{"id":4624,"date":"2022-12-20T18:09:20","date_gmt":"2022-12-20T21:09:20","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/user_contexts-man5\/"},"modified":"2022-12-20T18:09:20","modified_gmt":"2022-12-20T21:09:20","slug":"user_contexts-man5","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/user_contexts-man5\/","title":{"rendered":"user_contexts (man5)"},"content":{"rendered":"

user_contexts<\/h1>\n

NAME<\/a>
DESCRIPTION<\/a>
FILE FORMAT<\/a>
EXAMPLE<\/a>
SEE ALSO<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

user_contexts \u2212 The SELinux user contexts configuration files<\/p>\n

DESCRIPTION <\/a> <\/h2>\n

These optional user context configuration files contain entries that allow SELinux-aware login applications such as PAM<\/b>(8) (running in their own process context), to determine the context that a users login session should run under.<\/p>\n

SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active policy path:<\/p>\n

get_default_context<\/b>(3)
get_ordered_context_list<\/b>(3)
get_ordered_context_list_with_level<\/b>(3)
get_default_context_with_level<\/b>(3)
get_default_context_with_role<\/b>(3)
get_default_context_with_rolelevel<\/b>(3)
query_user_context<\/b>(3)
manual_user_enter_context<\/b>(3)<\/p>\n

There can be one file for each SELinux user configured on the system. The file path is formed using the path returned by selinux_user_contexts_path<\/b>(3) for the active policy, with the SELinux user name appended, for example:<\/p>\n

\/etc\/selinux\/{SELINUXTYPE}\/contexts\/users\/unconfined_u
\/etc\/selinux\/{SELINUXTYPE}\/contexts\/users\/xguest_u<\/i><\/p>\n

Where {SELINUXTYPE}<\/i> is the entry from the selinux configuration file config<\/i> (see selinux_config<\/b>(5)).<\/p>\n

These files contain context information as described in the FILE FORMAT<\/b> section.<\/p>\n

FILE FORMAT <\/a> <\/h2>\n

Each line in the user context configuration file consists of the following:<\/p>\n

login_process user_login_process<\/i><\/p>\n

Where:<\/p>\n

login_process<\/i><\/p>\n

This consists of a role<\/i>:<\/b>type<\/i>[:<\/b>range<\/i>] entry that represents the login process context.<\/p>\n

user_login_process<\/i><\/p>\n

This consists of a role<\/i>:<\/b>type<\/i>[:<\/b>range<\/i>] entry that represents the user login process context.<\/p>\n

EXAMPLE <\/a> <\/h2>\n

# Example for xguest_u at \/etc\/selinux\/targeted\/contexts\/users\/xguest_u<\/p>\n\n\n\n\n\n\n\n\n
<\/td>\n\n

system_r:crond_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n <\/td>\n <\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

system_r:initrc_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/td>\n <\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

system_r:local_login_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/td>\n<\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

system_r:remote_login_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/td>\n<\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

system_r:sshd_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n <\/td>\n <\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

system_r:xdm_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n <\/td>\n <\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/td>\n <\/td>\n\n

xguest_r:xguest_t:s0<\/p>\n<\/td>\n<\/tr>\n<\/table>\n

SEE ALSO <\/a> <\/h2>\n

selinux<\/b>(8), selinux_user_contexts_path<\/b>(3), PAM<\/b>(8), get_ordered_context_list<\/b>(3), get_ordered_context_list_with_level<\/b>(3), get_default_context_with_level<\/b>(3), get_default_context_with_role<\/b>(3), get_default_context_with_rolelevel<\/b>(3), query_user_context<\/b>(3), manual_user_enter_context<\/b>(3), selinux_config<\/b>(5)<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

user_contexts \u2212 The SELinux user contexts configuration files <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[959],"tags":[961,1291,1565],"class_list":["post-4624","post","type-post","status-publish","format-standard","hentry","category-5-formatos-de-ficheros","tag-961","tag-man5","tag-user_contexts"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=4624"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4624\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=4624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=4624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=4624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}