Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Fedora SELinux Support (http://www.linux-archive.org/fedora-selinux-support/)
-   -   weird dyntransition issue (http://www.linux-archive.org/fedora-selinux-support/648600-weird-dyntransition-issue.html)

Mr Dash Four 03-25-2012 01:02 PM

weird dyntransition issue
 
Since upgrading to the latest openssh (server) - v5.8p2-25 - and using
kernel 3.2 I started getting the following avc when trying to connect
via sftp and attempting to delete/change various files (please note that
sftpd_full_access is on!):


type=AVC msg=audit(1332653118.024:179): avc: denied { dyntransition }
for pid=1989 comm="sshd"
scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
tclass=process
type=SYSCALL msg=audit(1332653118.024:179): arch=40000003 syscall=4
success=no exit=-13 a0=3 a1=e11a48 a2=36 a3=e11a48 items=0 ppid=1986
pid=1989 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=3 comm="sshd" exe="/usr/sbin/sshd"
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)


I did not get the above avc with the previous version of openssh I was
using (v5.6) and I suspect it is something to do with the unprivileged
user transition feature, which has been implemented in this version, but
I can't be 100% sure.


I have tried to counter the above avc with including
"dyntrans_pattern(sshd_t, unconfined_t)", then
"unconfined_domtrans(sshd_t)" and finally a raw "allow sshd_t
unconfined_t:process { dyntransition };" but to no avail - I am still
getting the above avc! What am I doing wrong and is there a way to get
this sorted? Many thanks!

--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux


All times are GMT. The time now is 11:03 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.