4.4. Managing access to non-standard shared directories for unprivileged SELinux users

Procedure

1. Open the user_selinux(8) man page in your terminal:

   $ man user_selinux

   In the MANAGED FILES section, find an attribute or a type that corresponds with your scenario. For example, the user_home_type attribute.

2. Optional: To list all types assigned to an attribute, use the seinfo command with the -x and -a options, for example:

   $ seinfo -x -a user_home_type
   
   Type Attributes: 1
      attribute user_home_type;
   …
   	chrome_sandbox_home_t
   	config_home_t
   	cvs_home_t
   	data_home_t
   	dbus_home_t
   	fetchmail_home_t
   	gconf_home_t
   	git_user_content_t
   …

3. After you identify a candidate for the corresponding type, the data_home_t type in this example, check its SELinux mapping:

   $ semanage fcontext -l | grep data_home_t
   …
   /root/\.local/share(/.*)?                          all files          system_u:object_r:data_home_t:s0
   …

4. Map the corresponding type to a directory that you want to make accessible for user_u, for example, /shared-data:

   $ semanage fcontext -a -t data_home_t '/shared-data(/.*)?'

Verification

1. Check the mapping of the directory you configured:

   # semanage fcontext -l | grep "shared-data"
   /shared-data(/.*)?                             	all files      	system_u:object_r:data_home_t:s0

2. Log in as a Linux user mapped to the user_u SELinux user, and verify you can access the directory.