service_seusers(5)

💖 service_seusers(5) 💖

okay bestie, welcome to the service_seusers page — this is from the SELinux configuration corner of the manual universe, and it's literally all about the SELinux GNU/Linux user and service-to-SELinux-user mapping config files. no cap. 🎀

✨ NAME ✨

service_seusers — the SELinux GNU/Linux user and service to SELinux user mapping configuration files. yes that's a mouthful, we love her anyway 🫶

🌸 DESCRIPTION 🌸

okay so these are optional files, and what they do is let services define an SELinux user when they're authenticating via SELinux-aware login applications like PAM(8). it's giving ✨identity assignment✨

there is one file for each GNU/Linux user name that will be required to run a service with a specific SELinux user name. one user, one file. that's the vibe. 💅

the path for each configuration file is formed by the path returned by selinux_policy_root(3) with /logins/username appended — where username is a file representing the GNU/Linux user name. and the default services directory lives right here:

/etc/selinux/{SELINUXTYPE}/logins

where {SELINUXTYPE} is the entry from the selinux configuration file config (peep selinux_config(5) for that one, bestie).

and who reads all this? getseuser(3) does — it reads this file to map services to an SELinux user. iconic behaviour honestly. 👑

🦋 FILE FORMAT 🦋

every single line inside the username file is formatted like this, with each component separated by a colon:

service:seuser[:range]

where:

• service — the service name used by the application.
• seuser — the SELinux user name.
• range — the range for MCS/MLS policies.

🫶 lowkey important: the range part is the optional one in that bracket situation. the colons are the whole personality here, do not skip them.

🌈 EXAMPLES 🌈

Example 1 — for the 'root' user:

# ./logins/root
ipa:user_u:s0
this_service:unconfined_u:s0

Example 2 — for GNU/Linux user 'rch':

# ./logins/rch
ipa:unconfined_u:s0
that_service:unconfined_u:s0

look at that formatting. chef's kiss. 😭✨

👑 SEE ALSO 👑

selinux(8), PAM(8), selinux_policy_root(3), getseuser(3), selinux_config(5)

go read those too, bestie, they're all part of the same friend group fr fr 💜

and that's the whole page!! this lil masterpiece is brought to you by Security Enhanced Linux, dated 28-Nov-2011. mwah, ily, go configure something safely 🧚💖🌸