Bug 1218826 - [SELinux] gitolite does not set correct labels when writing .ssh/authorized_keys
Summary: [SELinux] gitolite does not set correct labels when writing .ssh/authorized_keys
Status: RESOLVED FIXED
Alias: None
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Security (show other bugs)
Version: Current
Hardware: Other Other
: P5 - None : Normal (vote)
Target Milestone: ---
Assignee: Cathy Hu
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-01-15 23:41 UTC by Cathy Hu
Modified: 2024-06-06 10:40 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cathy Hu 2024-01-15 23:41:10 UTC
Operating System: opensuse microos (ARM)
SELinux status, mode and policy name: enforcing
SELinux policy version and repository: 20231124-2.1

The software (incl. version) that is affected by the SELinux issue and the error message: 
gitolite-3.6.13-1.3
setup using: https://build.opensuse.org/package/view_file/openSUSE:Factory/gitolite/README.SUSE

SELinux Audit log:

```
~> sudo ausearch -m avc -ts 00:14
----
time->Tue Jan 16 00:15:49 2024
type=AVC msg=audit(1705360549.415:245): avc:  denied  { read } for  pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0
----
time->Tue Jan 16 00:15:49 2024
type=AVC msg=audit(1705360549.422:247): avc:  denied  { read } for  pid=2125 comm="sshd" name="authorized_keys" dev="mmcblk0p2" ino=550 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0

~> ls -aZ .ssh
system_u:object_r:var_t:s0 .      
system_u:object_r:var_t:s0 ..  
unconfined_u:object_r:var_t:s0 authorized_keys
```

Any other important details:
```
transactional-update pkg in gitolite
-> reboot
su - git
-> add ssh public key to /tmp/YourName.pub
gitolite setup -pk /tmp/YourName.pub
-> try to ssh to git@your-server -> does not allow login using ssh key, asks for password
```
```
sudo setenforce 0
-> try to ssh to git@your-server
hello YourName, this is git@your-server running gitolite3 3.6.13 on git 2.43.0

 R W	testing
Connection to your-server closed.
```

Probably mislabeling happening in the gitolite setup, will have a look during working hours
Comment 1 Cathy Hu 2024-01-15 23:49:35 UTC
ah, nope it is a policy issue, fedora has the homedir under /var/lib/gitolite, we have it under /srv/gitolite
Comment 2 Cathy Hu 2024-01-16 10:40:07 UTC
done