Add SELinux policy for fast SSH key lookup on RHEL 9 & 10

🤖 (Duo generated) What does this MR do?

Adds a new SELinux policy module to fix SSH authentication failures when using fast SSH key lookup on RHEL 9 and derivatives (Rocky Linux, AlmaLinux).

Related issues

Closes gitlab#438140 (closed)

Problem

On RHEL 9 and derivatives, the gitlab-workhorse process runs in the unconfined_service_t SELinux context. When using fast SSH key lookups via AuthorizedKeysCommand, the gitlab-shell-authorized-keys-check binary is executed by sshd (running in sshd_t context) and needs to connect to gitlab-workhorse's Unix socket to query the internal API.

Without the appropriate SELinux policy, this connection is denied with:

type=AVC msg=audit(...): avc: denied { connectto } for
  comm="gitlab-shell-au" path="/var/opt/gitlab/gitlab-workhorse/sockets/socket"
  scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023
  tcontext=system_u:system_r:unconfined_service_t:s0
  tclass=unix_stream_socket permissive=0

Solution

This MR adds a new SELinux policy module (gitlab-sshd-workhorse) that grants the necessary permission for sshd_t to connect to Unix stream sockets owned by processes running in unconfined_service_t context.

Changes

• Add gitlab-sshd-workhorse.te SELinux policy module
• Add gitlab-sshd-workhorse.pp compiled policy module
• Update selinux recipe to install/remove the new module
• Update SELinux README with documentation

Testing

Tested on AlmaLinux 9.8 with GitLab 19.1.0-ee:

1. ✅ Created fresh AlmaLinux 9 VM
2. ✅ Installed GitLab EE
3. ✅ Configured fast SSH key lookup with AuthorizedKeysCommand
4. ✅ Reproduced the SELinux denial issue
5. ✅ Applied the new policy module
6. ✅ Verified SSH authentication works with SELinux enforcing
7. ✅ Confirmed 0 SELinux denials in audit log

Checklist

• SELinux policy tested on RHEL 9 derivative (AlmaLinux 9.8)
• Policy is minimal and only grants necessary permissions
• Documentation updated
• Pipeline passes
• Labeled workflowin dev