Rawhide: SELinux breaks SSH agent forwarding

Ask Fedora
1

Hello!

When I SSH login to Fedora Rawhide with request for Agent Forwarding it does not work.
Output on Fedora Rawhide - SSHd Server:

$ ssh-add -L

Could not open a connection to your authentication agent.

$ echo $SSH_AUTH_SOCK

( no output )

When I look into logs there is SELinux denial:

$ sudo journalctl -b -p 4 --no-pager  _COMM=sshd-session

Jul 26 09:19:18 fedrh-min sshd-session[760]: error: unix_listener_tmp: bind "/home/ansible/.ssh/agent/s.nhjuFd45cs.sshd.9LxWLJLARg": Permission denied

$ ausearch -ts boot -m avc
----
time->Sun Jul 26 09:19:18 2026
type=AVC msg=audit(1785050358.281:102): avc:  denied  { create } for  pid=760 comm="sshd-session" name="s.nhjuFd45cs.sshd.9LxWLJLARg" scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ssh_home_t:s0 tclass=sock_file permissive=0

$ ls -lZR .ssh

.ssh:
total 8
drwx------. 2 ansible ansible system_u:object_r:ssh_home_t:s0     4096 Jul 26 09:14 agent
-rw-------. 1 ansible ansible unconfined_u:object_r:ssh_home_t:s0   95 Jul 26 09:14 authorized_keys

.ssh/agent:
total 0

While on F44 everything works as expected - output on Fedora 44 - SSHd Server:

$ ssh-add -L

ssh-ed25519 AAAAC...redacted...

$ echo $SSH_AUTH_SOCK

/home/ansible/.ssh/agent/s.NbfZt0VjBS.sshd.Qpkj4GNPm7

$ sudo lsof $SSH_AUTH_SOCK

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
sshd-sess 741 ansible   10u  unix 0x00000000ab80dc04      0t0 9165 /home/ansible/.ssh/agent/s.NbfZt0VjBS.sshd.Qpkj4GNPm7 type=STREAM (LISTEN)

Question: anybody else experiencing same problem with SSH agent forwarding on Fedora Rawhide?

2

I’m seeing selinux blocking reports on f44 that the devs pointed me to this bug 2502040 – ssh agent forwarding blocked by selinux debug1: Remote: Agent forwarding disabled: couldn't create listener socket
Maybe that is what you are seeing as well?

3

Thanks for hint! Not sure, so I asked them on Bugzilla for confirmation.

4

It’s the same issue as already reported in the mentioned BZ entry