user_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

okay so bestie, welcome to user_selinux(8) — the user SELinux Policy documentation 💖. Today’s main character is user_u, and we’re gonna get into every single deet: roles, types, ports, booleans, file paths, the whole vibe. No cap, nothing skipped.

✨ NAME ✨

  • user_u — Generic unprivileged user - Security Enhanced Linux Policy

💖 DESCRIPTION 💖

user_u is an SELinux User defined in the SELinux policy. SELinux users have default roles, user_r. The default role has a default type, user_t, associated with it.

The SELinux user will usually login to a system with a context that looks like:

user_u:user_r:user_t:s0

Linux users are automatically assigned an SELinux users at login. Login programs use the SELinux User to assign initial context to the user’s shell.

SELinux policy uses the context to control the user’s access.

By default all users are assigned to the SELinux user via the __default__ flag.

On Targeted policy systems the __default__ user is assigned to the unconfined_u SELinux user.

You can list all Linux User to SELinux user mapping using:

semanage login -l

If you wanted to change the default user mapping to use the user_u user, you would execute:

semanage login -m -s user_u __default__

If you want to map the one Linux user (joe) to the SELinux user user, you would execute:

$ semanage login -a -s user_u joe

🫶 USER DESCRIPTION 🫶

The SELinux user user_u is defined in policy as a unprivileged user. SELinux prevents unprivileged users from doing administration tasks without transitioning to a different role.

💅 SUDO 💅

okay so this section is literally just a heading in the original — no extra deets, no commands, nothing. We’re not inventing anything here, bestie. Moving on 💖

🪟 X WINDOWS LOGIN 🪟

The SELinux user user_u is able to X Windows login.

🌐 NETWORK 🌐

The SELinux user user_u is able to listen on the following tcp ports.

  • 1716
  • 6000-6020
  • 3689
  • all ports >= 1024
  • all ports without defined types
  • 32768-60999

The SELinux user user_u is able to connect to the following tcp ports.

  • 8955
  • 53,853
  • all ports
  • 389,636,3268,3269,7389
  • all ports without defined types
  • 32768-60999
  • all ports < 1024
  • 9080
  • 88,750,4444

The SELinux user user_u is able to listen on the following udp ports.

  • 5353
  • 32768-60999
  • 1716
  • all ports without defined types
  • all ports >= 1024

The SELinux user user_u is able to connect to the following tcp ports.

yep, it really says tcp again here even though we’re in the udp part — keeping it 100% as written 💀
  • 8955
  • 53,853
  • all ports
  • 389,636,3268,3269,7389
  • all ports without defined types
  • 32768-60999
  • all ports < 1024
  • 9080
  • 88,750,4444

🎚️ BOOLEANS 🎚️

SELinux policy is customizable based on least access required. user policy is extremely flexible and has several booleans that allow you to manipulate the policy and run user with the tightest access possible.

