LFCS · Question #389
When a user logs into a system using SSH, what is the format of SELinux security context which will assign the user_r role and the user_t domain to their login sessions?
The correct answer is C. system_r:sshd_t user_r:user_t. The SELinux security context format for a user's SSH login session assigns a specific user and role to the SSH daemon process, and then a distinct role and type to the user's interactive session.
Question
Options
- Auser_r:user_t system_r:sshd_t
- Bsshd_t:system_r user_t:user_r
- Csystem_r:sshd_t user_r:user_t
- Duser_t:user_r sshd_t:system_r
How the community answered
(17 responses)- B6% (1)
- C88% (15)
- D6% (1)
Why each option
The SELinux security context format for a user's SSH login session assigns a specific user and role to the SSH daemon process, and then a distinct role and type to the user's interactive session.
This option incorrectly reverses the typical order of the context parts for `sshd_t` and lacks clear separation for the distinct contexts.
This option has an incorrect order of elements for both contexts (e.g., `sshd_t:system_r` should be `system_u:system_r:sshd_t`, and `user_t:user_r` should be `user_u:user_r:user_t`).
SELinux contexts are typically represented as `user:role:type:level`. For SSH login, the `sshd` daemon operates under its own context, commonly `system_u:system_r:sshd_t`. Once a user authenticates, their interactive session (shell) is then assigned a new context, such as `user_u:user_r:user_t`, where `user_r` is the role and `user_t` is the type/domain for the user's processes. The question specifically asks for the format that assigns `user_r` role and `user_t` domain to *their login sessions*, implying the context of the user's interactive session.
Similar to B, this option has an incorrect order of elements within the contexts, as the standard format is `user:role:type`.
Concept tested: SELinux context format for SSH login
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-login_processes.html
Topics
Community Discussion
No community discussion yet for this question.