Re: sshd error: Failed to get default security context

[Dominick Grift <domg472@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2292 bytes --]

On Sat, Oct 17, 2009 at 07:39:50AM -0400, Daniel J Walsh wrote:
> On 10/16/2009 08:15 PM, Larry Ross wrote:
> > I have created a custom selinux user for the strict policy on RHEL5.3 who's
> > purpose is to connect via ssh and scp files off the machine.  When that user
> > tries to login via ssh, I see the following messages in /var/log/secure:
> > 
> > In enforcing:
> > Oct 16 07:49:40 localhost sshd[20461]: Accepted password for scpuser
> > from 192.168.1.1 port 64680 ssh2
> > Oct 16 07:49:40 localhost sshd[20461]: error: Failed to get default security
> > context for scpuser.
> > Oct 16 07:49:40 localhost sshd[20461]: fatal: SELinux failure. Aborting
> > connection.
> > 
> > In permissive:
> > Oct 16 07:55:59 localhost sshd[23302]: Accepted password for scpuser from
> > 192.168.1.1 port 56254 ssh2
> > Oct 16 07:55:59 localhost sshd[23302]: error: Failed to get default security
> > context for scpuser.
> > Oct 16 07:55:59 localhost sshd[23302]: error: SELinux failure. Continuing in
> > permissive mode.
> > 
> > Could someone explain what these messages mean?

I am not sure about el5 but in Fedora:

the files in /etc/selinux/<policy model>/contexts/targeted have specifications that tell the login programs what context to use for the specified seuser when he logs in.

I wrote an article about adding customized user domains for Fedora:

http://selinux-mac.blogspot.com/2009/06/selinux-lockdown-part-four-customized.html

And some screencasts:

http://selinux-mac.blogspot.com/2009/06/selinux-screencasts.html

> > 
> > I believe that I have a default context defined in the "default context"
> > file that should work. I believe I have an executable context available for
> > this user (using rbash rather than bash).
> > 
> > How is sshd making this decision?  It looks like it is calling setexeccon,
> > but I'm not sure how that makes its decision.  Where should I look for clues
> > as to how to fix it?
> > 
> >    Thank you,
> >    Larry
> > 
> Did you add an entry to default_types?
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]