I’ve recently switched over to Fedora Server on a couple of systems and I was surprised to find that SSH port forwarding doesn’t work out of the box, being blocked by SELinux. Obviously I can manually configure it not to be, but the documentation implies that it’s supposed to work by default: Making sure you're not a bot!
This begs the question, is this intentional or a bug? And if it’s a bug, how is it supposed to be configured? It’s not clear to me that Audit2Allow would yield the same policy that’s supposed to be active, and the denial message suggests setting “nis_enabled” instead which is even more nebulous (I can’t find any actual documentation anywhere as to what this actually does).
EDIT: Typical, the moment I post it I find the issue (linked from a post about X11 forwarding breaking funnily enough): 2523732 – sshd_session_t enforcement breaks OpenSSH direct-tcpip / ProxyJump forwarding to ssh_port_t
Summary is that sshd_session_t was running unconfined until a very recent policy update which didn’t include the rules to allow it to bind ports. I’d still be interested to know what exactly nis_enabled does, SELinux seems very keen for me to use this to fix the issue (Audit2Allow includes the comment “This avc can be allowed using the boolean ‘nis_enabled’”) but while there’s no clear documentation as to what it does there are online discussions that just kind of vaguely mention that it changes quite a lot of policies, so the scope seems unnecessarily large for just allowing SSH port forwarding…