6.2. Confining New Linux Users: useradd

download PDF
Linux users mapped to the SELinux unconfined_u user run in the unconfined_t domain. This is seen by running the id -Z command while logged-in as a Linux user mapped to unconfined_u:
~]$ id -Z
When Linux users run in the unconfined_t domain, SELinux policy rules are applied, but policy rules exist that allow Linux users running in the unconfined_t domain almost all access. If unconfined Linux users execute an application that SELinux policy defines can transition from the unconfined_t domain to its own confined domain, unconfined Linux users are still subject to the restrictions of that confined domain. The security benefit of this is that, even though a Linux user is running unconfined, the application remains confined, and therefore, the exploitation of a flaw in the application can be limited by policy.


This does not protect the system from the user. Instead, the user and the system are being protected from possible damage caused by a flaw in the application.
When creating Linux users with the useradd command, use the -Z option to specify which SELinux user they are mapped to. The following example creates a new Linux user, useruuser, and maps that user to the SELinux user_u user. Linux users mapped to the SELinux user_u user run in the user_t domain. In this domain, Linux users are unable to run setuid applications unless SELinux policy permits it (such as passwd), and cannot run the su or sudo command, preventing them from becoming the root user with these commands.

Procedure 6.1. Confining a New Linux User to user_u SELinux User

  1. As root, create a new Linux user (useruuser) that is mapped to the SELinux user_u user.
    ~]# useradd -Z user_u useruuser
  2. To view the mapping between useruuser and user_u, enter the following command as root:
    ~]# semanage login -l
    Login Name           SELinux User         MLS/MCS Range        Service
    __default__          unconfined_u         s0-s0:c0.c1023       *
    root                 unconfined_u         s0-s0:c0.c1023       *
    system_u             system_u             s0-s0:c0.c1023       *
    useruuser            user_u               s0                   *
  3. As root, assign a password to the Linux useruuser user:
    ~]# passwd useruuser
    Changing password for user useruuser.
    New password: Enter a password
    Retype new password: Enter the same password again
    passwd: all authentication tokens updated successfully.
  4. Log out of your current session, and log in as the Linux useruuser user. When you log in, the pam_selinux module maps the Linux user to an SELinux user (in this case, user_u), and sets up the resulting SELinux context. The Linux user's shell is then launched with this context. Enter the following command to view the context of a Linux user:
    ~]$ id -Z
  5. Log out of the Linux useruuser's session, and log back in with your account. If you do not want the Linux useruuser user, enter the following command as root to remove it, along with its home directory:
    ~]# userdel -Z -r useruuser
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.