Add default contexts for sshd-seesion

vmojzis · zpytela · commit 1177a3241b43 · 2025-09-16T12:44:57.000+02:00
In openssh-9.9 (Fedora 41), the sshd server has been split into a listener
binary, sshd(8), and a per-session binary, "sshd-session".

sshd-session runs in a new domain sshd_session_t, which is now used to
transition into an appropriate login context.

Signed-off-by: Vit Mojzis &lt;vmojzis@redhat.com&gt;
diff --git a/config/appconfig-mcs/default_contexts b/config/appconfig-mcs/default_contexts
@@ -2,6 +2,7 @@ system_r:crond_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 un
 system_r:local_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 system_r:remote_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 unconfined_r:unconfined_t:s0
 system_r:sshd_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
+system_r:sshd_session_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 system_r:sulogin_t:s0		sysadm_r:sysadm_t:s0
 system_r:xdm_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 
diff --git a/config/appconfig-mcs/guest_u_default_contexts b/config/appconfig-mcs/guest_u_default_contexts
@@ -4,5 +4,6 @@ system_r:initrc_su_t:s0		guest_r:guest_t:s0
 system_r:local_login_t:s0	guest_r:guest_t:s0
 system_r:remote_login_t:s0	guest_r:guest_t:s0
 system_r:sshd_t:s0		guest_r:guest_t:s0
+system_r:sshd_session_t:s0		guest_r:guest_t:s0
 system_r:cockpit_session_t:s0		guest_r:guest_t:s0
 system_r:init_t:s0		guest_r:guest_t:s0
diff --git a/config/appconfig-mcs/root_default_contexts b/config/appconfig-mcs/root_default_contexts
@@ -9,3 +9,4 @@ user_r:user_su_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:s
 # Uncomment if you want to automatically login as sysadm_r
 #
 #system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+#system_r:sshd_session_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
diff --git a/config/appconfig-mcs/staff_u_default_contexts b/config/appconfig-mcs/staff_u_default_contexts
@@ -1,6 +1,7 @@
 system_r:local_login_t:s0	staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:remote_login_t:s0	staff_r:staff_t:s0
 system_r:sshd_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:sshd_session_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:cockpit_session_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:crond_t:s0		staff_r:staff_t:s0 staff_r:cronjob_t:s0
 system_r:xdm_t:s0		staff_r:staff_t:s0
diff --git a/config/appconfig-mcs/sysadm_u_default_contexts b/config/appconfig-mcs/sysadm_u_default_contexts
@@ -1,6 +1,7 @@
 system_r:local_login_t:s0	sysadm_r:sysadm_t:s0
 system_r:remote_login_t:s0	sysadm_r:sysadm_t:s0
 system_r:sshd_t:s0		sysadm_r:sysadm_t:s0
+system_r:sshd_session_t:s0		sysadm_r:sysadm_t:s0
 system_r:cockpit_session_t:s0		sysadm_r:sysadm_t:s0
 system_r:crond_t:s0		sysadm_r:sysadm_t:s0
 system_r:xdm_t:s0		sysadm_r:sysadm_t:s0
diff --git a/config/appconfig-mcs/unconfined_u_default_contexts b/config/appconfig-mcs/unconfined_u_default_contexts
@@ -4,6 +4,7 @@ system_r:local_login_t:s0	unconfined_r:unconfined_t:s0
 system_r:remote_login_t:s0	unconfined_r:unconfined_t:s0
 system_r:rshd_t:s0		unconfined_r:unconfined_t:s0
 system_r:sshd_t:s0		unconfined_r:unconfined_t:s0
+system_r:sshd_session_t:s0	unconfined_r:unconfined_t:s0
 system_r:cockpit_session_t:s0		unconfined_r:unconfined_t:s0
 system_r:sysadm_su_t:s0		unconfined_r:unconfined_t:s0
 system_r:unconfined_t:s0	unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-mcs/user_u_default_contexts b/config/appconfig-mcs/user_u_default_contexts
@@ -2,6 +2,7 @@ system_r:init_t:s0	user_r:user_t:s0
 system_r:local_login_t:s0	user_r:user_t:s0
 system_r:remote_login_t:s0	user_r:user_t:s0
 system_r:sshd_t:s0		user_r:user_t:s0
+system_r:sshd_session_t:s0		user_r:user_t:s0
 system_r:cockpit_session_t:s0		user_r:user_t:s0
 system_r:crond_t:s0		user_r:user_t:s0 user_r:cronjob_t:s0
 system_r:xdm_t:s0		user_r:user_t:s0
diff --git a/config/appconfig-mcs/xguest_u_default_contexts b/config/appconfig-mcs/xguest_u_default_contexts
@@ -3,6 +3,7 @@ system_r:initrc_su_t:s0		xguest_r:xguest_t:s0
 system_r:local_login_t:s0	xguest_r:xguest_t:s0
 system_r:remote_login_t:s0	xguest_r:xguest_t:s0
 system_r:sshd_t:s0		xguest_r:xguest_t:s0
+system_r:sshd_session_t:s0		xguest_r:xguest_t:s0
 system_r:cockpit_session_t:s0		xguest_r:xguest_t:s0
 system_r:xdm_t:s0		xguest_r:xguest_t:s0
 system_r:init_t:s0		xguest_r:xguest_t:s0
diff --git a/config/appconfig-mls/default_contexts b/config/appconfig-mls/default_contexts
@@ -2,6 +2,7 @@ system_r:crond_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 un
 system_r:local_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 system_r:remote_login_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 unconfined_r:unconfined_t:s0
 system_r:sshd_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
+system_r:sshd_session_t:s0	user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 system_r:sulogin_t:s0		sysadm_r:sysadm_t:s0
 system_r:xdm_t:s0		user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0
 
