Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message

SELinux is preventing sshd(sshd_t) "read" var_t

I'm new to SELinux administration, but I understand that this message states sshd is not allowed to read anything under /var. How can I relabel to allow it access to /var/git? (without putting sshd in permissive mode)

I have tried labelling /var/git/.ssh/authorized_keys as sshd_key_t, but this has no effect. Thanks in advance!

share|improve this question
    
What distribution are you on? Why don't you create a folder for it elsewhere (i.e. under /home, /opt, /srv, which may or may not be restricted depending on your SELinux config) instead of under /var? –  Karl Katzke Aug 5 '09 at 20:01
    
I'm running FC11. I suppose the folder could be placed elsewhere, but /var/git seemed the most logical place to me. (I already have svn set up under /var/svn) –  Michael Mior Aug 5 '09 at 20:04
add comment

2 Answers 2

up vote 5 down vote accepted

I don't use Git so I could be wrong, but if I get your problem right, you probably created the user entirely by hand (i.e. editing /etc/passwd), not letting the system know that /var/git is a user home directory. It normally puts the relevant directories in /etc/selinux/targeted/contexts/files/file_contexts.homedirs. For instance, I have the same setup but with /Var/svn, added with useradd, and here's an excerpt of that file, added automagically:

#
# Home Context for user unconfined_u
#

/var/svn/[^/]*/.+       system_u:object_r:user_home_t:s0
/var/svn/[^/]*/.pulse(/.*)?     system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.gnome2(/.*)?    system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so     --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so.*   --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/((www)|(web)|(public_html)|(public_git))(/.+)?      system_u:object_r:httpd_user_content_t:s0
/var/svn/[^/]*/\.ssh(/.*)?      system_u:object_r:ssh_home_t:s0

(continued)

Once this is setup, a simple restorecon -Rv /var/git should do the trick.

share|improve this answer
    
I added the user using adduser, so I assumed this would have already been done. I'll try hacking something together tomorrow from what you have posted. Thanks! –  Michael Mior Aug 5 '09 at 20:52
    
Thanks! All I needed was the equivalent of the last line (setting /var/git/\.ssh/.* to context ssh_home_t. –  Michael Mior Aug 6 '09 at 13:42
    
This isn't just for accounts created by hand, it is true if the .ssh directory was created by hand. This did solve my problem, thank you very much for your answer –  TrueDuality Sep 17 '09 at 15:42
add comment

This could also be resolved by making the .ssh directory with a ssh_home_t context.

e.g.

context directory
home_root_t /customhome
user_home_dir_t /customhome/user
ssh_home_t /customhome/user/.ssh
ssh_home_t /customhome/user/.ssh/authorized_keys

On RHEL I created a user using the following:

useradd gitlab --home /app/gitlab

I had a heck of a time debugging and figuring out the right context. audit.log didn't show much. I also double checked the /etc/selinux/targeted/contexts/files/file_contexts.homedirs and it didn't auto-create the context.

share|improve this answer
    
As mentioned in my comment to the other answer, this is what I did :) –  Michael Mior Sep 11 '13 at 19:19
    
Ah I must have missed that. –  Sam Gleske Nov 5 '13 at 21:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.