Re: Centos 7, /var/lib/ssh-x509-auth/

[mark]

Miroslav Grepl wrote:
>  On 02/23/2016 03:57 PM, m.roth(a)5-cent.us wrote:
> > I assume that this is created by ssh when the user goes to ssh from
> > their system. So, why would I get 
> > If you want to allow ksh93 to have create access on the
> kmeyer.pem file
> > Then you need to change the label on <username>.pem
> > Do # semanage fcontext -a -t FILE_TYPE '<username>.pem'
> > where FILE_TYPE is one of the following: abrt_var_cache_t, auth_cache_t,
> > auth_home_t, cgroup_t, faillog_t, gitosis_var_lib_t, gkeyringd_tmp_t,
> > krb5_host_rcache_t, lastlog_t, mozilla_plugin_tmp_t,
> > mozilla_plugin_tmpfs_t, nfs_t, openshift_tmp_t, pam_var_run_t,
> > ssh_home_t, sshd_var_run_t, systemd_passwd_var_run_t, user_tmp_t,
> > var_auth_t.
> > Then execute:
> > restorecon -v '<username>.pem'
> >
> > ll -aZ /var/lib/ssh-x509-auth/
> > drwx------. adm  root system_u:object_r:var_lib_t:s0   .
> > drwxr-xr-x. root root system_u:object_r:var_lib_t:s0   ..
> > -rw-------. adm  adm  system_u:object_r:var_lib_t:s0   <username>
> > -rw-------. adm  adm  system_u:object_r:var_lib_t:s0   <username>.pem
> >
> > Is this a bug, a mislabeling, or...?
>
>  $ matchpathcon var/lib/ssh-x509-auth/
>  /var/lib/ssh-x509-auth	system_u:object_r:var_lib_t:s0
>
>  It is a default system labeling.
>
>  What is your AVC? 
Well, I just logged onto that user's workstation as me, and got a bunch of
varying ones. One similar is, excerpted from the setroubleshoot report:

Raw Audit Messages
type=AVC msg=audit(1456332138.947:141150): avc:  denied  { getattr } for 
pid=6552 comm="grep" path="/var/lib/ssh-x509-auth/rothmb"
dev="sda3"
ino=1277468 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_lib_t:s0 tclass=file

Is that what you're looking for?

       mark