default_contexts(5)

💖 default_contexts(5) — the SELinux default contexts config file 💖

okay bestie, so default_contexts(5)?? it's a whole manual page for the SELinux configuration file situation and honestly it's giving "quiet file, big job" energy. let's get into it 🫶

✨ NAME ✨

default_contexts — the SELinux default contexts configuration file, no cap. it's the file and it's literally called "default contexts." iconic naming tbh 💅

🌸 DESCRIPTION 🌸

so the default contexts configuration file, default_contexts, contains entries that let SELinux-aware login applications — think PAM(8) and its whole friend group — do their thing. like, they read this file to figure out which contexts they're allowed to use. slay.

SELinux-aware login applications generally use one or more of these libselinux functions, and every single one of them reads these files from the active policy path:

• get_default_context(3)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)

okay so which file do they actually open?? the default context configuration file path for the active policy is returned by selinux_default_contexts_path(3). ✨ the default, default contexts file is:

/etc/selinux/{SELINUXTYPE}/contexts/default_contexts

and where does {SELINUXTYPE} come from?? it's the entry from the selinux configuration file config (peep selinux_config(5) for the deets). 🦋

🎀 FILE FORMAT 🎀

every line in the default configuration file is built like this:

login_process user_login_process [user_login_process] ...

where, bestie, let me break it down:

• login_process — this one consists of a role:type[:range] entry that represents the login process context that are defined in the policy. (yes, that's the original phrasing, we keep the facts, we don't touch the grammar 💀)
• user_login_process — this one consists of one or more role:type[:range] entries that represent the user login process context defined in the policy. plural energy, multiple entries, we love to see it 🌈

⭐ reminder: the role:type[:range] shape is the whole moment here. role and type are mandatory-ish in the pattern, range is the optional little cherry on top in the brackets. and yes, user_login_process can appear more than once — that's the [user_login_process] ... part doing its thing. 👑

🔥 EXAMPLE 🔥

here's what it actually looks like in the wild, fr fr:

# ./contexts/default_contexts
system_r:crond_t:s0            system_r:system_crond_t:s0
system_r:local_login_t:s0      user_r:user_t:s0 staff_r:staff_t:s0
system_r:remote_login_t:s0     user_r:user_t:s0
system_r:sshd_t:s0             user_r:user_t:s0
system_r:sulogin_t:s0          sysadm_r:sysadm_t:s0
system_r:xdm_t:s0              user_r:user_t:s0

see how local_login_t gets two user login processes while the others get one?? that's the [user_login_process] ... flex right there. ate. 💅✨

🌈 SEE ALSO 🌈

go read these next, i'm obsessed with them:

• selinux(8)
• selinux_default_contexts_path(3)
• PAM(8)
• selinux_default_type_path(3)
• get_default_context(3)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)
• selinux_config(5)

and that's the whole page, bestie!! 🫶 this one's from Security Enhanced Linux, dated 28-Nov-2011, and it's the default_contexts(5) page — so if you ever need to know how login processes and user login processes get matched up, you know exactly where to look. mwah. 💖🎀🦋