diff --git a/config/appconfig-mls/guest_u_default_contexts b/config/appconfig-mls/guest_u_default_contexts
@@ -3,5 +3,6 @@ system_r:crond_t:s0		guest_r:guest_t:s0
 system_r:local_login_t:s0	guest_r:guest_t:s0
 system_r:remote_login_t:s0	guest_r:guest_t:s0
 system_r:sshd_t:s0		guest_r:guest_t:s0
+system_r:sshd_session_t:s0		guest_r:guest_t:s0
 system_r:cockpit_session_t:s0		guest_r:guest_t:s0
 system_r:init_t:s0		guest_r:guest_t:s0
diff --git a/config/appconfig-mls/root_default_contexts b/config/appconfig-mls/root_default_contexts
@@ -9,3 +9,4 @@ user_r:user_su_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:s
 # Uncomment if you want to automatically login as sysadm_r
 #
 #system_r:sshd_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+#system_r:sshd_session_t:s0		unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
diff --git a/config/appconfig-mls/staff_u_default_contexts b/config/appconfig-mls/staff_u_default_contexts
@@ -1,6 +1,7 @@
 system_r:local_login_t:s0	staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:remote_login_t:s0	staff_r:staff_t:s0
 system_r:sshd_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
+system_r:sshd_session_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:cockpit_session_t:s0		staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
 system_r:crond_t:s0		staff_r:staff_t:s0 staff_r:cronjob_t:s0
 system_r:xdm_t:s0		staff_r:staff_t:s0
diff --git a/config/appconfig-mls/unconfined_u_default_contexts b/config/appconfig-mls/unconfined_u_default_contexts
@@ -4,6 +4,7 @@ system_r:local_login_t:s0	unconfined_r:unconfined_t:s0
 system_r:remote_login_t:s0	unconfined_r:unconfined_t:s0
 system_r:rshd_t:s0		unconfined_r:unconfined_t:s0
 system_r:sshd_t:s0		unconfined_r:unconfined_t:s0
+system_r:sshd_session_t:s0	unconfined_r:unconfined_t:s0
 system_r:cockpit_session_t:s0		unconfined_r:unconfined_t:s0
 system_r:sysadm_su_t:s0		unconfined_r:unconfined_t:s0
 system_r:unconfined_t:s0	unconfined_r:unconfined_t:s0
diff --git a/config/appconfig-mls/user_u_default_contexts b/config/appconfig-mls/user_u_default_contexts
@@ -2,6 +2,7 @@ system_r:init_t:s0	user_r:user_t:s0
 system_r:local_login_t:s0	user_r:user_t:s0
 system_r:remote_login_t:s0	user_r:user_t:s0
 system_r:sshd_t:s0		user_r:user_t:s0
+system_r:sshd_session_t:s0		user_r:user_t:s0
 system_r:cockpit_session_t:s0		user_r:user_t:s0
 system_r:crond_t:s0		user_r:user_t:s0 user_r:cronjob_t:s0
 system_r:xdm_t:s0		user_r:user_t:s0
diff --git a/config/appconfig-mls/xguest_u_default_contexts b/config/appconfig-mls/xguest_u_default_contexts
@@ -3,6 +3,7 @@ system_r:initrc_su_t:s0		xguest_r:xguest_t:s0
 system_r:local_login_t:s0	xguest_r:xguest_t:s0
 system_r:remote_login_t:s0	xguest_r:xguest_t:s0
 system_r:sshd_t:s0		xguest_r:xguest_t:s0
+system_r:sshd_session_t:s0		xguest_r:xguest_t:s0
 system_r:cockpit_session_t:s0		xguest_r:xguest_t:s0
 system_r:xdm_t:s0		xguest_r:xguest_t:s0
 system_r:init_t:s0		xguest_r:xguest_t:s0
diff --git a/config/appconfig-standard/default_contexts b/config/appconfig-standard/default_contexts
@@ -2,6 +2,7 @@ system_r:crond_t	user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:un
 system_r:local_login_t	user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:unconfined_t
 system_r:remote_login_t	user_r:user_t staff_r:staff_t unconfined_r:unconfined_t
 system_r:sshd_t		user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:unconfined_t
+system_r:sshd_session_t	user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:unconfined_t
 system_r:sulogin_t	sysadm_r:sysadm_t
 system_r:xdm_t		user_r:user_t staff_r:staff_t sysadm_r:sysadm_t unconfined_r:unconfined_t
 