  • cron_userdomain_transition — want to determine whether crond can execute jobs in the user domain as opposed to the generic cronjob domain? turn this on. Enabled by default. Run setsebool -P cron_userdomain_transition 1.
  • deny_bluetooth — want to deny all system processes and Linux users to use bluetooth wireless technology? turn this on. Disabled by default. Run setsebool -P deny_bluetooth 1.
  • deny_execmem — want to deny user domains applications to map a memory region as both executable and writable? this is dangerous and the executable should be reported in bugzilla. Disabled by default. Run setsebool -P deny_execmem 1.
  • deny_ptrace — want to deny any process from ptracing or debugging any other processes? turn this on. Disabled by default. Run setsebool -P deny_ptrace 1.
  • fips_mode — want to allow all domains to execute in fips_mode? turn this on. Enabled by default. Run setsebool -P fips_mode 1.
  • git_session_users — want to determine whether calling user domains can execute Git daemon in the git_session_t domain? turn this on. Disabled by default. Run setsebool -P git_session_users 1.
  • httpd_enable_cgi — want to allow httpd cgi support? turn this on. Enabled by default. Run setsebool -P httpd_enable_cgi 1.
  • httpd_unified — want to unify HTTPD handling of all content files? turn this on. Disabled by default. Run setsebool -P httpd_unified 1.
  • nis_enabled — want to allow system to run with NIS? turn this on. Disabled by default. Run setsebool -P nis_enabled 1.
  • polipo_session_users — want to determine whether calling user domains can execute Polipo daemon in the polipo_session_t domain? turn this on. Disabled by default. Run setsebool -P polipo_session_users 1.
  • pppd_for_user — want to allow pppd to be run for a regular user? turn this on. Disabled by default. Run setsebool -P pppd_for_user 1.
  • selinuxuser_execmod — want to allow all unconfined executables to use libraries requiring text relocation that are not labeled textrel_shlib_t? turn this on. Disabled by default. Run setsebool -P selinuxuser_execmod 1.
  • selinuxuser_execstack — want to allow unconfined executables to make their stack executable? this should never, ever be necessary. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default. Run setsebool -P selinuxuser_execstack 1.
  • selinuxuser_mysql_connect_enabled — want to allow users to connect to the local mysql server? turn this on. Disabled by default. Run setsebool -P selinuxuser_mysql_connect_enabled 1.
  • selinuxuser_ping — want to allow confined users the ability to execute the ping and traceroute commands? turn this on. Disabled by default. Run setsebool -P selinuxuser_ping 1.
  • selinuxuser_rw_noexattrfile — want to allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)? turn this on. Disabled by default. Run setsebool -P selinuxuser_rw_noexattrfile 1.
  • selinuxuser_use_ssh_chroot — want to allow user to use ssh chroot environment? turn this on. Disabled by default. Run setsebool -P selinuxuser_use_ssh_chroot 1.
  • unprivuser_use_svirt — want to allow unprivileged user to create and transition to svirt domains? turn this on. Disabled by default. Run setsebool -P unprivuser_use_svirt 1.
  • use_nfs_home_dirs — want to support NFS home directories? turn this on. Enabled by default. Run setsebool -P use_nfs_home_dirs 1.
  • use_samba_home_dirs — want to support SAMBA home directories? turn this on. Disabled by default. Run setsebool -P use_samba_home_dirs 1.

🏠 HOME_EXEC 🏠

The SELinux user user_u is able execute home content files.

🔁 TRANSITIONS 🔁

Three things can happen when user_t attempts to execute a program.

  1. SELinux Policy can deny user_t from executing the program.
  2. SELinux Policy can allow user_t to execute the program in the current user type.

Execute the following to see the types that the SELinux user user_t can execute without transitioning:

sesearch -A -s user_t -c file -p execute_no_trans
  1. SELinux can allow user_t to execute the program and transition to a new type.

Execute the following to see the types that the SELinux user user_t can execute and transition:

$ sesearch -A -s user_t -c process -p transition

📁 MANAGED FILES 📁

The SELinux process type user_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions.

