Slowroll - ssh using key fails after latest selinux update

[koutsofios]

yesterday (Sat 8/8) there was one of the usual gigantic slowroll updates. it included new versions of selinux. after the update and reboot, when I tried to ssh into the system it asked me for a password even though I have ssh keys set up. I ran restorecon -R -v ~/.ssh and that fixed it. however, I then thought I’d fix any other lingering security problems so I touched the /.autorelabel file and rebooted. after that ssh started asking for a password again. seems like some selinux database is messed up? but doesn’t restorecon use the same db? this happened on all my slowroll systems that use selinux.

after the restorecon command (good):

drwx------. 2 ek ek unconfined_u:object_r:ssh_home_t:s0    6 Jul 25 10:59 agent
-rw-------. 1 ek ek unconfined_u:object_r:ssh_home_t:s0  177 Dec  1  2024 authorized_keys
-rw-r--r--. 1 ek ek unconfined_u:object_r:ssh_home_t:s0 1015 Dec 24  2025 config
-rw-------. 1 ek ek unconfined_u:object_r:ssh_home_t:s0 2610 Aug 24  2022 gh_rsa
-rw-r--r--. 1 ek ek unconfined_u:object_r:ssh_home_t:s0  576 Aug 24  2022 gh_rsa.pub
-rw-------. 1 ek ek unconfined_u:object_r:ssh_home_t:s0  399 Jul 19  2025 id_ed25519
-rw-r--r--. 1 ek ek unconfined_u:object_r:ssh_home_t:s0   88 Jul 19  2025 id_ed25519.pub
-rw-------. 1 ek ek unconfined_u:object_r:ssh_home_t:s0 2590 Oct 10  2025 id_rsa
-rw-r--r--. 1 ek ek unconfined_u:object_r:ssh_home_t:s0  560 Oct 10  2025 id_rsa.pub
-rw-------. 1 ek ek unconfined_u:object_r:ssh_home_t:s0 5175 Jun  3 21:47 known_hosts

after creating /.autorelabel and rebooting (bad):

drwx------. 2 ek ek unconfined_u:object_r:default_t:s0    6 Jul 25 10:59 agent
-rw-------. 1 ek ek unconfined_u:object_r:default_t:s0  177 Dec  1  2024 authorized_keys
-rw-r--r--. 1 ek ek unconfined_u:object_r:default_t:s0 1015 Dec 24  2025 config
-rw-------. 1 ek ek unconfined_u:object_r:default_t:s0 2610 Aug 24  2022 gh_rsa
-rw-r--r--. 1 ek ek unconfined_u:object_r:default_t:s0  576 Aug 24  2022 gh_rsa.pub
-rw-------. 1 ek ek unconfined_u:object_r:default_t:s0  399 Jul 19  2025 id_ed25519
-rw-r--r--. 1 ek ek unconfined_u:object_r:default_t:s0   88 Jul 19  2025 id_ed25519.pub
-rw-------. 1 ek ek unconfined_u:object_r:default_t:s0 2590 Oct 10  2025 id_rsa
-rw-r--r--. 1 ek ek unconfined_u:object_r:default_t:s0  560 Oct 10  2025 id_rsa.pub
-rw-------. 1 ek ek unconfined_u:object_r:default_t:s0 5175 Jun  3 21:47 known_hosts

so the good version has ‘ssh_home_t’ while the bad one has ‘default_t’

[nrickert]

@koutsofios

it asked me for a password even though I have ssh keys set up.

I wonder whether this is related to https://forums.opensuse.org/t/ssh-to-root-failing/195096

[koutsofios]

it does seem to have a rule for /home/…/.ssh/*:

/home/[^/]+/\.ssh(/.*)?                            all files          unconfined_u:object_r:ssh_home_t:s0` 