diff --git a/config/appconfig-standard/guest_u_default_contexts b/config/appconfig-standard/guest_u_default_contexts
@@ -4,5 +4,6 @@ system_r:initrc_su_t		guest_r:guest_t
 system_r:local_login_t		guest_r:guest_t
 system_r:remote_login_t		guest_r:guest_t
 system_r:sshd_t			guest_r:guest_t
+system_r:sshd_session_t			guest_r:guest_t
 system_r:cockpit_session_t			guest_r:guest_t
 system_r:init_t			guest_r:guest_t
diff --git a/config/appconfig-standard/root_default_contexts b/config/appconfig-standard/root_default_contexts
@@ -9,3 +9,4 @@ user_r:user_su_t	unconfined_r:unconfined_t sysadm_r:sysadm_t staff_r:staff_t use
 # Uncomment if you want to automatically login as sysadm_r
 #
 #system_r:sshd_t	unconfined_r:unconfined_t sysadm_r:sysadm_t staff_r:staff_t user_r:user_t
+#system_r:sshd_session_t	unconfined_r:unconfined_t sysadm_r:sysadm_t staff_r:staff_t user_r:user_t
diff --git a/config/appconfig-standard/staff_u_default_contexts b/config/appconfig-standard/staff_u_default_contexts
@@ -1,6 +1,7 @@
 system_r:local_login_t		staff_r:staff_t sysadm_r:sysadm_t
 system_r:remote_login_t		staff_r:staff_t
 system_r:sshd_t			staff_r:staff_t sysadm_r:sysadm_t
+system_r:sshd_session_t			staff_r:staff_t sysadm_r:sysadm_t
 system_r:cockpit_session_t			staff_r:staff_t sysadm_r:sysadm_t
 system_r:crond_t		staff_r:staff_t staff_r:cronjob_t
 system_r:xdm_t			staff_r:staff_t
diff --git a/config/appconfig-standard/sysadm_u_default_contexts b/config/appconfig-standard/sysadm_u_default_contexts
@@ -1,6 +1,7 @@
 system_r:local_login_t:s0	sysadm_r:sysadm_t:s0
 system_r:remote_login_t:s0	sysadm_r:sysadm_t:s0
 system_r:sshd_t:s0		sysadm_r:sysadm_t:s0
+system_r:sshd_session_t:s0		sysadm_r:sysadm_t:s0
 system_r:cockpit_session_t:s0		sysadm_r:sysadm_t:s0
 system_r:crond_t:s0		sysadm_r:sysadm_t:s0
 system_r:xdm_t:s0		sysadm_r:sysadm_t:s0
diff --git a/config/appconfig-standard/unconfined_u_default_contexts b/config/appconfig-standard/unconfined_u_default_contexts
@@ -4,6 +4,7 @@ system_r:local_login_t		unconfined_r:unconfined_t
 system_r:remote_login_t		unconfined_r:unconfined_t
 system_r:rshd_t			unconfined_r:unconfined_t
 system_r:sshd_t			unconfined_r:unconfined_t
+system_r:sshd_session_t		unconfined_r:unconfined_t
 system_r:cockpit_session_t:s0		sysadm_r:sysadm_t:s0
 system_r:sysadm_su_t		unconfined_r:unconfined_t
 system_r:unconfined_t		unconfined_r:unconfined_t
diff --git a/config/appconfig-standard/user_u_default_contexts b/config/appconfig-standard/user_u_default_contexts
@@ -2,6 +2,7 @@ system_r:init_t:s0	user_r:user_t:s0
 system_r:local_login_t		user_r:user_t
 system_r:remote_login_t		user_r:user_t
 system_r:sshd_t			user_r:user_t
+system_r:sshd_session_t			user_r:user_t
 system_r:cockpit_session_t			user_r:user_t
 system_r:crond_t		user_r:user_t user_r:cronjob_t
 system_r:xdm_t			user_r:user_t
diff --git a/config/appconfig-standard/xguest_u_default_contexts b/config/appconfig-standard/xguest_u_default_contexts
@@ -3,6 +3,7 @@ system_r:initrc_su_t	xguest_r:xguest_t
 system_r:local_login_t	xguest_r:xguest_t
 system_r:remote_login_t	xguest_r:xguest_t
 system_r:sshd_t		xguest_r:xguest_t
+system_r:sshd_session_t		xguest_r:xguest_t
 system_r:cockpit_session_t		xguest_r:xguest_t
 system_r:xdm_t		xguest_r:xguest_t
 system_r:init_t		xguest_r:xguest_t

Original file line number	Diff line number	Diff line change
`@@ -9,3 +9,4 @@ user_r:user_su_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:s`
`9`	`9`	`# Uncomment if you want to automatically login as sysadm_r`
`10`	`10`	`#`
`11`	`11`	`#system_r:sshd_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0`
	`12`	`+#system_r:sshd_session_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0`