seusers(5)

💖 seusers — the SELinux GNU/Linux user to SELinux user mapping configuration file 💖

okay bestie, this is the manual page for seusers, section 5 of the SELinux config docs. sit down, hydrate, and let's get into it ✨

🌸 NAME 🌸

seusers — literally the SELinux GNU/Linux user to SELinux user mapping configuration file. that's the whole vibe. 💅

🦋 DESCRIPTION 🦋

so the seusers file holds a list of GNU/Linux user → SELinux user mappings, and it's used by SELinux-aware login applications like PAM(8). yes, login apps. the ones that decide who you are when you log in. iconic gatekeeping behavior honestly 👑

selinux_usersconf_path(3) will hand you the active policy path to this file. the default SELinux users mapping file lives at:

/etc/selinux/{SELINUXTYPE}/seusers

where {SELINUXTYPE} is the entry you pulled from the selinux configuration file config (peep selinux_config(5) for that one 🫶).

and getseuserbyname(3) reads this very file to map a GNU/Linux user or group over to an SELinux user. so like, the whole pipeline is: file here, function there, mapping everywhere 💫

🎀 FILE FORMAT 🎀

every single line of the seusers configuration file is shaped like this:

[%group_id]|[user_id]:seuser_id[:range]

and here's what each lil piece means:

• group_id|user_id — the GNU/Linux user id, OR, if it's got the percentage (%) symbol in front of it, then it's a GNU/Linux group id instead. also, you can drop in an optional entry set to __default__ as a fall back if you need one 🍓
• seuser_id — the SELinux user identity. that's the whole point of the line, no cap.
• range — the optional level or range for an MLS/MCS policy. optional means optional, bestie.

✨ EXAMPLE ✨

here's what it actually looks like, chef's kiss:

# ./seusers
system_u:system_u:s0-s15:c0.c255
root:root:s0-s15:c0.c255
fred:user_u:s0
__default__:user_u:s0
%user_group:user_u:s0

see how fred gets user_u, and __default__ catches everybody else? that's the fallback doing its thing. slay 🙈

🌈 SEE ALSO 🌈

• selinux(8)
• PAM(8)
• selinux_usersconf_path(3)
• getseuserbyname(3)
• selinux_config(5)

Security Enhanced Linux • 28-Nov-2011 • seusers(5)

and that's the whole page bestie 💖 that version-and-date combo is from back in 28-Nov-2011, brought to you by Security Enhanced Linux — go forth and map your users, you absolute icon 👑✨🦋