1xguest_selinux(8) xguest SELinux Policy documentation xguest_selinux(8)
2
6 xguest_u - Least privileged xwindows user role. - Security Enhanced
7 Linux Policy
8
11 xguest_u is an SELinux User defined in the SELinux policy. SELinux
12 users have default roles, xguest_r. The default role has a default
13 type, xguest_t, associated with it.
14 The SELinux user will usually login to a system with a context that
16 looks like:
17 xguest_u:xguest_r:xguest_t:s0
19 Linux users are automatically assigned an SELinux users at login.
21 Login programs use the SELinux User to assign initial context to the
22 user's shell.
23 SELinux policy uses the context to control the user's access.
25 By default all users are assigned to the SELinux user via the
27 __default__ flag
28 On Targeted policy systems the __default__ user is assigned to the
30 unconfined_u SELinux user.
31 You can list all Linux User to SELinux user mapping using:
33 semanage login -l
35 If you wanted to change the default user mapping to use the xguest_u
37 user, you would execute:
38 semanage login -m -s xguest_u __default__
40 If you want to map the one Linux user (joe) to the SELinux user xguest,
43 you would execute:
44 $ semanage login -a -s xguest_u joe
46
50 The SELinux user xguest_u is defined in policy as a unprivileged user.
51 SELinux prevents unprivileged users from doing administration tasks
52 without transitioning to a different role.
53
57 The SELinux user xguest_u is able to X Windows login.
58
61 The SELinux user xguest_u is able to connect to the following tcp
62 ports.
63 53,853
65 8955
67 8080,8118,8123,10001-10010
69 8036
71 all ports with out defined types
73 9080
75 8000,9433,16001
77 4713
79 8081
81 32768-60999
83 21,989,990
85 80,81,443,488,8008,8009,8443,9000
87 88,750,4444
89 3128,3401,4827
91 4331,5001
93 843,1935
95 631,8610-8614
97 The SELinux user xguest_u is able to connect to the following tcp
100 ports.
101 53,853
103 8955
105 8080,8118,8123,10001-10010
107 8036
109 all ports with out defined types
111 9080
113 8000,9433,16001
115 4713
117 8081
119 32768-60999
121 21,989,990
123 80,81,443,488,8008,8009,8443,9000
125 88,750,4444
127 3128,3401,4827
129 4331,5001
131 843,1935
133 631,8610-8614
135
138 SELinux policy is customizable based on least access required. xguest
139 policy is extremely flexible and has several booleans that allow you to
140 manipulate the policy and run xguest with the tightest access possible.
141 If you want to allow xguest users to configure Network Manager and con‐
145 nect to apache ports, you must turn on the xguest_connect_network bool‐
146 ean. Enabled by default.
147 setsebool -P xguest_connect_network 1
149 If you want to allow xguest users to mount removable media, you must
153 turn on the xguest_mount_media boolean. Enabled by default.
154 setsebool -P xguest_mount_media 1
156 If you want to allow xguest to use blue tooth devices, you must turn on
160 the xguest_use_bluetooth boolean. Enabled by default.
161 setsebool -P xguest_use_bluetooth 1
163 If you want to deny user domains applications to map a memory region as
167 both executable and writable, this is dangerous and the executable
168 should be reported in bugzilla, you must turn on the deny_execmem bool‐
169 ean. Enabled by default.
170 setsebool -P deny_execmem 1
172 If you want to deny any process from ptracing or debugging any other
176 processes, you must turn on the deny_ptrace boolean. Enabled by
177 default.
178 setsebool -P deny_ptrace 1
180 If you want to allow all domains to execute in fips_mode, you must turn
184 on the fips_mode boolean. Enabled by default.
185 setsebool -P fips_mode 1
187 If you want to allow httpd cgi support, you must turn on the
191 httpd_enable_cgi boolean. Enabled by default.
192 setsebool -P httpd_enable_cgi 1
194 If you want to allow confined applications to run with kerberos, you
198 must turn on the kerberos_enabled boolean. Enabled by default.
199 setsebool -P kerberos_enabled 1
201 If you want to allow confined applications to use nscd shared memory,
205 you must turn on the nscd_use_shm boolean. Enabled by default.
206 setsebool -P nscd_use_shm 1
208 If you want to allow unconfined executables to make their stack exe‐
212 cutable. This should never, ever be necessary. Probably indicates a
213 badly coded executable, but could indicate an attack. This executable
214 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
215 stack boolean. Enabled by default.
