3.7. Confining regular users in SELinux

Procedure

1. Display the list of SELinux login records. The list displays the mappings of Linux users to SELinux users:

   # semanage login -l
   
   Login Name    SELinux User  MLS/MCS Range   Service
   
   __default__   unconfined_u  s0-s0:c0.c1023       *
   root          unconfined_u  s0-s0:c0.c1023       *

2. Map the __default__ user, which represents all users without an explicit mapping, to the user_u SELinux user:

   # semanage login -m -s user_u -r s0 __default__

Verification

1. Check that the __default__ user is mapped to the user_u SELinux user:

   # semanage login -l
   
   Login Name    SELinux User   MLS/MCS Range    Service
   
   __default__   user_u         s0               *
   root          unconfined_u   s0-s0:c0.c1023   *

2. Verify that the processes of a new user run in the user_u:user_r:user_t:s0 SELinux context.

   1. Create a new user:

      # adduser <example_user>

   2. Define a password for <example_user>:

      # passwd <example_user>

   3. Log out as root and log in as the new user.

   4. Show the security context for the user’s ID:

      [<example_user>@localhost ~]$ id -Z
      user_u:user_r:user_t:s0

   5. Show the security context of the user’s current processes:

      [<example_user>@localhost ~]$ ps axZ
      LABEL                           PID TTY      STAT   TIME COMMAND
      -                                 1 ?        Ss     0:05 /usr/lib/systemd/systemd --switched-root --system --deserialize 18
      -                              3729 ?        S      0:00 (sd-pam)
      user_u:user_r:user_t:s0        3907 ?        Ss     0:00 /usr/lib/systemd/systemd --user
      -                              3911 ?        S      0:00 (sd-pam)
      user_u:user_r:user_t:s0        3918 ?        S      0:00 sshd: <example_user>@pts/0
      user_u:user_r:user_t:s0        3922 pts/0    Ss     0:00 -bash
      user_u:user_r:user_dbusd_t:s0  3969 ?        Ssl    0:00 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
      user_u:user_r:user_t:s0        3971 pts/0    R+     0:00 ps axZ