Red Hat SummitDieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.
6.2. Confining New Linux Users: useradd
Linux users mapped to the SELinux
unconfined_u user run in the unconfined_t domain. This is seen by running the id -Z command while logged-in as a Linux user mapped to unconfined_u:
~]$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
When Linux users run in the
unconfined_t domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the unconfined_t domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the unconfined_t domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy.
Note
This does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application.
When creating Linux users with the
useradd command, use the -Z option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux user_u user. Linux users mapped to the SELinux user_u user run in the user_t domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as passwd), and cannot run the su or sudo command, preventing them from becoming the Linux root user with these commands.
- As the Linux root user, run the
useradd -Z user_u useruusercommand to create a new Linux user (useruuser) that is mapped to the SELinuxuser_uuser. - As the Linux root user, run the
semanage login -lcommand to view the mapping between the Linuxuseruuseruser anduser_u:~]#
semanage login -lLogin Name SELinux User MLS/MCS Range __default__ unconfined_u s0-s0:c0.c1023 root unconfined_u s0-s0:c0.c1023 system_u system_u s0-s0:c0.c1023 useruuser user_u s0 - As the Linux root user, run the
passwd useruusercommand to assign a password to the Linuxuseruuseruser:~]#
passwd useruuserChanging password for user useruuser. New UNIX password: Enter a password Retype new UNIX password: Enter the same password again passwd: all authentication tokens updated successfully. - Log out of your current session, and log in as the Linux
useruuseruser. When you log in, pam_selinux maps the Linux user to an SELinux user (in this case,user_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Run theid -Zcommand to view the context of a Linux user:~]$
id -Zuser_u:user_r:user_t:s0 - Log out of the Linux
useruuser's session, and log back in with your account. If you do not want the Linuxuseruuseruser, run theuserdel -r useruusercommand as the Linux root user to remove it, along with its home directory.
