Gitlab SSH not working after 19.3 upgrade on Alma Linux

Hello everyone!

I had some trouble with Gitlab these days, after I upgraded it to 19.3 together with my Alma Linux dependencies the SSH push/pull stopped working, and the cause was a drift in the SELinux policies.

I tried running gitlab-ctl apply-sepolicy, reconfigure and other commands but nothing seemed to work. It took me some time to find the root-cause of the issue, initially I thought that my ssh client of Fedora is borked, I also use 1Password to manage the ssh keys. Well that was not the case, ssh -vvv [email protected] is very verbose and helped troubleshoot, the issue was server-side.

Best way to solve SELinux policies is to use audit2allow command, every time there’s an action that is denied by SELinux the daemon logs it and the above utility can help you generate rules that can be added to SELinux.

After several times of running the following commands I got all the missing rules.

sudo ausearch -m AVC -ts recent \
  | audit2allow
sudo ausearch -m AVC -ts recent \
  | audit2allow

If you’re having the same issues you don’t have to run audit2allow, I saved the .te file which you can compile and package in order to install it as a SELinux module.

Save the following contents as “gitlab_ssh.te”

module gitlab_ssh 1.0;

require {
        type sshd_session_t;
        type gitlab_shell_t;
        class file { getattr open read };
        class dir { getattr search };
}

#============= sshd_session_t ==============

#!!!! This avc is allowed in the current policy
allow sshd_session_t gitlab_shell_t:dir search;
allow sshd_session_t gitlab_shell_t:dir getattr;

#!!!! This avc is allowed in the current policy
allow sshd_session_t gitlab_shell_t:file { getattr open read };

To install it execute the following commands:

➜  ~ checkmodule -M -m -o gitlab_ssh.mod gitlab_ssh.te
➜  ~ semodule_package -o gitlab_ssh.pp -m gitlab_ssh.mod
➜  ~ sudo semodule -i gitlab_ssh.pp

That’s it! Hope I saved you some troubleshooting time.