user_contexts(5)

✨ user_contexts(5) — the SELinux user contexts tea ✨

okay bestie, so this is a manual page for user_contexts — yes, that's the section 5 one, file formats, we love a file format moment 💅 — and it's literally about the SELinux user contexts configuration files. buckle up, it's giving sysadmin but make it cute 🎀

---

🌸 NAME 🌸

user_contexts — the SELinux user contexts configuration files, no cap.

---

💖 DESCRIPTION 💖

So these files are optional (key word, bestie, optional) user context configuration files, and what they do is hold entries that let SELinux-aware login applications — think PAM(8), running in their own process context — figure out which context a user's login session should be running under. it's basically the group chat where your login session gets told what vibe to have ✨

SELinux-aware login applications generally use one or more of these libselinux functions, and those functions read these files from the active policy path:

• get_default_context(3)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)

and here's the thing — there can be one file for each SELinux user configured on the system. one per user. iconic. 👑

the file path is formed using the path that selinux_user_contexts_path(3) returns for the active policy, and then the SELinux user name gets appended to it. for example:

/etc/selinux/{SELINUXTYPE}/contexts/users/unconfined_u
/etc/selinux/{SELINUXTYPE}/contexts/users/xguest_u

where {SELINUXTYPE} is the entry from the selinux configuration file config — go read selinux_config(5) if you need the deets on that one 🫶

these files contain context information, and that's all described in the FILE FORMAT section below. keep scrolling bestie ⬇️

---

🦋 FILE FORMAT 🦋

every single line in the user context configuration file is made up of the following:

login_process user_login_process

and here's what those mean, fr fr:

• login_process — this is a role:type[:range] entry that represents the login process context.
• user_login_process — this is a role:type[:range] entry that represents the user login process context.

that's it, that's the whole format. slay 🌈

---

🌟 EXAMPLE 🌟

here's a real one, an example for xguest_u at /etc/selinux/targeted/contexts/users/xguest_u:

# Example for xguest_u at /etc/selinux/targeted/contexts/users/xguest_u
system_r:crond_t:s0           xguest_r:xguest_t:s0
system_r:initrc_t:s0          xguest_r:xguest_t:s0
system_r:local_login_t:s0     xguest_r:xguest_t:s0
system_r:remote_login_t:s0    xguest_r:xguest_t:s0
system_r:sshd_t:s0            xguest_r:xguest_t:s0
system_r:xdm_t:s0             xguest_r:xguest_t:s0
xguest_r:xguest_t:s0          xguest_r:xguest_t:s0

look at those aligned columns. the way that it's formatted. ate and left no crumbs 💅

---

👑 SEE ALSO 👑

go read these too, bestie, they're all in the family:

• selinux(8)
• selinux_user_contexts_path(3)
• PAM(8)
• get_ordered_context_list(3)
• get_ordered_context_list_with_level(3)
• get_default_context_with_level(3)
• get_default_context_with_role(3)
• get_default_context_with_rolelevel(3)
• query_user_context(3)
• manual_user_enter_context(3)
• selinux_config(5)

---

okay that's the whole page, mwah 💋 this one came from Security Enhanced Linux, dated 28-Nov-2011, and it's filed under user_contexts(5) — periodt. now go configure your users, main character 💜🦋✨