1xguest_selinux(8) xguest SELinux Policy documentation xguest_selinux(8)
2
6 xguest_u - Least privileged xwindows user role. - Security Enhanced
7 Linux Policy
8
11 xguest_u is an SELinux User defined in the SELinux policy. SELinux
12 users have default roles, xguest_r. The default role has a default
13 type, xguest_t, associated with it.
14 The SELinux user will usually login to a system with a context that
16 looks like:
17 xguest_u:xguest_r:xguest_t:s0
19 Linux users are automatically assigned an SELinux users at login.
21 Login programs use the SELinux User to assign initial context to the
22 user's shell.
23 SELinux policy uses the context to control the user's access.
25 By default all users are assigned to the SELinux user via the
27 __default__ flag
28 On Targeted policy systems the __default__ user is assigned to the
30 unconfined_u SELinux user.
31 You can list all Linux User to SELinux user mapping using:
33 semanage login -l
35 If you wanted to change the default user mapping to use the xguest_u
37 user, you would execute:
38 semanage login -m -s xguest_u __default__
40
44 The SELinux user xguest_u is defined in policy as a unprivileged user.
45 SELinux prevents unprivileged users from doing administration tasks
46 without transitioning to a different role.
47
51 The SELinux user xguest_u is able to X Windows login.
52
55 The SELinux user xguest_u is able to listen on the following tcp ports.
56 32768-61000
58 all ports with out defined types
60 The SELinux user xguest_u is able to connect to the following tcp
63 ports.
64 53
66 8955
68 32768-61000
70 4331,5001
72 all ports < 1024
74 all ports with out defined types
76 8081
78 8080,8118,8123,10001-10010
80 8036
82 9080
84 389,636,3268,3269,7389
86 631,8610-8614
88 111
90 88,750,4444
92 4713
94 3128,3401,4827
96 21,989,990
98 843,1935
100 8000,9433,16001
102 80,81,443,488,8008,8009,8443,9000
104 The SELinux user xguest_u is able to listen on the following udp ports.
107 32768-61000
109 all ports with out defined types
111 The SELinux user xguest_u is able to connect to the following tcp
114 ports.
115 53
117 8955
119 32768-61000
121 4331,5001
123 all ports < 1024
125 all ports with out defined types
127 8081
129 8080,8118,8123,10001-10010
131 8036
133 9080
135 389,636,3268,3269,7389
137 631,8610-8614
139 111
141 88,750,4444
143 4713
145 3128,3401,4827
147 21,989,990
149 843,1935
151 8000,9433,16001
153 80,81,443,488,8008,8009,8443,9000
155
158 SELinux policy is customizable based on least access required. xguest
159 policy is extremely flexible and has several booleans that allow you to
160 manipulate the policy and run xguest with the tightest access possible.
161 If you want to allow xguest users to configure Network Manager and con‐
165 nect to apache ports, you must turn on the xguest_connect_network bool‐
166 ean. Enabled by default.
167 setsebool -P xguest_connect_network 1
169 If you want to allow xguest users to mount removable media, you must
173 turn on the xguest_mount_media boolean. Enabled by default.
174 setsebool -P xguest_mount_media 1
176 If you want to allow xguest to use blue tooth devices, you must turn on
180 the xguest_use_bluetooth boolean. Enabled by default.
181 setsebool -P xguest_use_bluetooth 1
183 If you want to allow users to resolve user passwd entries directly from
187 ldap rather then using a sssd server, you must turn on the authlo‐
188 gin_nsswitch_use_ldap boolean. Disabled by default.
189 setsebool -P authlogin_nsswitch_use_ldap 1
191 If you want to deny user domains applications to map a memory region as
195 both executable and writable, this is dangerous and the executable
196 should be reported in bugzilla, you must turn on the deny_execmem bool‐
197 ean. Enabled by default.
198 setsebool -P deny_execmem 1
200 If you want to deny any process from ptracing or debugging any other
204 processes, you must turn on the deny_ptrace boolean. Enabled by
205 default.
206 setsebool -P deny_ptrace 1
208 If you want to allow any process to mmap any file on system with
212 attribute file_type, you must turn on the domain_can_mmap_files bool‐
213 ean. Enabled by default.
214 setsebool -P domain_can_mmap_files 1
216 If you want to allow all domains write to kmsg_device, while kernel is
220 executed with systemd.log_target=kmsg parameter, you must turn on the
221 domain_can_write_kmsg boolean. Disabled by default.
222 setsebool -P domain_can_write_kmsg 1
224 If you want to allow all domains to use other domains file descriptors,
228 you must turn on the domain_fd_use boolean. Enabled by default.
229 setsebool -P domain_fd_use 1
231 If you want to allow all domains to have the kernel load modules, you
235 must turn on the domain_kernel_load_modules boolean. Disabled by
236 default.
