Re: [gentoo-hardened] Can't login by ssh

[Julien Thomas]

Hello.

According to your dmesg message,
I think that the password checking binary should be of type
system_u:object_r:chkpwd_exec_t, which is not present here.

However, I do not remember very well if it has to be here or not, as
sometimes log messages do not really relfect the object type (in my
case), with for instance, labels compressions (type_exec_t -> type_t).

So, have you check
http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=4&chap=3
to see if it's an error produced by an incorrect labelling  ?

for ino=427414, what is the associated file ?
See the second possible error, "Incorrect Password File Contexts", of
the previous link.



Shaochun Wang wrote:
> Currently, I use the targeted policy. But I can't login using ssh.
> Command dmesg shows the following message:
>
> audit(1194494942.948:137): avc:  denied  { entrypoint } for  pid=29208
> comm="sshd" name="bash" dev=hda5 ino=427414
> scontext=user_u:system_r:system_chkpwd_t
> tcontext=system_u:object_r:shell_exec_t tclass=file
>
> Any help?
>
>