I would like to connect a user account I have created for git in /var/git using authorized_keys. However, SELinux prevents this with the following AVC message

SELinux is preventing sshd(sshd_t) "read" var_t

I'm new to SELinux administration, but I understand that this message states sshd is not allowed to read anything under /var. How can I relabel to allow it access to /var/git? (without putting sshd in permissive mode)

I have tried labelling /var/git/.ssh/authorized_keys as sshd_key_t, but this has no effect. Thanks in advance!

  • What distribution are you on? Why don't you create a folder for it elsewhere (i.e. under /home, /opt, /srv, which may or may not be restricted depending on your SELinux config) instead of under /var? Aug 5, 2009 at 20:01
  • I'm running FC11. I suppose the folder could be placed elsewhere, but /var/git seemed the most logical place to me. (I already have svn set up under /var/svn) Aug 5, 2009 at 20:04

2 Answers 2


I don't use Git so I could be wrong, but if I get your problem right, you probably created the user entirely by hand (i.e. editing /etc/passwd), not letting the system know that /var/git is a user home directory. It normally puts the relevant directories in /etc/selinux/targeted/contexts/files/file_contexts.homedirs. For instance, I have the same setup but with /Var/svn, added with useradd, and here's an excerpt of that file, added automagically:

# Home Context for user unconfined_u

/var/svn/[^/]*/.+       system_u:object_r:user_home_t:s0
/var/svn/[^/]*/.pulse(/.*)?     system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.gnome2(/.*)?    system_u:object_r:gnome_home_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so     --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/.*/plugins/nppdf\.so.*   --      system_u:object_r:textrel_shlib_t:s0
/var/svn/[^/]*/((www)|(web)|(public_html)|(public_git))(/.+)?      system_u:object_r:httpd_user_content_t:s0
/var/svn/[^/]*/\.ssh(/.*)?      system_u:object_r:ssh_home_t:s0


Once this is setup, a simple restorecon -Rv /var/git should do the trick.

  • I added the user using adduser, so I assumed this would have already been done. I'll try hacking something together tomorrow from what you have posted. Thanks! Aug 5, 2009 at 20:52
  • Thanks! All I needed was the equivalent of the last line (setting /var/git/\.ssh/.* to context ssh_home_t. Aug 6, 2009 at 13:42
  • This isn't just for accounts created by hand, it is true if the .ssh directory was created by hand. This did solve my problem, thank you very much for your answer Sep 17, 2009 at 15:42

This could also be resolved by making the .ssh directory with a ssh_home_t context.


context directory
home_root_t /customhome
user_home_dir_t /customhome/user
ssh_home_t /customhome/user/.ssh
ssh_home_t /customhome/user/.ssh/authorized_keys

On RHEL I created a user using the following:

useradd gitlab --home /app/gitlab

I had a heck of a time debugging and figuring out the right context. audit.log didn't show much. I also double checked the /etc/selinux/targeted/contexts/files/file_contexts.homedirs and it didn't auto-create the context.

  • As mentioned in my comment to the other answer, this is what I did :) Sep 11, 2013 at 19:19
  • Ah I must have missed that.
    – Sam Gleske
    Nov 5, 2013 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.