/etc/rc\.d/init\.d/sshd                            regular file       system_u:object_r:sshd_initrc_exec_t:s0 
/etc/ssh/primes                                    regular file       system_u:object_r:sshd_key_t:s0 
/etc/ssh/ssh_host.*_key                            regular file       system_u:object_r:sshd_key_t:s0 
/etc/ssh/ssh_host.*_key\.pub                       regular file       system_u:object_r:sshd_key_t:s0 
/home/[^/]+/\.ansible/cp/.*                        socket             unconfined_u:object_r:ssh_home_t:s0 
/home/[^/]+/\.shosts                               all files          unconfined_u:object_r:ssh_home_t:s0 
/home/[^/]+/\.ssh(/.*)?                            all files          unconfined_u:object_r:ssh_home_t:s0 
/opt/NX/home/nx/\.ssh(/.*)?                        all files          system_u:object_r:nx_server_home_ssh_t:s0 
/root/\.shosts                                     all files          system_u:object_r:ssh_home_t:s0 
/root/\.ssh(/.*)?                                  all files          system_u:object_r:ssh_home_t:s0 
/run/issue.d(/.*)?                                 all files          system_u:object_r:systemd_ssh_issue_var_run_t:s0 
/run/pam_ssh(/.*)?                                 all files          system_u:object_r:pam_var_run_t:s0 
/run/sshd\.init\.pid                               regular file       system_u:object_r:sshd_var_run_t:s0 
/run/sshd\.pid                                     regular file       system_u:object_r:sshd_var_run_t:s0 
/srv/gitolite/\.ssh(/.*)?                          all files          system_u:object_r:ssh_home_t:s0 
/srv/gitolite3/\.ssh(/.*)?                         all files          system_u:object_r:ssh_home_t:s0 
/usr/NX/home/nx/\.ssh(/.*)?                        all files          system_u:object_r:nx_server_home_ssh_t:s0 
/usr/bin/gsisshd                                   regular file       system_u:object_r:sshd_exec_t:s0 
/usr/bin/kanidm_ssh_authorizedkeys                 regular file       system_u:object_r:kanidm_sshkeys_exec_t:s0 
/usr/bin/kanidm_ssh_authorizedkeys_direct          regular file       system_u:object_r:kanidm_sshkeys_direct_exec_t:s0 
/usr/bin/rssh                                      regular file       system_u:object_r:rssh_exec_t:s0 
/usr/bin/ssh                                       regular file       system_u:object_r:ssh_exec_t:s0 
/usr/bin/ssh-agent                                 regular file       system_u:object_r:ssh_agent_exec_t:s0 
/usr/bin/ssh-keygen                                regular file       system_u:object_r:ssh_keygen_exec_t:s0 
/usr/bin/sshd                                      regular file       system_u:object_r:sshd_exec_t:s0 
/usr/bin/sshd-gen-keys-start                       regular file       system_u:object_r:sshd_keygen_exec_t:s0 
/usr/bin/sshd-keygen                               regular file       system_u:object_r:sshd_keygen_exec_t:s0 
/usr/lib(64)?/nagios/plugins/check_ssh             regular file       system_u:object_r:nagios_services_plugin_exec_t:s0 
/usr/lib/openssh/ssh-keysign                       regular file       system_u:object_r:ssh_keysign_exec_t:s0 
/usr/lib/ssh/.*                                    regular file       system_u:object_r:bin_t:s0 
/usr/lib/systemd/system-generators/systemd-ssh-generator regular file       system_u:object_r:systemd_ssh_generator_exec_t:s0 
/usr/lib/systemd/system/sshd-keygen.*              regular file       system_u:object_r:sshd_keygen_unit_file_t:s0 
/usr/lib/systemd/system/sshd.*                     regular file       system_u:object_r:sshd_unit_file_t:s0 
/usr/lib/systemd/systemd-ssh-issue                 regular file       system_u:object_r:systemd_ssh_issue_exec_t:s0 
/usr/libexec/(open)?ssh/ssh-keysign                regular file       system_u:object_r:ssh_keysign_exec_t:s0 
/usr/libexec/(open)?ssh/ssh-pkcs11-helper          regular file       system_u:object_r:ssh_agent_exec_t:s0 
/usr/libexec/(open)?ssh/sshd-auth                  regular file       system_u:object_r:sshd_auth_exec_t:s0 
/usr/libexec/(open)?ssh/sshd-keygen                regular file       system_u:object_r:sshd_keygen_exec_t:s0 
/usr/libexec/(open)?ssh/sshd-session               regular file       system_u:object_r:sshd_session_exec_t:s0 
/usr/libexec/nm-ssh-service                        regular file       system_u:object_r:ssh_exec_t:s0 
/usr/libexec/openssh/sftp-server                   regular file       system_u:object_r:bin_t:s0 
/usr/libexec/rssh_chroot_helper                    regular file       system_u:object_r:rssh_chroot_helper_exec_t:s0 
/usr/libexec/sssd/sssd_ssh                         regular file       system_u:object_r:sssd_exec_t:s0 
/var/empty/sshd/etc/localtime                      regular file       system_u:object_r:locale_t:s0 
/var/lib/[^/]+/\.ssh(/.*)?                         all files          system_u:object_r:ssh_home_t:s0 
/var/lib/amanda/\.ssh(/.*)?                        all files          system_u:object_r:ssh_home_t:s0 
/var/lib/nocpulse/\.ssh(/.*)?                      all files          system_u:object_r:ssh_home_t:s0 
/var/lib/nxserver/home/.ssh(/.*)?                  all files          system_u:object_r:nx_server_home_ssh_t:s0 
/var/lib/one/\.ssh(/.*)?                           all files          system_u:object_r:ssh_home_t:s0 
/var/lib/openshift/[^/]+/\.ssh(/.*)?               all files          system_u:object_r:ssh_home_t:s0 
/var/lib/openshift/gear/[^/]+/\.ssh(/.*)?          all files          system_u:object_r:ssh_home_t:s0 
/var/lib/pam_ssh(/.*)?                             all files          system_u:object_r:var_auth_t:s0 
/var/lib/pgsql/\.ssh(/.*)?                         all files          system_u:object_r:ssh_home_t:s0 
/var/lib/stickshift/[^/]+/\.ssh(/.*)?              all files          system_u:object_r:ssh_home_t:s0

[koutsofios]

in my case root can ssh with a key just fine, even though I never ran restorecon on its .ssh directory.