[gentoo-hardened] Re: ssh root login -> root:system_r:system_chkpwd_t !?

[Antoine Martin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Anyone?

With 2005.1 soon removed, I would like to have these issues cleared up
sooner rather than later...

Antoine Martin wrote:
> Hi,
>
> make.profile -> ../usr/portage/profiles/selinux/2007.0/amd64
> Running 2.6.23.13 in non-enforcing mode, targetted policy.
>
> system_u:system_r:sshd_t        root      sshd: root@pts/0
> root:system_r:system_chkpwd_t   root      pts/0    00:00:00 -bash
>
> The first denials:
>
> [  140.780441] inode_doinit_with_dentry:
> context_to_sid(root:object_r:staff_tmpfs_t) returned 22 for dev=md2
> ino=961000
> [  265.282465] audit(1200225126.688:46): avc:  denied  { entrypoint }
> for  pid=6208 comm="sshd" path="/bin/bash" dev=md0 ino=49189
> scontext=root:system_r:system_chkpwd_t
> tcontext=system_u:object_r:shell_exec_t tclass=file
> [  265.282727] audit(1200225126.688:47): avc:  denied  { read write }
> for  pid=6208 comm="bash" name="0" dev=devpts ino=2
> scontext=root:system_r:system_chkpwd_t
> tcontext=root:object_r:sshd_devpts_t tclass=chr_file
>
> Any ideas?
>
>
> Also, was getting some denials because /lib was not labeled:
> lrwxrwxrwx  root root system_u:object_r:default_t      /lib -> lib64
> I had to add this to file_contexts:
> /lib             -l       system_u:object_r:lib_t
> How come?
>
> Cheers
> Antoine
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHmzHSGK2zHPGK1rsRCg1cAJ9e7cGNBzSPlU2yil76jtkaeo7BkgCfR96k
ByEAIGtMK33LZRpJiDOJfSk=
=9Jle
-----END PGP SIGNATURE-----
-- 
gentoo-hardened@l.g.o mailing list