Contents
What are SELinux users and how to map Linux users to?
However, SELinux can confine Linux users, to take advantage of the security rules and mechanisms applied to them, by mapping Linux users to SELinux users. A number of confined SELinux users exist in SELinux policy. The following is a list of confined SELinux users and their associated domains:
Why are SELinux users not allowed to use home directories?
– By default, Linux users in the guest_t and xguest_t domains cannot execute applications in their home directories or /tmp, preventing them from executing applications in directories they have write access to. This helps prevent flawed or malicious applications from modifying files that users own.
How are MLS and MCs defined in SELinux?
SELinux policy rules define how types can access each other, whether it is a domain accessing a type, or a domain accessing another domain. Level is an attribute of MLS and MCS. An MLS range is a pair of levels, written as lowlevel- highlevel if the levels differ, or lowlevel if the levels are identical (s0-s0 is the same as s0).
How to change the context of a SELinux file?
Use the chcon command to change the SELinux context for files. Changes made with the chcon command do not survive a file system relabel or the execution of the restorecon command. When using chcon, provide all or part of the SELinux context to change.
How to confine new users in SELinux context?
Confining New Linux Users: useradd 6.3. Confining Existing Linux Users: semanage login 6.4. Changing the Default Mapping 6.6. Booleans for Users Executing Applications 7. Securing Programs Using Sandbox 7.1. Running an Application Using Sandbox 8.1. Security and Virtualization 9. Secure Linux Containers 10.
How to create a user page in SELinux?
The sepolicy Python Bindings 5.2. Generating SELinux Policy Modules: sepolicy generate 5.3. Understanding Domain Transitions: sepolicy transition 5.4. Generating Manual Pages: sepolicy manpage 6. Confining Users 6.1. Linux and SELinux User Mappings 6.2.
Which is the best way to generate SELinux policy modules?
Generating SELinux Policy Modules: sepolicy generate 5.3. Understanding Domain Transitions: sepolicy transition 5.4. Generating Manual Pages: sepolicy manpage 6. Confining Users 6.1. Linux and SELinux User Mappings 6.2. Confining New Linux Users: useradd 6.3. Confining Existing Linux Users: semanage login 6.4. Changing the Default Mapping 6.6.