Backport !9672 to 19-3-stable: selinux: add sshd_session_t and sshd_auth_t rules for RHEL 10 / OpenSSH 9.8+

Adam Churequested to merge
backport-10048-selinux-sshd-session-rhel10-19-3 into 19-3-stable

What does this MR do?

Backport of !9672 (merged) to 19-3-stable (cherry-pick of c4e50d42).

Fixes git-over-SSH on RHEL 10 / AlmaLinux 10 with SELinux in Enforcing mode. OpenSSH 9.8+ splits sshd into a listener (sshd_t) and a per-connection handler (sshd-session, running as sshd_session_t). The existing GitLab SELinux modules only grant sshd_t access to the gitlab_shell_t-labelled /var/opt/gitlab/.ssh/authorized_keys, so every SSH key is rejected.

Changes:

  • files/gitlab-selinux/gitlab-19.4.0-sshd-session.te (new): standalone module granting sshd_session_t (OpenSSH 9.8+) and sshd_auth_t (OpenSSH 10.0+) dir and file permissions on gitlab_shell_t objects, wrapped in raw optional blocks so it installs cleanly on RHEL 7/8/9.
  • files/gitlab-selinux/gitlab.te: same rules added to the unified policy (1.0.0 -> 1.1.0), adds the missing dir class declaration, removes a duplicate type sshd_t require.
  • files/gitlab-cookbooks/gitlab/recipes/selinux.rb: installs the new module in the non-unified path and removes it in the unified path.
  • spec/chef/cookbooks/gitlab/recipes/selinux_spec.rb: ChefSpec coverage for both code paths.

Related issues

Related to #10048 (closed) Backport of !9672 (merged)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

  • MR title and description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • Latest Merge Result pipeline is green.
  • When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
  • The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. (N/A)
    • UBT EE pipeline (Trigger:ee-package-ubt) is green

For GitLab team members

  • The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded. (N/A)
  • If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed. (N/A)
  • If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken. (N/A)

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes. (See !9672 (merged))
  • Documentation created/updated. (No user-facing config change)
  • Tests added.
  • Integration tests added to GitLab QA. (N/A, backport)
  • Equivalent MR/issue for the GitLab Chart opened. (N/A, SELinux is Omnibus-only)
  • Validate potential values for new configuration settings. (N/A, no new settings)

Merge request reports