  • alsa_home_t
    • /home/[^/]+/.asoundrc
  • auth_cache_t
    • /var/cache/coolkey(/.*)?
  • bluetooth_helper_tmp_t — no default paths listed.
  • bluetooth_helper_tmpfs_t — no default paths listed.
  • chrome_sandbox_tmpfs_t — no default paths listed.
  • faillog_t
    • /var/log/btmp.*
    • /run/faillock(/.*)?
    • /var/log/faillog.*
    • /var/log/tallylog.*
  • games_data_t
    • /var/games(/.*)?
    • /var/lib/games(/.*)?
  • gconf_tmp_t
    • /tmp/gconfd-[^/]+/.*
  • gpg_agent_tmp_t
    • /home/[^/]+/.gnupg/log-socket
  • httpd_user_content_t
    • /home/[^/]+/((www)|(web)|(public_html))(/.+)?
  • httpd_user_htaccess_t
    • /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
  • httpd_user_ra_content_t
    • /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
  • httpd_user_rw_content_t — no default paths listed.
  • httpd_user_script_exec_t
    • /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
  • krb5_host_rcache_t
    • /var/tmp/krb5_0.rcache2
    • /var/cache/krb5rcache(/.*)?
    • /var/tmp/nfs_0
    • /var/tmp/DNS_25
    • /var/tmp/host_0
    • /var/tmp/imap_0
    • /var/tmp/HTTP_23
    • /var/tmp/HTTP_48
    • /var/tmp/ldap_55
    • /var/tmp/ldap_487
    • /var/tmp/ldapmap1_0
  • mail_spool_t
    • /var/mail(/.*)?
    • /var/spool/imap(/.*)?
    • /var/spool/mail(/.*)?
    • /var/spool/smtpd(/.*)?
  • mqueue_spool_t
    • /var/spool/(client)?mqueue(/.*)?
    • /var/spool/mqueue.in(/.*)?
  • pulseaudio_tmpfs_t — no default paths listed.
  • pulseaudio_tmpfsfile — no default paths listed.
  • sandbox_tmpfs_type
    • all sandbox content in tmpfs file systems
  • security_t
    • /selinux
  • session_dbusd_tmp_t
    • /run/user/[0-9]+/bus
    • /run/user/[0-9]+/dbus(/.*)?
    • /run/user/[0-9]+/dbus-1(/.*)?
  • usbfs_t — no default paths listed.
  • user_fonts_cache_t
    • /root/.fontconfig(/.*)?
    • /root/.fonts/auto(/.*)?
    • /root/.fonts.cache-.*
    • /root/.cache/fontconfig(/.*)?
    • /home/[^/]+/.fontconfig(/.*)?
    • /home/[^/]+/.fonts/auto(/.*)?
    • /home/[^/]+/.fonts.cache-.*
    • /home/[^/]+/.cache/fontconfig(/.*)?
  • user_home_type
    • all user home files
  • user_tmp_t
    • /run/tlog(/.*)?
    • /run/user/[^/]+
    • /dev/shm/mono.*
    • /tmp/.ICE-unix(/.*)?
    • /tmp/.X11-unix(/.*)?
    • /dev/shm/pulse-shm.*
    • /run/user
    • /tmp/.X0-lock
    • /tmp/hsperfdata_root
    • /var/tmp/hsperfdata_root
    • /home/[^/]+/tmp
    • /home/[^/]+/.tmp
    • /run/user/[0-9]+
    • /tmp/gconfd-[^/]+
  • user_tmp_type
    • all user tmp files
  • virt_image_type
    • all virtual image files
  • xserver_tmpfs_t — no default paths listed.

💻 COMMANDS 💻

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage boolean can also be used to manipulate the booleans
  • system-config-selinux is a GUI tool available to customize SELinux policy settings.

👑 AUTHOR 👑

Okay so nobody wrote this with their human hands, bestie — it's auto-generated ✨. The page literally says it was created using sepolicy manpage, which is a tool that reads the policy and spits out documentation for you. So if you ever wondered "who do I thank for this masterpiece," the answer is: a script. Iconic behaviour honestly 🎀

🌈 SEE ALSO 🌈

The friend group of related manpages — go read these next, they're all linked together and honestly it's giving a whole cinematic universe 💅:

ngl the duplicates are giving "Ctrl+V twice and shipped it" energy, but they're all real references so we keep every single one. No entries left behind 🫶

💌 one last cute sign-off 💌

That's the whole page, bestie! Footer time, and it's short and sweet: it's brought to you by mgrepl@redhat.com, with the version/section thing being just user, and the page title itself is user_selinux(8) 🎀 That's the source, the version, and the page name, all wrapped up. Go forth and be secure — SELinux is your friend, not your enemy, fr fr 🔥💖

📦 where this page comes from