I have search here but found no answer to the exact same problem this guy faced: http://forums.fedoraforum.org/showthread.php?p=1043553 - he got no answer either.

Is it too much of a co-incidence it just started happening after the fedora servers were hacked? I have automatic updates on.

System is Fed 9. Thank you.

Which Fedora servers got cracked then?


Problem, OK, but you didn't post if you tried his workarounds? If you tried his local policy then that should not work because he makes an error using "file read" but that should be "file getattr".

I'm sorry for saying that the way I did, I guess I was being paranoid! I suppose thats the knock on problem now, anything affecting SSH gets folk jumpy.

You were right, those workarounds didn't help, but I have some more information. First, there has been a change to nxsever because it used to put its keys in /etc/nxserver ... and now it uses /usr/NX/ ...

But the main thing I found is if I use setenforce 0 it all works! Does anyone know the exact change I need to make to SElinux to fix this please?

Here is the full line from /var/messages:

Aug 25 09:32:08 scooby setroubleshoot: SELinux is preventing sshd (sshd_t) "getattr" to /usr/NX/home/nx/.ssh/authorized_keys2 (usr_t). For complete SELinux messages. run sealert -l d89f8e82-3d16-454e-a990-8
c998f411d85

Being paranoid is OK IMHO, just watch our for spreading FUD. If you suspect tampering with any distribution check their security mailing list. If it's not listed and you still suspect a problem check with the distribution's Security Officer or security team. They are able to deal with things swiftyly, accurately and decisively.


Even *with* applying my note on the "getattr" attribute?


That puts SE Linux in permissive mode, in other words it does nothing but log errors.


If you run 'sealert -l d89f8e82-3d16-454e-a990-8c998f411d85|audit2allow' you should get a line to add to your local policy.