guest_selinux(8)

okay so bestie, you're reading the guest_selinux(8) page — officially the guest SELinux Policy documentation — and it's all about the least privileged terminal user role. no cap, let's get into it. 💅✨

🌸 NAME 🌸

guest_u — Least privileged terminal user role. — Security Enhanced Linux Policy

💖 DESCRIPTION 💖

So guest_u is an SELinux User defined in the SELinux policy. SELinux users get default roles, and for this one that's guest_r. That default role has a default type, guest_t, attached to it.

Usually the SELinux user logs in with a context that looks like this:

guest_u:guest_r:guest_t:s0

Linux users get assigned an SELinux user automatically at login. Login programs use that SELinux user to give the user's shell its initial context. Then SELinux policy uses the context to control the user's access. iconic behavior, honestly.

By default, all users are assigned to the SELinux user via the __default__ flag.

On Targeted policy systems, the __default__ user is assigned to the unconfined_u SELinux user.

You can list all Linux User to SELinux user mapping with:

semanage login -l

If you wanted to change the default user mapping to use the guest_u user, you would run:

semanage login -m -s guest_u __default__

If you want to map the one Linux user (joe) to the SELinux user guest, you would run:

$ semanage login -a -s guest_u joe

🫶 USER DESCRIPTION 🫶

The SELinux user guest_u is defined in policy as an unprivileged user. SELinux prevents unprivileged users from doing administration tasks without transitioning to a different role. that's the whole point, bestie — no sneaky admin energy. 💅

😳 SUDO 😳

This heading is here in the original, bestie — there are no extra SUDO deets under it. the next heading has the actual tea.

🪟 X WINDOWS LOGIN 🪟

The SELinux user guest_u is not able to X Windows login. nope, not the move. 🙈

🌐 NETWORK 🌐

Here's the port vibe check, exactly as listed:

• The SELinux user guest_u is able to listen on the following tcp ports: 1716
• The SELinux user guest_u is able to connect to the following tcp ports: 9080, 88,750,4444
• The SELinux user guest_u is able to listen on the following udp ports: 5353, 1716
• The SELinux user guest_u is able to connect to the following tcp ports: 9080, 88,750,4444 — yes, tcp again in the original, so we're keeping it exact, bestie 🫡

🔥 BOOLEANS 🔥

SELinux policy is customizable based on least access required. The guest policy is extremely flexible and has several booleans that let you manipulate the policy and run guest with the tightest access possible. lock it down, slay. 🔐

• deny_bluetooth — if you want to deny all system processes and Linux users to use bluetooth wireless technology, turn this on. Disabled by default. Run setsebool -P deny_bluetooth 1.
• deny_execmem — if you want to deny user domains applications to map a memory region as both executable and writable, turn this on. This is dangerous, and the executable should be reported in bugzilla. Disabled by default. Run setsebool -P deny_execmem 1.
• fips_mode — if you want to allow all domains to execute in fips_mode, turn this on. Enabled by default. Run setsebool -P fips_mode 1.
• httpd_enable_cgi — if you want to allow httpd cgi support, turn this on. Enabled by default. Run setsebool -P httpd_enable_cgi 1.
• httpd_unified — if you want to unify HTTPD handling of all content files, turn this on. Disabled by default. Run setsebool -P httpd_unified 1.
• kerberos_enabled — if you want to allow confined applications to run with kerberos, turn this on. Enabled by default. Run setsebool -P kerberos_enabled 1.
• selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, turn this on. Disabled by default. Run setsebool -P selinuxuser_execstack 1.

okay so this should never, ever be necessary. It probably means a badly coded executable, but it could mean an attack. That executable should be reported in bugzilla. fr fr, be careful. 😭

• selinuxuser_use_ssh_chroot — if you want to allow user to use ssh chroot environment, turn this on. Disabled by default. Run setsebool -P selinuxuser_use_ssh_chroot 1.
• use_nfs_home_dirs — if you want to support NFS home directories, turn this on. Enabled by default. Run setsebool -P use_nfs_home_dirs 1.
• use_samba_home_dirs — if you want to support SAMBA home directories, turn this on. Disabled by default. Run setsebool -P use_samba_home_dirs 1.

🏠 HOME_EXEC 🏠

The SELinux user guest_u can execute home content files. cute, but stay in your lane. 🎀

🦋 TRANSITIONS 🦋

Three things can happen when guest_t attempts to execute a program:

1. SELinux Policy can deny guest_t from executing the program.
2. SELinux Policy can allow guest_t to execute the program in the current user type.

Execute the following to see the types that the SELinux user guest_t can execute without transitioning:

sesearch -A -s guest_t -c file -p execute_no_trans

3. SELinux can allow guest_t to execute the program and transition to a new type.

Execute the following to see the types that the SELinux user guest_t can execute and transition:

$ sesearch -A -s guest_t -c process -p transition

📂 MANAGED FILES 📂

The SELinux process type guest_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Also remember: the process's UID still needs to have DAC permissions. iykyk. 🔑

• alsa_home_t — /home/[^/]+/.asoundrc
• auth_cache_t — /var/cache/coolkey(/.*)?
• cifs_t
• httpd_user_content_t — /home/[^/]+/((www)|(web)|(public_html))(/.+)?
• httpd_user_htaccess_t — /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
• httpd_user_ra_content_t — /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
• httpd_user_rw_content_t
• httpd_user_script_exec_t — /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
• nfs_t
• user_home_type — all user home files
• user_tmp_type — all user tmp files

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

✍️ AUTHOR ✍️

This manual page was auto-generated using sepolicy manpage .

👀 SEE ALSO 👀

selinux(8), guest(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

xoxo 💖 — footer sign-off: mgrepl@redhat.com, guest, guest_selinux(8). that's the source/version tea, and there's no date on this footer, bestie. periodt. 🎀