Home / server / Questions / 50573
Accepted
Michael Mior
Asked: 2009-08-06 11:58:04 +0800 CST

SELinux preventing passwordless SSH login

  • 772

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message

SELinux is preventing sshd(sshd_t) "read" var_t

I'm new to SELinux administration, but I understand that this message states sshd is not allowed to read anything under /var. How can I relabel to allow it access to /var/git? (without putting sshd in permissive mode)

I have tried labelling /var/git/.ssh/authorized_keys as sshd_key_t, but this has no effect. Thanks in advance!

security ssh selinux

2 Answers

  1. Best Answer

    I don't use Git so I could be wrong, but if I get your problem right, you probably created the user entirely by hand (i.e. editing /etc/passwd), not letting the system know that /var/git is a user home directory. It normally puts the relevant directories in /etc/selinux/targeted/contexts/files/file_contexts.homedirs. For instance, I have the same setup but with /Var/svn, added with useradd, and here's an excerpt of that file, added automagically:

    #
# Home Context for user unconfined_u
#

/var/svn/[^/]*/.+       system_u:object_r:user_home_t:s0
/var/svn/[^/]*/.pulse(/.*)?     system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.gnome2(/.*)?    system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so     --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so.*   --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/((www)|(web)|(public_html)|(public_git))(/.+)?      system_u:object_r:httpd_user_content_t:s0
/var/svn/[^/]*/\.ssh(/.*)?      system_u:object_r:ssh_home_t:s0

    (continued)

    Once this is setup, a simple restorecon -Rv /var/git should do the trick.

    • 8

  2. This could also be resolved by making the .ssh directory with a ssh_home_t context.

    e.g.

    context directory
home_root_t /customhome
user_home_dir_t /customhome/user
ssh_home_t /customhome/user/.ssh
ssh_home_t /customhome/user/.ssh/authorized_keys

    On RHEL I created a user using the following:

    useradd gitlab --home /app/gitlab

    I had a heck of a time debugging and figuring out the right context. audit.log didn't show much. I also double checked the /etc/selinux/targeted/contexts/files/file_contexts.homedirs and it didn't auto-create the context.

    • 2