홈
제품
Red Hat Enterprise Linux
10
Using SELinux
3.2. Roles and access rights of SELinux users

3.2. Roles and access rights of SELinux users

The SELinux policy maps each Linux user to an SELinux user. This allows Linux users to inherit the restrictions of SELinux users.

You can customize the permissions for confined users in your SELinux policy according to specific needs by adjusting booleans in the policy. You can determine the current state of these booleans by using the semanage boolean -l command. To list all SELinux users, their SELinux roles, and levels and ranges for MLS and MCS, use the semanage user -l command as root.

Expand

표 3.1. Roles of SELinux users
User	Default role	Additional roles
`unconfined_u`	`unconfined_r`	`system_r`
`guest_u`	`guest_r`
`xguest_u`	`xguest_r`
`user_u`	`user_r`
`staff_u`	`staff_r`	`sysadm_r`
		`unconfined_r`
		`system_r`
`sysadm_u`	`sysadm_r`
`root`	`staff_r`	`sysadm_r`
		`unconfined_r`
		`system_r`
`system_u`	`system_r`

Note that system_u is a special user identity for system processes and objects, and system_r is the associated role. Administrators must never associate this system_u user and the system_r role to a Linux user. Also, unconfined_u and root are unconfined users. For these reasons, the roles associated to these SELinux users are not included in the following table Types and access rights of SELinux roles.

Each SELinux role corresponds to an SELinux type and provides specific access rights.

Expand

표 3.2. Types and access rights of SELinux roles
Role	Type	Log in using X Window System	`su` and `sudo`	Execute in home directory and `/tmp` (default)	Networking
`unconfined_r`	`unconfined_t`	yes	yes	yes	yes
`guest_r`	`guest_t`	no	no	yes	no
`xguest_r`	`xguest_t`	yes	no	yes	web browsers only (Mozilla Firefox, GNOME Web)
`user_r`	`user_t`	yes	no	yes	yes
`staff_r`	`staff_t`	yes	only `sudo`	yes	yes
`auditadm_r`	`auditadm_t`		yes	yes	yes
`dbadm_r`	`dbadm_r`		yes	yes	yes
`logadm_r`	`logadm_t`		yes	yes	yes
`webadm_r`	`webadm_r`		yes	yes	yes
`secadm_r`	`secadm_t`		yes	yes	yes
`sysadm_r`	`sysadm_t`	only when the `xdm_sysadm_login` boolean is `on`	yes	yes	yes

For more detailed descriptions of the non-administrator roles, see Confined non-administrator roles in SELinux.

For more detailed descriptions of the administrator roles, see Confined administrator roles in SELinux.

To list all available roles, enter the seinfo -r command:

$ seinfo -r
Roles: 14
   auditadm_r
   dbadm_r
   guest_r
   logadm_r
   nx_server_r
   object_r
   secadm_r
   staff_r
   sysadm_r
   system_r
   unconfined_r
   user_r
   webadm_r
   xguest_r

Note that the seinfo command is provided by the setools-console package, which is not installed by default.

3.2. Roles and access rights of SELinux users

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links