From d358e342f41d4a8684cef2dbea322447efa4091a Mon Sep 17 00:00:00 2001 From: Nick Anderson Date: Fri, 7 Aug 2026 21:52:45 -0500 Subject: [PATCH] Allowed sshd_session_t access to /opt/cfengine on EL10 Ticket: ENT-14405 Changelog: Fixed Federated Reporting transport failing on RHEL 10 hubs --- misc/selinux/cfengine-enterprise.te.el10 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/misc/selinux/cfengine-enterprise.te.el10 b/misc/selinux/cfengine-enterprise.te.el10 index 78c94d7081..1aee2439e4 100644 --- a/misc/selinux/cfengine-enterprise.te.el10 +++ b/misc/selinux/cfengine-enterprise.te.el10 @@ -2,8 +2,15 @@ require { type devpts_t; type systemd_userdbd_runtime_t; type systemd_userdbd_t; + type sshd_session_t; } +#============= special rules for Federated Reporting ============= +# EL10 serves connections in sshd_session_t, not sshd_t, and does not grant it +# the generic file_type:dir search +allow sshd_session_t cfengine_var_lib_t:dir { getattr open search }; +allow sshd_session_t cfengine_var_lib_t:file { getattr open read }; + #============= cfengine_apachectl_t ============== allow cfengine_apachectl_t devpts_t:dir { getattr search }; allow cfengine_apachectl_t proc_t:file getattr;