commit f1b82547e654ea81ab2f0cd40d7d98a3a30a7ef7
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 15 15:03:14 2022 +0000
Add changelog entry
commit 02a7b703c69f875874c34db3ebc43396312ec486
Merge: 9ac317d87 987f81c3c
Author: Colin Watson <cjwatson@debian.org>
Date: Tue Nov 15 15:02:35 2022 +0000
Merge branch 'selinux' into 'master'
Do not copy security context in postinst
See merge request ssh-team/openssh!19
commit 987f81c3cdcaf5bf13c01e965ab4628df2185a70
Author: Christian Göttsche <cgzones@googlemail.com>
Date: Tue Nov 15 15:31:11 2022 +0100
Do not copy security context in postinst
Do not copy the SELinux context of the example configuration file in
the postinst script of openssh-server, cause the source context might
not be valid at the destination, e.g. if /tmp is mounted on a tmpfs:
type=PROCTITLE msg=audit(11/15/22 15:02:37.425:138) : proctitle=cp -a /usr/share/openssh/sshd_config /tmp/tmp.ElPamcNGQn
type=PATH msg=audit(11/15/22 15:02:37.425:138) : item=0 name=/tmp/tmp.ElPamcNGQn inode=271 dev=00:26 mode=file,600 ouid=root ogid=root rdev=00:00 obj=root:object_r:dpkg_script_tmp_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(11/15/22 15:02:37.425:138) : cwd=/
type=SYSCALL msg=audit(11/15/22 15:02:37.425:138) : arch=x86_64 syscall=lsetxattr success=no exit=EACCES(Permission denied) a0=0x7ffca403b605 a1=0x7f5a8198079d a2=0x5559c429dcc0 a3=0x1b items=1 ppid=6632 pid=6634 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts6 ses=4 comm=cp exe=/usr/bin/cp subj=root:sysadm_r:dpkg_script_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(11/15/22 15:02:37.425:138) : avc: denied { associate } for pid=6634 comm=cp name=tmp.ElPamcNGQn dev="tmpfs" ino=271 scontext=system_u:object_r:usr_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0
Use the default context for the target instead.
Also create /etc/ssh with the default SELinux context.
There is 1 open security issue in bullseye.
You can find information about how to handle this issue in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/o/openssh.png){kind=link}