semanage-user(8)

🌸 semanage-user — the SELinux user mapping tool, bestie edition 🌸

okay so real talk, this is the semanage-user(8) page from the semanage family, and it's literally your bestie for wiring up SELinux Users to roles and MLS/MCS levels. no cap. let's get into it 💅

---

✨ NAME ✨

semanage-user — SELinux Policy Management SELinux User mapping tool 🫶

---

🎀 SYNOPSIS 🎀

semanage user [-h] [-n] [-N] [-S STORE] [ --add ( -L LEVEL -R ROLES -r
RANGE SEUSER) | --delete SEUSER | --deleteall | --extract | --list [-C]
| --modify ( -L LEVEL -R ROLES -r RANGE SEUSER ) ]

---

🦋 DESCRIPTION 🦋

so semanage is the girl who configures certain elements of SELinux policy without you having to modify or recompile anything from policy sources. she's lowkey doing the most so you don't have to.

and semanage user specifically? she controls the mapping between an SELinux User and the roles and MLS/MCS levels. it's giving matchmaker, honestly. 🔥

---

👑 OPTIONS 👑

• -h, --help — show this help message and exit. the "just tell me what's happening" button 💖
• -n, --noheading — do NOT print the heading when listing the specified object type. minimalism era ✨
• -N, --noreload — do not reload policy after commit. (normally she does reload, just so we're clear 👀)
• -S STORE, --store STORE — select an alternate SELinux Policy Store to manage. shopping at a different location bestie 🛍️
• -C, --locallist — list local customizations only. your personal edits, not the factory defaults 🌸
• -a, --add — add a record of the specified object type ➕
• -d, --delete — delete a record of the specified object type 🗑️
• -m, --modify — modify a record of the specified object type ✏️
• -l, --list — list records of the specified object type 📋
• -E, --extract — extract customizable commands, for use within a transaction. like, exporting the vibe for later 🧚
• -D, --deleteall — remove ALL local customizations. dramatic? maybe. thorough? absolutely 💀
• -L LEVEL, --level LEVEL — default SELinux Level for SELinux user, s0 is the default. (MLS/MCS Systems only)
• -r RANGE, --range RANGE — MLS/MCS Security Range (MLS/MCS Systems only). the SELinux Range for SELinux login mapping defaults to the SELinux user record range. the SELinux Range for SELinux user defaults to s0.
• -R [ROLES], --roles [ROLES] — SELinux Roles. bestie, you must enclose multiple roles within quotes, separated by spaces. OR you can specify -R multiple times. both slay 🌈

heads up: -L and -r are for MLS/MCS systems only. don't come for me if you're on a non-MLS system, that's just what the page says 🙈

---

💜 EXAMPLE 💜

List SELinux users
# semanage user -l
Modify groups for staff_u user
# semanage user -m -R "system_r unconfined_r staff_r" staff_u
Assign user topsecret_u role staff_r and range s0-TopSecret
# semanage user -a -R "staff_r" -rs0-TopSecret topsecret_u

---

⭐ SEE ALSO ⭐

selinux(8), semanage(8), semanage-login(8)

---

🍓 AUTHOR 🍓

this man page was written by Daniel Walsh <dwalsh@redhat.com> — we love a legend 🫶

---

okay that's the whole page, and the date stamp on this iconic piece of work is 20130617, from the semanage-user(8) manual itself. periodt. go configure your SELinux users, main character 💅✨