216 setsebool -P selinuxuser_execstack 1
218 If you want to allow user to r/w files on filesystems that do not have
222 extended attributes (FAT, CDROM, FLOPPY), you must turn on the selin‐
223 uxuser_rw_noexattrfile boolean. Enabled by default.
224 setsebool -P selinuxuser_rw_noexattrfile 1
226 If you want to allow user to use ssh chroot environment, you must turn
230 on the selinuxuser_use_ssh_chroot boolean. Disabled by default.
231 setsebool -P selinuxuser_use_ssh_chroot 1
233 If you want to support NFS home directories, you must turn on the
237 use_nfs_home_dirs boolean. Disabled by default.
238 setsebool -P use_nfs_home_dirs 1
240 If you want to support SAMBA home directories, you must turn on the
244 use_samba_home_dirs boolean. Disabled by default.
245 setsebool -P use_samba_home_dirs 1
247
251 The SELinux user xguest_u is able execute home content files.
252
255 Three things can happen when xguest_t attempts to execute a program.
256 1. SELinux Policy can deny xguest_t from executing the program.
258 2. SELinux Policy can allow xguest_t to execute the program in the cur‐
262 rent user type.
263 Execute the following to see the types that the SELinux user
265 xguest_t can execute without transitioning:
266 sesearch -A -s xguest_t -c file -p execute_no_trans
268 3. SELinux can allow xguest_t to execute the program and transition to
272 a new type.
273 Execute the following to see the types that the SELinux user
275 xguest_t can execute and transition:
276 $ sesearch -A -s xguest_t -c process -p transition
278
282 The SELinux process type xguest_t can manage files labeled with the
283 following file types. The paths listed are the default paths for these
284 file types. Note the processes UID still need to have DAC permissions.
285 alsa_home_t
287 /home/[^/]+/.asoundrc
289 anon_inodefs_t
291 auth_cache_t
294 /var/cache/coolkey(/.*)?
296 chrome_sandbox_tmpfs_t
298 cifs_t
301 dosfs_t
304 gconf_tmp_t
307 /tmp/gconfd-[^/]+/.*
309 gkeyringd_tmp_t
311 /var/run/user/[^/]*/keyring.*
313 gnome_home_type
315 httpd_user_content_t
318 /home/[^/]+/((www)|(web)|(public_html))(/.+)?
320 httpd_user_htaccess_t
322 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
324 httpd_user_ra_content_t
326 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
328 httpd_user_rw_content_t
330 httpd_user_script_exec_t
333 /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
335 nfs_t
337 noxattrfs
340 all files on file systems which do not support extended attributes
342 pulseaudio_tmpfs_t
344 pulseaudio_tmpfsfile
347 usbfs_t
350 user_fonts_cache_t
353 /root/.fontconfig(/.*)?
355 /root/.fonts/auto(/.*)?
356 /root/.fonts.cache-.*
357 /root/.cache/fontconfig(/.*)?
358 /home/[^/]+/.fontconfig(/.*)?
359 /home/[^/]+/.fonts/auto(/.*)?
360 /home/[^/]+/.fonts.cache-.*
361 /home/[^/]+/.cache/fontconfig(/.*)?
362 user_home_type
364 all user home files
366 user_tmp_t
368 /dev/shm/mono.*
370 /var/run/user(/.*)?
371 /tmp/.ICE-unix(/.*)?
372 /tmp/.X11-unix(/.*)?
373 /dev/shm/pulse-shm.*
374 /tmp/.X0-lock
375 /tmp/hsperfdata_root
376 /var/tmp/hsperfdata_root
377 /home/[^/]+/tmp
378 /home/[^/]+/.tmp
379 /tmp/gconfd-[^/]+
380 user_tmp_type
382 all user tmp files
384 xserver_tmpfs_t
386
390 semanage fcontext can also be used to manipulate default file context
391 mappings.
392 semanage permissive can also be used to manipulate whether or not a
394 process type is permissive.
395 semanage module can also be used to enable/disable/install/remove pol‐
397 icy modules.
398 semanage boolean can also be used to manipulate the booleans
400 system-config-selinux is a GUI tool available to customize SELinux pol‐
403 icy settings.
404
407 This manual page was auto-generated using sepolicy manpage .
408
411 selinux(8), xguest(8), semanage(8), restorecon(8), chcon(1), sepol‐
412 icy(8), setsebool(8), xguest_dbusd_selinux(8), xguest_dbusd_selinux(8),
413 xguest_gkeyringd_selinux(8), xguest_gkeyringd_selinux(8)
414mgrepl@redhat.com xguest xguest_selinux(8)