Re: Defining SELinux users, "Unable to get valid context...". Help!

[Dominick Grift <dominick.grift@defensec.nl>]

Dominick Grift <dominick.grift@defensec.nl> writes:

> Peter Whittaker <peterwhittaker@sphyrnasecurity.com> writes:
>
>> On Sun, Feb 14, 2021 at 2:32 AM Dominick Grift
>> <dominick.grift@defensec.nl> wrote:
>>> Peter Whittaker <peterwhittaker@sphyrnasecurity.com> writes:
>>>
>>> > Yes, I may need it, but at this point I want to understand why one
>>> > works and the other doesn't.
>>>
>>> I know that the openssh-server in red-hat based distributions has custom
>>> selinux patches.
>>
>> Well. Just fixed it by accident. The relevant line of /etc/pam.d/sshd was
>>
>>     session    required     pam_selinux.so open env_params
>>
>> In an attempt to debug the problem, I changed this to
>>
>>     session    required     pam_selinux.so open select_context
>>
>> PAM did not ask me for a context, but did set the context correctly.
>>
>>     session    required     pam_selinux.so open
>>
>> also worked fine.
>
> oh right! ... yes corner case...
>
> to make it work with env_params you need:
>
> allow xferHigh2Local_t self:context contains;
>
> Sorry for overlooking that
>
>>
>> I need to do some research on this. The env_params option was a system
>> default, I dislike changing system defaults unless I understand why.
>>
>> Now to figure why the auditor's context is failing to be set.

I think this patch is why you need "context containts" when you have
"env_params" set: https://src.fedoraproject.org/rpms/openssh/blob/rawhide/f/openssh-7.8p1-role-mls.patch



>>
>> P
>>
>> Peter Whittaker
>> Director, Business Development
>> www.SphyrnaSecurity.com
>> +1 613 864 5337

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift