Backport !9744 to 19-3-stable: Allow sshd fast SSH key lookup under SELinux

Adam Churequested to merge
backport-438140-selinux-connectto-authorized-keys-19-3 into 19-3-stable

What does this MR do?

Backport of !9744 (merged) to 19-3-stable (cherry-pick of d4b61859).

Fixes fast SSH key lookup (AuthorizedKeysCommand via gitlab-shell-authorized-keys-check) failing on EL 9 and EL 10 with SELinux in Enforcing mode. The AVC denial was { connectto } on unix_stream_socket from sshd_t to unconfined_service_t (the Workhorse socket).

Changes:

  • files/gitlab-selinux/gitlab-10.5.0-ssh-authorized-keys.te (1.0 -> 1.1): grants sshd_t unconfined_service_t:unix_stream_socket connectto and var_log_t:file { open append }; adds optional {} blocks for sshd_session_t (OpenSSH 9.8+ / EL 10) and sshd_auth_t (OpenSSH 10+) granting connectto, http_cache_port_t name_connect, and var_log_t { open append }.
  • files/gitlab-selinux/gitlab.te (1.1.0 -> 1.2.0): same rules added to the unified policy.
  • files/gitlab-cookbooks/gitlab/recipes/selinux.rb + SELinuxHelper.module_installed_and_current?: the semodule -i resources for gitlab-10.5.0-ssh-authorized-keys and the unified gitlab module now compare the installed module (semodule -E) byte-for-byte against the shipped .pp, so upgraded hosts pick up the new policy once and reconfigure stays idempotent.
  • ChefSpec coverage in selinux_spec.rb and selinux_helper_spec.rb.

Depends on !9765 (merged) (backport of !9672 (merged)), already merged to 19-3-stable, for the sshd_session_t baseline on EL 10.

Related issues

Related to gitlab#438140 (closed) Backport of !9744 (merged)

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

  • MR title and description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • Latest Merge Result pipeline is green.
  • When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
  • The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. (N/A)
    • UBT EE pipeline (Trigger:ee-package-ubt) is green

For GitLab team members

  • The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded. (N/A)
  • If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed. (N/A)
  • If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken. (N/A)

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes. (See !9744 (merged))
  • Documentation created/updated. (No user-facing config change)
  • Tests added.
  • Integration tests added to GitLab QA. (N/A, backport)
  • Equivalent MR/issue for the GitLab Chart opened. (N/A, SELinux is Omnibus-only)
  • Validate potential values for new configuration settings. (N/A, no new settings)

Merge request reports