[gentoo-hardened] SELinux preventing sshd from listening on ports other than 22

[Andrew Ross]

Will Keaney wrote:
> I've just finished updating my SELinux VM, but still get a lot of avc
>  denials in /var/log/syslog. What is the recommended method of
> changing the SELinux policy?  I seem to remember PeBenito saying in
> IRC that editing the policy files directly is not recommended.

> avc:  denied  { name_bind } for  pid=5164 comm="sshd" src=2222
> scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:port_t
> tclass=tcp_socket

I'm new to SELinux myself, but I'm almost certain I can be of help here.

You've configured sshd to listen on port 2222 instead of the default 22,
but SELinux policy states that sshd can only bind to ports labelled with
the type ssh_port_t. The semanage command can be used to adjust port
labels e.g.

semanage port -a -t ssh_port_t -p tcp 2222

Cheers

Andrew