Re: username.pem

[Vit Mojzis]

To answer your last question, it would be better to solve this without adding new rules.
Try changing the context of /var/lib/ssh-x509-auth/ directory to var_auth_t (sshd already
has write access to it).
 #chcon -R -t var_auth_t /var/lib/ssh-x509-auth/

If this solves the issue, please file a bug so that we can change the context
permanently.

Vit Mojzis
SELinux Solutions
Red Hat, Inc.


----- Original Message -----
From: "m roth" <m.roth(a)5-cent.us&gt;
To: "CentOS" <centos(a)centos.org&gt;, "selinux"
<selinux(a)lists.fedoraproject.org&gt;
Sent: Tuesday, April 26, 2016 5:31:16 PM
Subject: username.pem

Hi, folks,

   Our system gets/creates /var/lib/ssh-x509-auth/<username>,pem, then
deletes it when the log out. selinux (in permissive mode) complains.
First, I changed the context to cert_t, and *now* it complains that
ksh93 wants write, etc access on the directory. grep ssh-x509-auth
/var/log/audit/audit.log | audit2allow offers me this:
#============= sshd_t ==============
allow sshd_t cert_t:dir write;
allow sshd_t var_lib_t:file { write getattr create open ioctl };

So: first, is this an expected behavior; second, is that the correct
fcontext, and, finally, is it safe for me to create this as a local
policy?

Thanks in advance.

         mark
--
selinux mailing list
selinux(a)lists.fedoraproject.org
http://lists.fedoraproject.org/admin/lists/[e-mail]