guest_selinux(8)

1guest_selinux(8)      guest SELinux Policy documentation      guest_selinux(8)
2
3
4

NAME

6       guest_u  - Least privledge terminal user - Security Enhanced Linux Pol‐
7       icy
8
9

DESCRIPTION

11       guest_u is an SELinux User defined in the SELinux policy. SELinux users
12       have  default  roles,  guest_r.   The  default role has a default type,
13       guest_t, associated with it.
14
15       The SELinux user will usually login to a system  with  a  context  that
16       looks like:
17
18       guest_u:guest_r:guest_t:s0
19
20       Linux  users  are  automatically  assigned  an  SELinux users at login.
21       Login programs use the SELinux User to assign initial  context  to  the
22       user's shell.
23
24       SELinux policy uses the context to control the user's access.
25
26       By  default  all  users  are  assigned  to  the  SELinux  user  via the
27       __default__ flag
28
29       On Targeted policy systems the __default__  user  is  assigned  to  the
30       unconfined_u SELinux user.
31
32       You can list all Linux User to SELinux user mapping using:
33
34       semanage login -l
35
36       If  you  wanted  to  change the default user mapping to use the guest_u
37       user, you would execute:
38
39       semanage login -m -s guest_u __default__
40
41
42

USER DESCRIPTION

44       The SELinux user guest_u is defined in policy as a  unprivileged  user.
45       SELinux  prevents  unprivileged  users  from doing administration tasks
46       without transitioning to a different role.
47
48

SUDO

X WINDOWS LOGIN

51       The SELinux user guest_u is not able to X Windows login.
52
53

NETWORK

55       The SELinux user guest_u is able to listen on the following tcp ports.
56
57              all ports > 500 and < 1024
58
59              all ports with out defined types
60
61
62       The SELinux user guest_u is able to connect to the following tcp ports.
63
64              389,636,3268
65
66              53
67
68              88,750
69
70              111
71
72              all ports with out defined types
73
74              all ports < 1024
75
76              9080
77
78
79       The SELinux user guest_u is able to listen on the following udp ports.
80
81              all ports > 500 and < 1024
82
83              all ports with out defined types
84
85
86       The SELinux user guest_u is able to connect to the following tcp ports.
87
88              389,636,3268
89
90              53
91
92              88,750
93
94              111
95
96              all ports with out defined types
97
98              all ports < 1024
99
100              9080
101
102

BOOLEANS

104       SELinux policy is customizable based on least access  required.   guest
105       policy is extremely flexible and has several booleans that allow you to
106       manipulate the policy and run guest with the tightest access possible.
107
108
109
110       If you want to allow direct login to the console device.  Required  for
111       System  390,  you must turn on the allow_console_login boolean. Enabled
112       by default.
113
114       setsebool -P allow_console_login 1
115
116
117
118       If you want to allow all domains to use other domains file descriptors,
119       you must turn on the allow_domain_fd_use boolean. Enabled by default.
120
121       setsebool -P allow_domain_fd_use 1
122
123
124
125       If  you  want to allow unconfined executables to map a memory region as
126       both executable and writable, this  is  dangerous  and  the  executable
127       should  be  reported  in  bugzilla), you must turn on the allow_execmem
128       boolean. Enabled by default.
129
130       setsebool -P allow_execmem 1
131
132
133
134       If you want to allow unconfined executables to make  their  stack  exe‐
135       cutable.   This  should  never, ever be necessary. Probably indicates a
136       badly coded executable, but could indicate an attack.  This  executable
137       should  be  reported in bugzilla), you must turn on the allow_execstack
138       boolean. Enabled by default.
139
140       setsebool -P allow_execstack 1
141
142
143
144       If you want to allow confined applications to run  with  kerberos,  you
145       must turn on the allow_kerberos boolean. Enabled by default.
146
147       setsebool -P allow_kerberos 1
148
149
150
151       If  you want to allow sysadm to debug or ptrace all processes, you must
152       turn on the allow_ptrace boolean. Disabled by default.
153
154       setsebool -P allow_ptrace 1
155
156
157
158       If you want to allow system to run with  NIS,  you  must  turn  on  the
159       allow_ypbind boolean. Disabled by default.
160
161       setsebool -P allow_ypbind 1
162
163
164
165       If  you  want to allow all domains to have the kernel load modules, you
166       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
167       default.
168
169       setsebool -P domain_kernel_load_modules 1
170
171
172
173       If you want to allow all domains to execute in fips_mode, you must turn
174       on the fips_mode boolean. Enabled by default.
175
176       setsebool -P fips_mode 1
177
178
179
180       If you want to enable reading of urandom for all domains, you must turn
181       on the global_ssp boolean. Disabled by default.
182
183       setsebool -P global_ssp 1
184
185
186
187       If  you  want  to  allow  httpd  cgi  support,  you  must  turn  on the
188       httpd_enable_cgi boolean. Enabled by default.
189
190       setsebool -P httpd_enable_cgi 1
191
192
193
194       If you want to unify HTTPD handling of all content files, you must turn
195       on the httpd_unified boolean. Disabled by default.
196
197       setsebool -P httpd_unified 1
198
199
200
201       If  you  want to allow confined applications to use nscd shared memory,
202       you must turn on the nscd_use_shm boolean. Enabled by default.
203
204       setsebool -P nscd_use_shm 1
205
206
207
208       If you want to enabling secure mode disallows programs,  such  as  new‐
209       role,  from transitioning to administrative user domains, you must turn
210       on the secure_mode boolean. Disabled by default.
211
212       setsebool -P secure_mode 1
213
214
215
216       If you want to allow ssh logins as sysadm_r:sysadm_t, you must turn  on
217       the ssh_sysadm_login boolean. Disabled by default.
218
219       setsebool -P ssh_sysadm_login 1
220
221
222
223       If  you  want  to  support  NFS  home directories, you must turn on the
224       use_nfs_home_dirs boolean. Disabled by default.
225
226       setsebool -P use_nfs_home_dirs 1
227
228
229
230       If you want to support SAMBA home directories, you  must  turn  on  the
231       use_samba_home_dirs boolean. Disabled by default.
232
233       setsebool -P use_samba_home_dirs 1
234
235
236
237       If  you  want  to  allow  xdm  logins  as  sysadm, you must turn on the
238       xdm_sysadm_login boolean. Disabled by default.
239
240       setsebool -P xdm_sysadm_login 1
241
242
243

