Gateway port forwarding check fails on Fedora 44: SELinux sshd_session_t regression

Problem

The SSH port forwarding check fails when JetBrains Gateway connects to a Fedora 44 remote host with SELinux enforcing. The IDE reports:

The Host Doesn't Meet the Minimal Requirements. The SSH port forwarding check failed. A client might not be able to connect to the remote backend. It could be due to some configurations, such as the SSH server configuration or firewall rules.

The message is generic. On Fedora 44 with recent selinux-policy versions, the trigger is an SELinux AVC denial rather than an SSH or firewall misconfiguration.

Related article: How to debug port-forwarding-related connection issues with Gateway remote development covers the general SSH-side and firewall causes for the same message.

Cause

selinux-policy 44.6-1 removed the permissive setting from the sshd_session_t domain. Starting with selinux-policy 44.7-1 the domain enforces, and no rule allows sshd_session_t to tcp_socket name_connect on ephemeral_port_t. OpenSSH cannot open the forwarded port that JetBrains Gateway needs on the remote host. The sshd_session_t change also breaks OpenSSH ProxyJump, dynamic (SOCKS) forwarding, and X11 forwarding for the same reason.

Tracked upstream as Red Hat Bugzilla 2523732.

To confirm the SELinux denial on the remote host:

sudo ausearch -m avc -ts recent | grep sshd_session_t

An AVC line naming sshd_session_t and tclass=tcp_socket name_connect is the denial that blocks the Gateway port forwarding check.

Resolution

The permanent fix is to update selinux-policy and selinux-policy-targeted to 44.9-1.fc44 or later on the remote host, which restores the missing rules:

sudo dnf upgrade --refresh selinux-policy selinux-policy-targeted

While 44.9-1.fc44 is only in the updates-testing repository, enable it explicitly:

sudo dnf --enablerepo=updates-testing upgrade selinux-policy selinux-policy-targeted

Temporary workaround: mark the domain permissive

If updating is not immediately possible, mark sshd_session_t permissive so SELinux logs denials instead of enforcing:

sudo semanage permissive -a sshd_session_t

Remove that setting after the update:

sudo semanage permissive -d sshd_session_t

Temporary workaround: narrow policy module

For a targeted alternative, grant only the two connect rules Gateway needs through a local policy module. Save the following as sshd-session-forward.te:

module sshd-session-forward 1.0;

require {
    type sshd_session_t;
    type ephemeral_port_t;
    type vnc_port_t;
    class tcp_socket name_connect;
}

allow sshd_session_t ephemeral_port_t:tcp_socket name_connect;
allow sshd_session_t vnc_port_t:tcp_socket name_connect;

Compile and install it:

make -f /usr/share/selinux/devel/Makefile sshd-session-forward.pp
sudo semodule -i sshd-session-forward.pp