up vote 1 down vote favorite
share [g+] share [fb]

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message

SELinux is preventing sshd(sshd_t) "read" var_t

I'm new to SELinux administration, but I understand that this message states sshd is not allowed to read anything under /var. How can I relabel to allow it access to /var/git? (without putting sshd in permissive mode)

I have tried labelling /var/git/.ssh/authorized_keys as sshd_key_t, but this has no effect. Thanks in advance!

link|improve this question
83% accept rate
What distribution are you on? Why don't you create a folder for it elsewhere (i.e. under /home, /opt, /srv, which may or may not be restricted depending on your SELinux config) instead of under /var? – Karl Katzke Aug 5 '09 at 20:01
I'm running FC11. I suppose the folder could be placed elsewhere, but /var/git seemed the most logical place to me. (I already have svn set up under /var/svn) – Michael Mior Aug 5 '09 at 20:04
feedback

1 Answer

up vote 4 down vote accepted

I don't use Git so I could be wrong, but if I get your problem right, you probably created the user entirely by hand (i.e. editing /etc/passwd), not letting the system know that /var/git is a user home directory. It normally puts the relevant directories in /etc/selinux/targeted/contexts/files/file_contexts.homedirs. For instance, I have the same setup but with /Var/svn, added with useradd, and here's an excerpt of that file, added automagically:

#
# Home Context for user unconfined_u
#

/var/svn/[^/]*/.+       system_u:object_r:user_home_t:s0
/var/svn/[^/]*/.pulse(/.*)?     system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.gnome2(/.*)?    system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so     --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so.*   --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/((www)|(web)|(public_html)|(public_git))(/.+)?      system_u:object_r:httpd_user_content_t:s0
/var/svn/[^/]*/\.ssh(/.*)?      system_u:object_r:ssh_home_t:s0

(continued)

Once this is setup, a simple restorecon -Rv /var/git should do the trick.

link|improve this answer
I added the user using adduser, so I assumed this would have already been done. I'll try hacking something together tomorrow from what you have posted. Thanks! – Michael Mior Aug 5 '09 at 20:52
Thanks! All I needed was the equivalent of the last line (setting /var/git/\.ssh/.* to context ssh_home_t. – Michael Mior Aug 6 '09 at 13:42
This isn't just for accounts created by hand, it is true if the .ssh directory was created by hand. This did solve my problem, thank you very much for your answer – TrueDuality Sep 17 '09 at 15:42
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.