Bug 1218826

Summary: [SELinux] gitolite does not set correct labels when writing .ssh/authorized_keys
Product: [openSUSE] openSUSE Tumbleweed Reporter: Cathy Hu <cathy.hu>
Component: SecurityAssignee: Cathy Hu <cathy.hu>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None    
Version: Current   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Cathy Hu 2024-01-15 23:41:10 UTC
Operating System: opensuse microos (ARM)
SELinux status, mode and policy name: enforcing
SELinux policy version and repository: 20231124-2.1

The software (incl. version) that is affected by the SELinux issue and the error message: 
gitolite-3.6.13-1.3
setup using: https://build.opensuse.org/package/view_file/openSUSE:Factory/gitolite/README.SUSE

SELinux Audit log:

```
~> sudo ausearch -m avc -ts 00:14
----
time->Tue Jan 16 00:15:49 2024
type=AVC msg=audit(1705360549.415:245): avc:  denied  { read } for  pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0
----
time->Tue Jan 16 00:15:49 2024
type=AVC msg=audit(1705360549.422:247): avc:  denied  { read } for  pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0

~> ls -aZ .ssh
system_u:object_r:var_t:s0 .      
system_u:object_r:var_t:s0 ..  
unconfined_u:object_r:var_t:s0 authorized_keys
```

Any other important details:
```
transactional-update pkg in gitolite
-> reboot
su - git
-> add ssh public key to /tmp/YourName.pub
gitolite setup -pk /tmp/YourName.pub
-> try to ssh to git@your-server -> does not allow login using ssh key, asks for password
```
```
sudo setenforce 0
-> try to ssh to git@your-server
hello YourName, this is git@your-server running gitolite3 3.6.13 on git 2.43.0

 R W	testing
Connection to your-server closed.
```

Probably mislabeling happening in the gitolite setup, will have a look during working hours
Comment 1 Cathy Hu 2024-01-15 23:49:35 UTC
ah, nope it is a policy issue, fedora has the homedir under /var/lib/gitolite, we have it under /srv/gitolite
Comment 2 Cathy Hu 2024-01-16 10:40:07 UTC
done