Draft: selinux: add sshd_session_t and sshd_auth_t rules for RHEL 10 / OpenSSH 9.8+

Adam Churequested to merge
duo/fix/10048-selinux-sshd-session-rhel10 into master

What does this MR do?

Fixes git-over-SSH on RHEL 10 / AlmaLinux 10 with SELinux in Enforcing mode.

OpenSSH 9.8 (shipped as openssh-server-9.9p1 on RHEL 10 / AlmaLinux 10) split the sshd daemon into two binaries:

  • sshd — the listener (still runs as sshd_t)
  • sshd-session — the per-connection handler (runs as the new sshd_session_t domain)

Authentication now runs in sshd_session_t, but the existing GitLab SELinux modules only grant sshd_t access to the gitlab_shell_t-labelled /var/opt/gitlab/.ssh/authorized_keys. As a result, sshd-session cannot read the authorized keys file and every SSH key is rejected.

AVC denials observed on gitlab-ee-19.2.1-ee.0.el10:

scontext=sshd_session_t tcontext=gitlab_shell_t denied { search } on .ssh dir
scontext=sshd_session_t tcontext=gitlab_shell_t denied { read open getattr } on authorized_keys

Changes

  1. files/gitlab-selinux/gitlab-19.2.0-sshd-session.te (new file) — standalone SELinux module granting sshd_session_t (OpenSSH 9.8+, RHEL 10) and sshd_auth_t (OpenSSH 10.0+, Fedora 43) the necessary dir and file permissions on gitlab_shell_t objects. Both types are wrapped in optional_policy blocks so the module installs cleanly on RHEL 7/8/9 where those types do not exist.

  2. files/gitlab-selinux/gitlab.te (updated, version 1.0.0 → 1.1.0) — adds the same optional_policy blocks to the unified policy, adds the missing dir class declaration, and removes a duplicate type sshd_t require entry.

  3. files/gitlab-cookbooks/gitlab/recipes/selinux.rb (updated) — installs the new standalone module in the non-unified path; removes it (migrating to the unified policy) in the unified path. Follows the same pattern as the earlier fix for gitlab-13.5.0-gitlab-shell.

  4. spec/chef/cookbooks/gitlab/recipes/selinux_spec.rb (updated) — adds ChefSpec tests covering both the unified and non-unified code paths for the new module.

The config/software/gitlab-selinux.rb build script already compiles all *.te files in files/gitlab-selinux/ via checkmodule + semodule_package, so no build script changes are needed.

Related issues

Closes #10048 (closed)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

  • MR title and description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • Latest Merge Result pipeline is green.
  • When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
  • The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable.
    • UBT EE pipeline (Trigger:ee-package-ubt) is green

For GitLab team members

If you don't have access to this, the reviewer should trigger these jobs for you during the review process.

  • The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded.
  • If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed.
  • If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken.

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes.
  • Documentation created/updated.
  • Tests added. (ChefSpec tests added for both unified and non-unified policy paths)
  • Integration tests added to GitLab QA.
  • Equivalent MR/issue for the GitLab Chart opened. (N/A — SELinux policy is package-specific)
  • Validate potential values for new configuration settings. (N/A — no new configuration settings)

Merge request reports