nerdexam
Linux_Foundation

LFCS · Question #389

When a user logs into a system using SSH, what is the format of SELinux security context which will assign the user_r role and the user_t domain to their login sessions?

The correct answer is C. system_r:sshd_t user_r:user_t. The SELinux security context format for a user's SSH login session assigns a specific user and role to the SSH daemon process, and then a distinct role and type to the user's interactive session.

Submitted by skyler.x· Apr 18, 2026Operation of Running Systems

Question

When a user logs into a system using SSH, what is the format of SELinux security context which will assign the user_r role and the user_t domain to their login sessions?

Options

  • Auser_r:user_t system_r:sshd_t
  • Bsshd_t:system_r user_t:user_r
  • Csystem_r:sshd_t user_r:user_t
  • Duser_t:user_r sshd_t:system_r

How the community answered

(17 responses)
  • B
    6% (1)
  • C
    88% (15)
  • D
    6% (1)

Why each option

The SELinux security context format for a user's SSH login session assigns a specific user and role to the SSH daemon process, and then a distinct role and type to the user's interactive session.

Auser_r:user_t system_r:sshd_t

This option incorrectly reverses the typical order of the context parts for `sshd_t` and lacks clear separation for the distinct contexts.

Bsshd_t:system_r user_t:user_r

This option has an incorrect order of elements for both contexts (e.g., `sshd_t:system_r` should be `system_u:system_r:sshd_t`, and `user_t:user_r` should be `user_u:user_r:user_t`).

Csystem_r:sshd_t user_r:user_tCorrect

SELinux contexts are typically represented as `user:role:type:level`. For SSH login, the `sshd` daemon operates under its own context, commonly `system_u:system_r:sshd_t`. Once a user authenticates, their interactive session (shell) is then assigned a new context, such as `user_u:user_r:user_t`, where `user_r` is the role and `user_t` is the type/domain for the user's processes. The question specifically asks for the format that assigns `user_r` role and `user_t` domain to *their login sessions*, implying the context of the user's interactive session.

Duser_t:user_r sshd_t:system_r

Similar to B, this option has an incorrect order of elements within the contexts, as the standard format is `user:role:type`.

Concept tested: SELinux context format for SSH login

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-login_processes.html

Topics

#SELinux#Security Context#SSH#User Sessions

Community Discussion

No community discussion yet for this question.

Full LFCS Practice