HOME_EXEC

245       The SELinux user guest_u is able execute home content files.
246
247

TRANSITIONS

249       Three things can happen when guest_t attempts to execute a program.
250
251       1. SELinux Policy can deny guest_t from executing the program.
252
253
254
255       2. SELinux Policy can allow guest_t to execute the program in the  cur‐
256       rent user type.
257
258              Execute  the  following  to  see the types that the SELinux user
259              guest_t can execute without transitioning:
260
261              sesearch -A -s guest_t -c file -p execute_no_trans
262
263
264
265       3. SELinux can allow guest_t to execute the program and transition to a
266       new type.
267
268              Execute  the  following  to  see the types that the SELinux user
269              guest_t can execute and transition:
270
271              $ sesearch -A -s guest_t -c process -p transition
272
273
274

MANAGED FILES

276       The SELinux process type guest_t can manage files labeled with the fol‐
277       lowing  file  types.   The paths listed are the default paths for these
278       file types.  Note the processes UID still need to have DAC permissions.
279
280       anon_inodefs_t
281
282
283       auth_cache_t
284
285            /var/cache/coolkey(/.*)?
286
287       cifs_t
288
289
290       httpd_user_content_t
291
292            /home/[^/]*/((www)|(web)|(public_html))(/.+)?
293            /home/staff/((www)|(web)|(public_html))(/.+)?
294
295       httpd_user_htaccess_t
296
297
298       httpd_user_ra_content_t
299
300
301       httpd_user_rw_content_t
302
303
304       httpd_user_script_exec_t
305
306
307       initrc_tmp_t
308
309
310       mnt_t
311
312            /mnt(/[^/]*)
313            /mnt(/[^/]*)?
314            /rhev(/[^/]*)?
315            /media(/[^/]*)
316            /media(/[^/]*)?
317            /etc/rhgb(/.*)?
318            /media/.hal-.*
319            /net
320            /afs
321            /rhev
322            /misc
323
324       nfs_t
325
326
327       tmp_t
328
329            /tmp
330            /usr/tmp
331            /var/tmp
332            /tmp-inst
333            /var/tmp-inst
334            /var/tmp/vi.recover
335
336       user_home_type
337
338            all user home files
339
340       user_tmp_t
341
342            /tmp/gconfd-.*
343            /tmp/gconfd-staff
344
345       user_tmpfs_t
346
347            /dev/shm/mono.*
348            /dev/shm/pulse-shm.*
349
350

COMMANDS

352       semanage fcontext can also be used to manipulate default  file  context
353       mappings.
354
355       semanage  permissive  can  also  be used to manipulate whether or not a
356       process type is permissive.
357
358       semanage module can also be used to enable/disable/install/remove  pol‐
359       icy modules.
360
361       semanage boolean can also be used to manipulate the booleans
362
363
364       system-config-selinux is a GUI tool available to customize SELinux pol‐
365       icy settings.
366
367

AUTHOR

369       This manual page was auto-generated using sepolicy manpage .
370
371