Re: trouble with ssh in today's rawhide + refpolicy

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Tue, 2007-10-23 at 09:23 -0400, Stephen Smalley wrote:
> On Tue, 2007-10-23 at 13:09 +0000, Christopher J. PeBenito wrote:
> > On Mon, 2007-10-22 at 17:26 -0400, Eamon Walsh wrote:
> > > On a rawhide box updated this afternoon, running refpolicy trunk in mcs 
> > > mode, I get the following after rebooting the box and logging in over ssh:
> > > 
> > > $ id -Z
> > > sysadm_u:sysadm_r:system_chkpwd_t:s0
> > 
> > Do you have ssh_sysadm_login on?  Also, it seems odd that this would
> > happen, since this combination doesn't show up in default_contexts, and
> > the only auto transition to system_chkpwd_t from sshd_t is via
> > chkpwd_exec_t.
> 
> We've seen this kind of behavior before when the
> get_ordered_context_list() logic fails to get any contexts from
> security_compute_user() that correspond with any of the partial contexts
> in default_contexts - it then falls back to just returning the entire
> reachable list.

Ok.  For some reason I always thought it would just fail if nothing
worked from default_contexts.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.