Red Hat Security: Linux in Physical, Virtual, and Cloud

At login time, SELinux maps the Linux user to an SELinux user. This way, the Linux user inherits the restrictions that are assigned to their associated SELinux user.

The semanage login -l command displays the table that SELinux uses for this mapping.

[root@host ~]# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

As shown in this output, SELinux maps the Linux root user to the unconfined_u SELinux user. The __default__ entry instructs SELinux to map all the Linux users that are not explicitly mapped to an SELinux user to the unconfined_u SELinux user. Linux users that are mapped to the unconfined_u (the unconfined user) SELinux user do not have additional user-based SELinux restrictions. Other SELinux policy restrictions still apply.

SELinux uses the system_u user for system services. Do not use it for your Linux users.

Linux users who are logged in can retrieve their associated SELinux user with the id -Z command.

[root@host ~]# id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

To map an existing Linux user to an SELinux user, use the semanage login -a -s SELinux_user Linux_user command.

[root@host ~]# semanage login -a -s sysadm_u  operator1

To remove the mapping, use the semanage login -d -s SELinux_user Linux_user command.

[root@host ~]# semanage login -d -s sysadm_u  operator1

To modify the default mapping, use the semanage login -m -s SELinux_user -r s0 __default__ command.

[root@host ~]# semanage login -m -s user_u -r s0 __default__

You can also map a new Linux user at creation time by using the -Z option of the useradd command.

[root@host ~]# useradd -Z staff_u developer1

On Red Hat Enterprise Linux, SELinux comes with a set of predefined SELinux users. You rarely have to create new ones because these existing users cover most use cases.

The following table lists the most useful confined SELinux users for system administration.

A number of Booleans can adjust the restrictions set on confined users. The preceding list includes one Boolean: ssh_sysadm_login, which controls whether users that are mapped to the sysadm_u SELinux user can log in by using the ssh command.

Another set of Booleans restricts whether these users can run executables in their home directory or in the /tmp/ directory. These are the user_exec_content, sysadm_exec_content, and staff_exec_content Booleans for the user_u, sysadm_u, and staff_u SELinux users, respectively.

When you decide to confine all your Linux users, you usually start by modifying the default mapping to the user_u SELinux user.

[root@host ~]# semanage login -m -s user_u -r s0 __default__

This way, SELinux confines all your Linux users to an SELinux user with minimal privileges by default. If you use the default mapping, no further configuration is needed; SELinux automatically confines all existing users that do not have a mapping on their next login.

For extra protection, you can also prevent users with the user_u SELinux user mapping from executing programs in their home directories and the /tmp/ directory. To do that, set the user_exec_content Boolean to the off value.

[root@host ~]# setsebool -P user_exec_content off

To confine your system administrators, map their Linux account to the sysadm_u SELinux user. For existing accounts, use the semanage login -a command:

[root@host ~]# semanage login -a -s sysadm_u  operator1

For new users, you can use the -Z option of the useradd command to do the mapping at user creation time.

[root@host ~]# useradd -G wheel -Z sysadm_u operator2

The previous command uses the -G option to add the new account to the Linux wheel group to benefit from the existing sudo rule for this group.

By default, and for extra protection, users that are mapped to the sysadm_u SELinux user cannot use SSH to log in. Set the ssh_sysadm_login Boolean to the on value if you must allow SSH access.

[root@host ~]# setsebool -P ssh_sysadm_login on

Remember to remove the mapping when deleting a Linux user account.

[root@host ~]# userdel operator1
[root@host ~]# semanage login -d -s sysadm_u  operator1

You can also use the userdel -Z command to remove the mapping at the same time that you delete the user account.

[root@host ~]# userdel -Z operator2

Some standard Linux users might need to run specific commands as the root user. Map them to the staff_u SELinux user account and configure the sudo command.

For existing accounts, use the semanage login -a command:

[root@host ~]# semanage login -a -s staff_u  developer1

For new users, you can use the -Z option of the useradd command to do the mapping at user creation time.

[root@host ~]# useradd -Z staff_u developer2

The next step is to configure the sudoers files to list the commands that these users can run as the root user.

For extra protection, you can also prevent the staff_u SELinux users from executing programs in their home directories and the /tmp/ directory. For that level of protection, set the staff_exec_content Boolean to the off value.

[root@host ~]# setsebool -P staff_exec_content off

Remember to remove the mapping when deleting the Linux user account.

[root@host ~]# userdel -Z developer1