init_t and sshd

[Vincenzo Ciaglia <vin@netwosix.org>]

Hello, once i solved every problems related to SELinux installation from
scratch i started working on policies for Netwosix.

Here the problem:

vciaglia@vciaglia-desktop:~$ ssh -l vciaglia 192.168.0.4
vciaglia@192.168.0.4's password:
Read from remote host 192.168.0.4: Connection reset by peer
Connection to 192.168.0.4 closed.

In few words i can ssh into my machine only as "root" when i'm in
enforcing mode. So i took a look to the avc denials and audit2allow says
me to add this line to my "init.te":

allow init_t shadow_t:file { getattr read };

So i tried to add the line and rebuild the policy but i get this result:

grep ^portcon tmp/policy.conf.tmp >> policy.conf || true
grep ^netifcon tmp/policy.conf.tmp >> policy.conf || true
grep ^nodecon tmp/policy.conf.tmp >> policy.conf || true
Compiling netwosix policy.21
/usr/bin/checkpolicy policy.conf -o policy.21
/usr/bin/checkpolicy:  loading policy configuration from policy.conf
libsepol.check_assertion_helper: assertion on line 147384 violated by
allow init_t shadow_t:file { read };
libsepol.check_assertions: 1 assertion violations occured
Error while expanding policy
make: *** [policy.21] Error 1

I have read that this means that my init.te file includes a rule that
allows sshd, in this case, to read my /etc/shadow file, and this
violates an assertion in the base policy.

How can i solve the problem?

Thank you!

-- 
Vincenzo Ciaglia - <vin(at)netwosix(dot)org>
Linux Netwosix - <http://www.netwosix.org>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.