Man page - user_contexts(5)

Packages contains this manual

Package:  selinux-utils
apt-get install selinux-utils

Manuals in package:
• selabel_db(5)
• x_contexts(5)
• selabel_media(5)
• matchpathcon(8)
• selabel_x(5)
• getsebool(8)
• file_contexts.subs_dist(5)
• sepgsql_contexts(5)
• media(5)
• setenforce(8)
• default_contexts(5)
• failsafe_context(5)
• avcstat(8)
• file_contexts.local(5)
• seusers(5)
• file_contexts(5)
• service_seusers(5)
• customizable_types(5)
• user_contexts(5)
• getenforce(8)
• sefcontext_compile(8)
• selabel_file(5)
• selinux(8)
• togglesebool(8)
• file_contexts.homedirs(5)
• selinuxenabled(8)
• virtual_image_context(5)
• selinuxexeccon(8)
• virtual_domain_context(5)
• default_type(5)
• securetty_types(5)
• removable_context(5)
• file_contexts.subs(5)
• booleans(8)
• secolor.conf(5)
Documentations in package:
• selinux-utils

Manual

user_contexts

NAME
DESCRIPTION
FILE FORMAT
EXAMPLE
SEE ALSO

---

NAME

user_contexts - The SELinux user contexts configuration files

DESCRIPTION

These optional user context configuration files contain entries that allow SELinux-aware login applications such as PAM (8) (running in their own process context), to determine the context that a users login session should run under.

SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active policy path:

get_default_context (3)
get_ordered_context_list (3)
get_ordered_context_list_with_level (3)
get_default_context_with_level (3)
get_default_context_with_role (3)
get_default_context_with_rolelevel (3)
query_user_context (3)
manual_user_enter_context (3)

There can be one file for each SELinux user configured on the system. The file path is formed using the path returned by selinux_user_contexts_path (3) for the active policy, with the SELinux user name appended, for example:

/etc/selinux/{SELINUXTYPE}/contexts/users/unconfined_u
/etc/selinux/{SELINUXTYPE}/contexts/users/xguest_u

Where {SELINUXTYPE} is the entry from the selinux configuration file config (see selinux_config (5)).

These files contain context information as described in the FILE FORMAT section.

FILE FORMAT

Each line in the user context configuration file consists of the following:

login_process user_login_process

Where:

login_process

This consists of a role : type [ : range ] entry that represents the login process context.

user_login_process

This consists of a role : type [ : range ] entry that represents the user login process context.

EXAMPLE

# Example for xguest_u at /etc/selinux/default/contexts/users/xguest_u

	system_r:crond_t:s0					xguest_r:xguest_t:s0
	system_r:initrc_t:s0					xguest_r:xguest_t:s0
	system_r:local_login_t:s0					xguest_r:xguest_t:s0
	system_r:remote_login_t:s0					xguest_r:xguest_t:s0
	system_r:sshd_t:s0					xguest_r:xguest_t:s0
	system_r:xdm_t:s0					xguest_r:xguest_t:s0
	xguest_r:xguest_t:s0					xguest_r:xguest_t:s0

SEE ALSO

selinux (8), selinux_user_contexts_path (3), PAM (8), get_ordered_context_list (3), get_ordered_context_list_with_level (3), get_default_context_with_level (3), get_default_context_with_role (3), get_default_context_with_rolelevel (3), query_user_context (3), manual_user_enter_context (3), selinux_config (5)

---