Chapter 6. Confining Users

In Red Hat Enterprise Linux, users are mapped to the SELinux unconfined_u user by default. All processes run by unconfined_u are in the unconfined_t domain. This means that users can access across the system within the limits of the standard Linux DAC policy. However, a number of confined SELinux users are available in Red Hat Enterprise Linux. This means that users can be restricted to limited set of capabilities. Each Linux user is mapped to an SELinux user using SELinux policy, allowing Linux users to inherit the restrictions placed on SELinux users, for example (depending on the user), not being able to: For example, processes run by the SELinux user_u user are in the user_t domain. Such processes can connect to network, but cannot run the su or sudo commands. This helps protect the system from the user. See Section 3.3, “Confined and Unconfined Users”, Table 3.1, “SELinux User Capabilities” for further information about confined users and their capabilities.

~]# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

~]# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

__default__          unconfined_u         s0-s0:c0.c1023       *

__default__          unconfined_u         s0-s0:c0.c1023       *