 ino=97974
scontext=root:sysadm_r:checkpolicy_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

Apr  2 09:38:00 selinux kernel:

Apr  2 09:38:00 selinux kernel: avc:  denied  { read write } for 
pid=24485 exe=/usr/sbin/load_policy path=/dev/tty1 dev=08:03 ino=97974
scontext=root:sysadm_r:load_policy_t
tcontext=system_u:object_r:tty_device_t tclass=chr_file

Apr  2 09:38:00 selinux kernel:

Apr  2 09:38:00 selinux kernel: avc:  denied  { read } for  pid=24485
exe=/usr/sbin/load_policy name=urandom dev=08:03 ino=99021
scontext=root:sysadm_r:load_policy_t
tcontext=system_u:object_r:random_device_t tclass=chr_file

Apr  2 09:38:00 selinux kernel:

Apr  2 09:38:00 selinux kernel: avc:  granted  { load_policy } for 
pid=24485 exe=/usr/sbin/load_policy
scontext=root:sysadm_r:load_policy_t
tcontext=system_u:object_r:security_t tclass=security

Apr  2 09:38:00 selinux kernel: security:  5 users, 5 roles, 360 types

Apr  2 09:38:00 selinux kernel: security:  31 classes, 21636 rules


and then try to establish an SSH connection,
what's the output of: 
  
    audit2allow -l -i /var/log/xxxxxxxx 


allow getty_t getty_t:udp_socket { getattr };

allow getty_t random_device_t:chr_file { read };

allow ldconfig_t random_device_t:chr_file { read };

allow local_login_t mnt_t:dir { getattr };

allow local_login_t random_device_t:chr_file { read };

allow local_login_t scsi_generic_device_t:chr_file { getattr setattr };

allow setfiles_t random_device_t:chr_file { read };



where xxxxxxxx is the log file that holds AVC messages? 
  
Cheers, 
  
--------------------------------------------------- 
Bill McCarty, Ph.D. 
Professor of Information Technology 
Azusa Pacific University 
  
  
  
-- 
  gentoo-hardened@g.o
mailing list 
  
. 
  

hope you will find something !!

THX fanfan, oluve's padawan



-- 
***************************************

*       Francois NOEL IUT GTR         *

*                                     
* 
*  mail : fanfan@××××××××××××.fr      *
* ou : francois.noel@××××××××××××.fr 
*

*       msn : adrena@××.st            *

*   actuellement en stage au CRDP     *

***************************************



-- 
***************************************
*       Francois NOEL IUT GTR         *
*                                     * 
*  mail : fanfan@××××××××××××.fr      *  
* ou : francois.noel@××××××××××××.fr  *
*       msn : adrena@××.st            *
*   actuellement en stage au CRDP     *
***************************************