Re: [gentoo-hardened] sshd not working in enforcing mode

[Jan Dušek]

OK, you were right about the logging stuff - now I'm getting the
following error (among others :)) just after restarting sshd:

...
avc:  denied  { read write } for  pid=11273 exe=/usr/sbin/sshd
path=/dev/tty2 dev=08:03 ino=325331 scontext=system_u:system_r:sshd_t
tcontext=root:object_r:sysadm_tty_device_t tclass=chr_file
...

What is strange is the fact that I don't see any other errors related to
ssh if I login to this machine via ssh (still in permissive mode).

So is there anything I can do about this error message? E.g. can I
adjust the access rights somehow to make it accessible for the source
countext? (I repeat I'm new to SELinux so please tell me if I'm saying
something stupid.)


--jd

Michael Ihde wrote:
> Jan,
>
> I've had the same problem.  However, I get quite a few dmesg outputs.
> ~From what I can tell SELinux caches the avc messages and only prints out
> unique ones.  When I reload the policy it clears the cache and the
> messages are printed out again.
>
> I've been adding some policies to domains/misc/local.te to try and get
> it to work.  With all the local.te policies removed these are the
> messages I get using these commands
>
> $ dmesg -c
> $ make reload
> $ run_init /etc/init.d/sshd restart
>
> (From remote machine)
> ssh <selinux_host>
>
> This was run in permissive mode so it did allow a log-in.  I've added
>
>
> ~Michael
>
>
> avc:  denied  { read } for  pid=1215 exe=/usr/bin/checkpolicy
> name=urandom dev=03:47 ino=575343 scontext=root:sysadm_r:checkpolicy_t
> tcontext=system_u:object_r:random_device_t tclass=chr_file
>
> avc:  denied  { read } for  pid=1229 exe=/usr/sbin/load_policy
> name=urandom dev=03:47 ino=575343 scontext=root:sysadm_r:load_policy_t
> tcontext=system_u:object_r:random_device_t tclass=chr_file
>
> avc:  granted  { load_policy } for  pid=1229 exe=/usr/sbin/load_policy
> scontext=root:sysadm_r:load_policy_t
> tcontext=system_u:object_r:security_t tclass=security
> security:  3 users, 6 roles, 356 types
> security:  30 classes, 21122 rules
>
> avc:  denied  { append } for  pid=839 exe=/usr/sbin/syslog-ng
> path=/dev/tty12 dev=03:47 ino=575428
> scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:tty_device_t tclass=chr_file
>
> avc:  denied  { read } for  pid=1232 exe=/usr/sbin/run_init name=urandom
> dev=03:47 ino=575343 scontext=root:sysadm_r:run_init_t
> tcontext=system_u:object_r:random_device_t tclass=chr_file
>
> avc:  denied  { read write } for  pid=1281 exe=/usr/sbin/sshd
> path=/dev/tty1 dev=03:47 ino=575461 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:sysadm_tty_device_t tclass=chr_file
>
> avc:  denied  { read } for  pid=1284 exe=/sbin/insmod name=urandom
> dev=03:47 ino=575343 scontext=system_u:system_r:insmod_t
> tcontext=system_u:object_r:random_device_t tclass=chr_file
>
> avc:  denied  { read write } for  pid=1291 exe=/usr/sbin/sshd name=ptyp0
> dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> tcontext=system_u:object_r:device_t tclass=chr_file
>
> avc:  denied  { ioctl } for  pid=1291 exe=/usr/sbin/sshd path=/dev/ptyp0
> dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> tcontext=system_u:object_r:device_t tclass=chr_file
>
> avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ptyp0
> dev=03:47 ino=575701 scontext=system_u:system_r:sshd_t
> tcontext=system_u:object_r:device_t tclass=chr_file
>
> avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:staff_tty_device_t tclass=chr_file
>
> avc:  denied  { setattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:staff_tty_device_t tclass=chr_file
>
> avc:  denied  { read write } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:staff_tty_device_t tclass=chr_file
>
> avc:  denied  { ioctl } for  pid=1291 exe=/usr/sbin/sshd path=/dev/ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:staff_tty_device_t tclass=chr_file
>
> avc:  denied  { relabelfrom } for  pid=1291 exe=/usr/sbin/sshd
> name=ttyp0 dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=root:object_r:staff_tty_device_t tclass=chr_file
>
> avc:  denied  { relabelto } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
>
> avc:  denied  { getattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
>
> avc:  denied  { setattr } for  pid=1291 exe=/usr/sbin/sshd name=ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
>
> avc:  denied  { read write } for  pid=1293 exe=/usr/sbin/sshd
> path=/dev/ttyp0 dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=user_u:object_r:user_tty_device_t tclass=chr_file
>
> avc:  denied  { ioctl } for  pid=1293 exe=/usr/sbin/sshd path=/dev/ttyp0
> dev=03:47 ino=575939 scontext=system_u:system_r:sshd_t
> tcontext=user_u:object_r:user_tty_device_t tclass=chr_file

-- 
gentoo-hardened@g.o mailing list



--
gentoo-hardened@g.o mailing list