SELinux SSH regression on Fedora-44

[jelly]

Caused by https://src.fedoraproject.org/rpms/openssh/c/c3d6c51bfca1cf6a2d452186c241470e63e06851?branch=rawhide

See containers/podman#27551 (comment) for debugging details.

Downstream report: https://bugzilla.redhat.com/show_bug.cgi?id=2418587

[martinpitt]

Naughty added in #8507

[jelly]

Another issue happens in Cockpit on rawhide.:

Dec 04 09:01:08 fedora-rawhide-127-0-0-2-2201 setroubleshoot[1345]: SELinux is preventing sshd-auth from using the setuid capability. For complete SELinux messages run: sealert -l 9e957b8f-3cea-46aa-ae7e-926597cce6d7
Dec 04 09:01:08 fedora-rawhide-127-0-0-2-2201 setroubleshoot[1345]: SELinux is preventing sshd-auth from using the setuid capability.

                                                                    *****  Plugin catchall (100. confidence) suggests   **************************

                                                                    If you believe that sshd-auth should have the setuid capability by default.
                                                                    Then you should report this as a bug.
                                                                    You can generate a local policy module to allow this access.
                                                                    Do
                                                                    allow this access for now by executing:
                                                                    # ausearch -c 'sshd-auth' --raw | audit2allow -M my-sshdauth
                                                                    # semodule -X 300 -i my-sshdauth.pp

It reproduces with:

[jelle@carbon][~/projects/cockpit/main]%ssh root@c passwd -S
Warning: Permanently added '[127.0.0.2]:2201' (ED25519) to the list of known hosts.

But not with an interactive session

[jelle@carbon][~/projects/cockpit/main]%ssh root@c
Warning: Permanently added '[127.0.0.2]:2201' (ED25519) to the list of known hosts.
Web console: https://fedora-rawhide-127-0-0-2-2201:9090/

Last login: Thu Dec  4 09:01:06 2025 from 172.27.0.2
[root@fedora-rawhide-127-0-0-2-2201 ~]# passwd -S
root P 2025-12-02 -1 -1 -1 -1

[martinpitt]

Bump -- let's do another round here. https://bugzilla.redhat.com/show_bug.cgi?id=2418587 is closed, but without being logged in I can't see why, and RH login is broken at the moment.