LX0-104 · Question #389
When a user logs into a system using SSH, what is the format of SELinux security context which will assign the user_r role and the user_t domain to their login sessions?
The correct answer is C. system_r:sshd_t user_r:user_t. An SELinux security context for an SSH login session combines the context of the sshd process with the context assigned to the logged-in user, typically presented as the system_r:sshd_t context followed by the user's assigned context like user_r:user_t.
Question
Options
- Auser_r:user_t system_r:sshd_t
- Bsshd_t:system_r user_t:user_r
- Csystem_r:sshd_t user_r:user_t
- Duser_t:user_r sshd_t:system_r
How the community answered
(28 responses)- A7% (2)
- C89% (25)
- D4% (1)
Why each option
An SELinux security context for an SSH login session combines the context of the `sshd` process with the context assigned to the logged-in user, typically presented as the `system_r:sshd_t` context followed by the user's assigned context like `user_r:user_t`.
The order is reversed; the daemon's context usually comes first in a chain or implied context.
This option incorrectly places `sshd_t` first without the correct role (`system_r`) and reverses the typical user context format.
When a user logs in via SSH, the session inherits a security context that reflects both the `sshd` process itself and the user's designated security context. The `system_r:sshd_t` part represents the context of the SSH daemon process, which facilitates the login, while `user_r:user_t` represents the role (`user_r`) and type/domain (`user_t`) assigned to the specific user's session.
This option incorrectly reverses the typical user context format and places the `sshd` context second with an incorrect role order.
Concept tested: SELinux context for SSH login sessions
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-selinux_users_and_administrators_guide-changing_contexts-persistent_changes_semanage_login-ssh_logins
Topics
Community Discussion
No community discussion yet for this question.