What are the three types of SELinux contexts for a service like SSH?

A service is governed by three context types at once — the PROCESS context (sshd_t), the FILE context of what it reads (ssh_home_t), and the PORT context it binds (ssh_port_t) — and policy must connect the process type to both the file type and the port type for it to work.

This is the unifying mental model of SELinux: a working service is a triangle of process-type ↔ file-type ↔ port-type, all linked by policy rules. For sshd, policy must allow sshd_t to read ssh_home_t (so it can check ~/.ssh/authorized_keys) and to bind ssh_port_t (so it can listen on 22). The same pattern repeats everywhere — Apache is httpd_t + httpd_sys_content_t + http_port_t — which is why, when a service misbehaves under SELinux, you check all three context types, not just the file.

View each context:

# Process context
ps auxZ | grep sshd

# File context
ls -laZ ~/.ssh/id_rsa

# Port context
semanage port -l | grep " 22$"

For access to work, SELinux policy must allow:

• sshd_t to read ssh_home_t files
• sshd_t to bind to ssh_port_t ports

This applies to all services:

• Apache: httpd_t + httpd_sys_content_t + http_port_t
• MySQL: mysqld_t + mysqld_db_t + mysqld_port_t

Tip: When troubleshooting, check all three context types!