When I try to log on to my laptop, which runs Ubuntu 9.10, the server rejects my login attempts.

Checking /var/log/auth.log, I see the following:

Feb 14 12:41:16 tiger-laptop sshd[6798]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for tiger

I googled for this, and ran across the following:


Here's the part that I think relates to the problem that I'm having:


What's wrong on my system? Why it's not possible to login even if selinux is in permissive mode? Any suggestions?

I'd start by trying to figure out why sshd isn't running in sshd_t (it seems to be running in sysadm_t).


selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mail...stinfo/selinux

Yes, sshd is running in sysadm_t:

ps axZ | grep sshd

system_u:system_r:sysadm_t 3632 ? Ss 0:00 /usr/sbin/sshd -o PidFile=/var/run/sshd.init.pi

ls -Z /usr/sbin/sshd

system_ubject_r:sshd_exec_t /usr/sbin/sshd

Don't know why it's not sshd_t. I didn't modified something. It's a standard installation of sles11 with the default reference policy from tresys.

Maybe this code snippet from policy/modules/services/ssh.te is responsible for that:

Allow ssh logins as sysadm_r:sysadm_t

gen_tunable(ssh_sysadm_login, true)

Any ideas?

Do you have boolean init_upstart set to on? if not try setting it to on. I do not believe ssh_sysadm_login boolean works currently but i may be mistaken. >

-- Yeah, setting init_upstart to on did the trick! THANK A LOT! Do you know why this prevents the user from logging in through ssh even if selinux is set to permissive??

Ok, so the million dollar question is "where do I set 'init_upstart=1'"?

It's not clear from context which configuration file needs to be edited, and I'm not at all familiar with SELinux configuration.

  • 1
    Something is wrong here. Ubuntu doesn't use SELinux by default. Are you sure you are running Ubuntu 9.10 on your laptop? – Juliano Feb 14 '11 at 21:33
  • Ok, as I understand it, Ubuntu has SeLinux installed, but set to permissive mode, so most of the time it shouldn't get in the way. This is how it's configured on my laptop. Apparently there's a bug in either SeLinux or sshd which will block login even though selinux is set to permissive. Setting "init_upstart=1" will tweak which user launches sshd so that selinux won't complain. – Barton Chittenden Feb 14 '11 at 22:23
  • ...having said that, it's also possible that I requested that SeLinux be enabled during installation... I don't remember. – Barton Chittenden Feb 14 '11 at 22:25

Probably with semanage. Like:

semanage boolean init_upstart 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.