user_contexts(5) [centos man page]

user_contexts(5)					       SELinux configuration						  user_contexts(5)

NAME

       user_contexts - The SELinux user contexts configuration files

DESCRIPTION

       These  optional	user  context  configuration  files contain entries that allow SELinux-aware login applications such as PAM(8) (running in
       their own process context), to determine the context that a users login session should run under.

       SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active pol-
       icy path:
	      get_default_context(3)
	      get_ordered_context_list(3)
	      get_ordered_context_list_with_level(3)
	      get_default_context_with_level(3)
	      get_default_context_with_role(3)
	      get_default_context_with_rolelevel(3)
	      query_user_context(3)
	      manual_user_enter_context(3)

       There  can  be  one  file  for  each  SELinux  user  configured	on  the  system.  The  file   path  is	formed	using the path returned by
       selinux_user_contexts_path(3) for the active policy, with the SELinux user name appended, for example:
	      /etc/selinux/{SELINUXTYPE}/contexts/users/unconfined_u
	      /etc/selinux/{SELINUXTYPE}/contexts/users/xguest_u

       Where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config(5)).

       These files contain context information as described in the FILE FORMAT section.

FILE FORMAT

       Each line in the user context configuration file consists of the following:
	      login_process user_login_process

       Where:
	      login_process
		     This consists of a role:type[:range] entry that represents the login process context.
	      user_login_process
		     This consists of a role:type[:range] entry that represents the user login process context.

EXAMPLE

       # Example for xguest_u at /etc/selinux/targeted/contexts/users/xguest_u
       system_r:crond_t:s0	     xguest_r:xguest_t:s0
       system_r:initrc_t:s0	     xguest_r:xguest_t:s0
       system_r:local_login_t:s0     xguest_r:xguest_t:s0
       system_r:remote_login_t:s0    xguest_r:xguest_t:s0
       system_r:sshd_t:s0	     xguest_r:xguest_t:s0
       system_r:xdm_t:s0	     xguest_r:xguest_t:s0
       xguest_r:xguest_t:s0	     xguest_r:xguest_t:s0

SEE ALSO

       selinux(8), selinux_user_contexts_path(3), PAM(8), get_ordered_context_list(3), get_ordered_context_list_with_level(3),
       get_default_context_with_level(3), get_default_context_with_role(3), get_default_context_with_rolelevel(3), query_user_context(3),
       manual_user_enter_context(3), selinux_config(5)

Security Enhanced Linux 					    28-Nov-2011 						  user_contexts(5)

get_ordered_context_list(3)					      SELinux					       get_ordered_context_list(3)

NAME

       get_ordered_context_list,   get_ordered_context_list_with_level,   get_default_context,	 get_default_context_with_level,  get_default_con-
       text_with_role, get_default_context_with_rolelevel, query_user_context, manual_user_enter_context,  get_default_role  -	determine  SELinux
       context(s) for user sessions

SYNOPSIS

       #include <selinux/selinux.h>
       #include <selinux/get_context_list.h>

       int get_ordered_context_list(const char *user, security_context_t fromcon, security_context_t **list);

       int get_ordered_context_list_with_level(const char *user, const char *level, security_context_t fromcon, security_context_t **list);

       int get_default_context(const char *user, security_context_t fromcon, security_context_t *newcon);

       int get_default_context_with_level(const char *user, const char *level, security_context_t fromcon, security_context_t *newcon);

       int get_default_context_with_role(const char *user, const char *role, security_context_t fromcon, security_context_t *newcon);

       int  get_default_context_with_rolelevel(const  char  *user,  const char *level, const char *role, security_context_t fromcon, security_con-
       text_t *newcon);

       int query_user_context(security_context_t *list, security_context_t *newcon);

       int manual_user_enter_context(const char *user, security_context_t *newcon);

       int get_default_type(const char *role, char **type);

DESCRIPTION

       get_ordered_context_list() invokes the security_compute_user(3) function to obtain the list of contexts for the	specified  user  that  are
       reachable   from   the	specified   fromcon   context.	  The	function   then   orders   the	 resulting   list   based  on  the  global
       /etc/selinux/{SELINUXTYPE}/contexts/default_contexts file and the per-user /etc/selinux/{SELINUXTYPE}/contexts/users/<username> file if	it
       exists.	 The  fromcon  parameter may be NULL to indicate that the current context should be used.  The function returns the number of con-
       texts in the list, or -1 upon errors.  The list must be freed using the freeconary(3) function.

       get_ordered_context_list_with_level() invokes the get_ordered_context_list() function and applies the specified level.

       get_default_context() is the same as get_ordered_context_list() but only returns a single context which has to be freed with freecon(3).

       get_default_context_with_level() invokes the get_default_context() function and applies the specified level.

       get_default_context_with_role() is the same as get_default_context() but only returns a context with the specified role, returning -1 if no
       such context is reachable for the user.

       get_default_context_with_rolelevel() invokes the get_default_context_with_role() function and applies the specified level.

       query_user_context()  takes  a list of contexts, queries the user via stdin/stdout as to which context they want, and returns a new context
       as selected by the user (which has to be freed with freecon(3)).

       manual_user_enter_context() allows the user to manually enter a context as a fallback if  a  list  of  authorized  contexts  could  not	be
       obtained. Caller must free via freecon(3).

       get_default_type() Get the default type (domain) for role and set type to refer to it, which has to be freed with free.

RETURN VALUE

       get_ordered_context_list()  and	get_ordered_context_list_with_level()  return  the  number of contexts in the list upon success or -1 upon
       errors.	The other functions return 0 for success or -1 for errors.

SEE ALSO

       selinux(8), freeconary(3), freecon(3), security_compute_av(3), getseuserbyname(3)

russell@coker.com.au						  1 January 2004				       get_ordered_context_list(3)