<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Package: selinux-policy-default<br class="">Version: 2:2.20220520-1<br class=""><br class="">Info:<br class="">When running SELinux on a freshly installed ‚Debian‘ (‚Stable‘, ‚Testing‘) in ‚enforcing‘ mode, additional policies (e.g. for ‚bash‘ or ‚systemd-resolved‘) are missing.<br class=""><br class="">Issue(s):<div class=""><br class="">• systemd-resolved<br class="">‚system-resolved‘ can not be started via systemd unit file. You will see errors like ‚Failed to initialize SELinux labeling handle: No such file or directory‘. Unfortunately, this is misleading in this case and is ‚libselinux-1‘ related (reported within an additional bug report). However, there’s still an issue which isn’t reported or logged in any case. Within the code you can see the following block:<br class=""><br class="">(optional base_optional_1526<br class=""> (typeattributeset cil_gen_require selinux_config_t)<br class=""> (dontaudit systemd_resolved_t selinux_config_t (dir (getattr open search)))<br class=""> (dontaudit systemd_resolved_t selinux_config_t (file (ioctl read getattr lock open)))<br class="">)<br class=""><br class="">Which means that it is declared as ‚dontaudit‘. Removing the ‚dontaudit‘ attribute allows us fetch the missing rule and to create a policy for this:<br class=""><br class="">AVC avc: denied { read } for pid=4016 comm="systemd-resolve" name="config" dev="sda1" ino=531948 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:selinux_config_t:s0 tclass=file permissive=0<br class=""><br class=""><br class=""><div class="">• /bin/bash: Permission denied<br class=""></div>Trying to initialize a SSH session results directly in:<br class=""><br class="">Linux testing 5.16.0-6-amd64 #1 SMP PREEMPT Debian 5.16.18-1 (2022-03-29) x86_64<br class="">The programs included with the Debian GNU/Linux system are free software;<br class="">the exact distribution terms for each program are described in the<br class="">individual files in /usr/share/doc/*/copyright.<br class=""><br class="">Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent<br class="">permitted by applicable law.<br class="">Last login: Mon Jun 13 08:22:29 2022 from 10.0.2.2<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>/bin/bash: Permission denied<br class="">Connection to 127.0.0.1 closed.<br class=""><br class="">Luckily you can still use the regular console for logging in. However, this is just to mention here and hasn’t been further analyzed.<br class=""><br class="">How to reproduce:<br class=""><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Use a Debian Stable or Testing minimal installation<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Remove AppArmor (apt remove apparmor)<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Install SELinux (apt-get install selinux-basics selinux-policy-default auditd)<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Run ‚selinux-activate‘ (Keep in mind, this will only set SELinux to ‚permissive‘ mode, not ‚enforcing’)<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Reboot (it will ‚relabel‘ during the boot)<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Edit ‚/etc/selinux/config‘ an switch ‚SELINUX‘ from ‚permissive‘ to ‚enforcing‘<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Reboot<br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>• Now, you can reproduce the mentioned issues (ssh login bash permission, systemd-resolved) <br class=""></div><div class=""><br class=""></div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">If you need further information or help for debugging, feel free to ask.</span><div class=""><font color="#000000" class=""><span style="caret-color: rgb(0, 0, 0);" class=""><br class=""></span></font><div class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">Thanks,</div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">gyptazy</div></div></div></div></body></html>