The update of selinux-policy for Alma Linux 10.2 to version 42.1.18-4.2 broke my Kerberos login.
The changelog says this:
* Di Jun 23 2026 Zdenek Pytela <zpytela@redhat.com> - 42.1.18-4.2
- Remove permissive domain for sshd_session_t and sshd_auth_t
Resolves: RHEL-178897
The changed behaviour is that ssh is asking for a password despite having a valid Kerberos ticket. The error message on the jumphost is this:
Aug 14 07:37:34 wgs22 sshd-session[386080]: Authorized to user, krb5 principal user@EXAMPLE.COM (ssh_gssapi_krb5_cmdok)
Aug 14 07:37:34 wgs22 sshd-session[386080]: Accepted gssapi-keyex for user from IP-Address port 39190 ssh2: user@EXAMPLE.COM
Aug 14 07:37:34 wgs22 sshd-session[386080]: mkstemp(): Permission denied
Aug 14 07:37:34 wgs22 sshd-session[386080]: ssh_krb5_cc_new_unique(): Permission denied
It fails to create a Kerberos credentials cache file (at /tmp/krb5cc_UID_randomstring.
I would’ve liked to report this to Red Hat, but the new issue tracker is hard to use.