service_seusers(5) [debian man page]
service_seusers(5) SELinux configuration service_seusers(5) NAME
service_seusers - The SELinux GNU/Linux user and service to SELinux user mapping configuration files. DESCRIPTION
These are optional files that allow services to define an SELinux user when authenticating via SELinux-aware login applications such as PAM(8). There is one file for each GNU/Linux user name that will be required to run a service with a specific SELinux user name. The path for each configuration file is formed by the path returned by selinux_policy_root(3) with /logins/username appended (where user- name is a file representing the GNU/Linux user name). The default services directory is located at: /etc/selinux/{SELINUXTYPE}/logins Where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config(5)). getseuser(3) reads this file to map services to an SELinux user. FILE FORMAT
Each line within the username file is formatted as follows with each component separated by a colon: service:seuser[:range] Where: service The service name used by the application. seuser The SELinux user name. range The range for MCS/MLS policies. EXAMPLES
Example 1 - for the 'root' user: # ./logins/root ipa:user_u:s0 this_service:unconfined_u:s0 Example 2 - for GNU/Linux user 'rch': # ./logins/rch ipa:unconfined_u:s0 that_service:unconfined_u:s0 SEE ALSO
selinux(8), PAM(8), selinux_policy_root(3), getseuser(3), selinux_config(5) Security Enhanced Linux 28-Nov-2011 service_seusers(5)
Check Out this Related Man Page
user_contexts(5) SELinux configuration user_contexts(5) NAME
user_contexts - The SELinux user contexts configuration files. DESCRIPTION
These optional user context configuration files contain entries that allow SELinux-aware login applications such as PAM(8) (running in their own process context), to determine the context that a users login session should run under. SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active pol- icy path: get_default_context(3) get_ordered_context_list(3) get_ordered_context_list_with_level(3) get_default_context_with_level(3) get_default_context_with_role(3) get_default_context_with_rolelevel(3) query_user_context(3) manual_user_enter_context(3) There can be one file for each SELinux user configured on the system. The file path is formed using the path returned by selinux_user_con- texts_path(3) for the active policy, with the SELinux user name appended, for example: /etc/selinux/{SELINUXTYPE}/contexts/users/unconfined_u /etc/selinux/{SELINUXTYPE}/contexts/users/xguest_u Where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config(5)). These files contain context information as described in the FILE FORMAT section. FILE FORMAT
Each line in the user context configuration file consists of the following: login_process user_login_process Where: login_process This consists of a role:type[:range] entry that represents the login process context. user_login_process This consists of a role:type[:range] entry that represents the user login process context. EXAMPLE
# Example for xguest_u at /etc/selinux/targeted/contexts/users/xguest_u system_r:crond_t:s0 xguest_r:xguest_t:s0 system_r:initrc_t:s0 xguest_r:xguest_t:s0 system_r:local_login_t:s0 xguest_r:xguest_t:s0 system_r:remote_login_t:s0 xguest_r:xguest_t:s0 system_r:sshd_t:s0 xguest_r:xguest_t:s0 system_r:xdm_t:s0 xguest_r:xguest_t:s0 xguest_r:xguest_t:s0 xguest_r:xguest_t:s0 SEE ALSO
selinux(8), selinux_user_contexts_path(3), PAM(8), get_ordered_context_list(3), get_ordered_context_list_with_level(3), get_default_con- text_with_level(3), get_default_context_with_role(3), get_default_context_with_rolelevel(3), query_user_context(3), manual_user_enter_con- text(3), selinux_config(5) Security Enhanced Linux 28-Nov-2011 user_contexts(5)