Bugzilla – Bug 1218826
[SELinux] gitolite does not set correct labels when writing .ssh/authorized_keys
Last modified: 2024-06-06 10:40:31 UTC
Operating System: opensuse microos (ARM) SELinux status, mode and policy name: enforcing SELinux policy version and repository: 20231124-2.1 The software (incl. version) that is affected by the SELinux issue and the error message: gitolite-3.6.13-1.3 setup using: https://build.opensuse.org/package/view_file/openSUSE:Factory/gitolite/README.SUSE SELinux Audit log: ``` ~> sudo ausearch -m avc -ts 00:14 ---- time->Tue Jan 16 00:15:49 2024 type=AVC msg=audit(1705360549.415:245): avc: denied { read } for pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0 ---- time->Tue Jan 16 00:15:49 2024 type=AVC msg=audit(1705360549.422:247): avc: denied { read } for pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0 ~> ls -aZ .ssh system_u:object_r:var_t:s0 . system_u:object_r:var_t:s0 .. unconfined_u:object_r:var_t:s0 authorized_keys ``` Any other important details: ``` transactional-update pkg in gitolite -> reboot su - git -> add ssh public key to /tmp/YourName.pub gitolite setup -pk /tmp/YourName.pub -> try to ssh to git@your-server -> does not allow login using ssh key, asks for password ``` ``` sudo setenforce 0 -> try to ssh to git@your-server hello YourName, this is git@your-server running gitolite3 3.6.13 on git 2.43.0 R W testing Connection to your-server closed. ``` Probably mislabeling happening in the gitolite setup, will have a look during working hours
ah, nope it is a policy issue, fedora has the homedir under /var/lib/gitolite, we have it under /srv/gitolite
done