237 setsebool -P domain_kernel_load_modules 1
239 If you want to allow all domains to execute in fips_mode, you must turn
243 on the fips_mode boolean. Enabled by default.
244 setsebool -P fips_mode 1
246 If you want to enable reading of urandom for all domains, you must turn
250 on the global_ssp boolean. Disabled by default.
251 setsebool -P global_ssp 1
253 If you want to allow httpd cgi support, you must turn on the
257 httpd_enable_cgi boolean. Enabled by default.
258 setsebool -P httpd_enable_cgi 1
260 If you want to unify HTTPD handling of all content files, you must turn
264 on the httpd_unified boolean. Disabled by default.
265 setsebool -P httpd_unified 1
267 If you want to allow confined applications to run with kerberos, you
271 must turn on the kerberos_enabled boolean. Enabled by default.
272 setsebool -P kerberos_enabled 1
274 If you want to allow logging in and using the system from /dev/console,
278 you must turn on the login_console_enabled boolean. Enabled by default.
279 setsebool -P login_console_enabled 1
281 If you want to allow system to run with NIS, you must turn on the
285 nis_enabled boolean. Disabled by default.
286 setsebool -P nis_enabled 1
288 If you want to allow confined applications to use nscd shared memory,
292 you must turn on the nscd_use_shm boolean. Enabled by default.
293 setsebool -P nscd_use_shm 1
295 If you want to disallow programs, such as newrole, from transitioning
299 to administrative user domains, you must turn on the secure_mode bool‐
300 ean. Enabled by default.
301 setsebool -P secure_mode 1
303 If you want to allow regular users direct dri device access, you must
307 turn on the selinuxuser_direct_dri_enabled boolean. Enabled by default.
308 setsebool -P selinuxuser_direct_dri_enabled 1
310 If you want to allow unconfined executables to make their stack exe‐
314 cutable. This should never, ever be necessary. Probably indicates a
315 badly coded executable, but could indicate an attack. This executable
316 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
317 stack boolean. Enabled by default.
318 setsebool -P selinuxuser_execstack 1
320 If you want to allow user to r/w files on filesystems that do not have
324 extended attributes (FAT, CDROM, FLOPPY), you must turn on the selin‐
325 uxuser_rw_noexattrfile boolean. Enabled by default.
326 setsebool -P selinuxuser_rw_noexattrfile 1
328 If you want to allow user to use ssh chroot environment, you must turn
332 on the selinuxuser_use_ssh_chroot boolean. Disabled by default.
333 setsebool -P selinuxuser_use_ssh_chroot 1
335 If you want to allow ssh logins as sysadm_r:sysadm_t, you must turn on
339 the ssh_sysadm_login boolean. Disabled by default.
340 setsebool -P ssh_sysadm_login 1
342 If you want to support NFS home directories, you must turn on the
346 use_nfs_home_dirs boolean. Disabled by default.
347 setsebool -P use_nfs_home_dirs 1
349 If you want to support SAMBA home directories, you must turn on the
353 use_samba_home_dirs boolean. Disabled by default.
354 setsebool -P use_samba_home_dirs 1
356 If you want to allow the graphical login program to login directly as
360 sysadm_r:sysadm_t, you must turn on the xdm_sysadm_login boolean.
361 Enabled by default.
362 setsebool -P xdm_sysadm_login 1
364 If you want to allows clients to write to the X server shared memory
368 segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
369 abled by default.
370 setsebool -P xserver_clients_write_xshm 1
372 If you want to support X userspace object manager, you must turn on the
376 xserver_object_manager boolean. Enabled by default.
377 setsebool -P xserver_object_manager 1
379
383 The SELinux user xguest_u is able execute home content files.
384
387 Three things can happen when xguest_t attempts to execute a program.
388 1. SELinux Policy can deny xguest_t from executing the program.
390 2. SELinux Policy can allow xguest_t to execute the program in the cur‐
394 rent user type.
395 Execute the following to see the types that the SELinux user
397 xguest_t can execute without transitioning:
398 sesearch -A -s xguest_t -c file -p execute_no_trans
400 3. SELinux can allow xguest_t to execute the program and transition to
404 a new type.
405 Execute the following to see the types that the SELinux user
407 xguest_t can execute and transition:
408 $ sesearch -A -s xguest_t -c process -p transition
410
414 The SELinux process type xguest_t can manage files labeled with the
415 following file types. The paths listed are the default paths for these
416 file types. Note the processes UID still need to have DAC permissions.
417 anon_inodefs_t
419 auth_cache_t
422 /var/cache/coolkey(/.*)?
424 chrome_sandbox_tmpfs_t
426 cifs_t
429 gconf_tmp_t
432 /tmp/gconfd-[^/]+/.*
434 gnome_home_type
436 httpd_user_content_t
439 /home/[^/]+/((www)|(web)|(public_html))(/.+)?
441 httpd_user_htaccess_t
443 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
445 httpd_user_ra_content_t
447 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
449 httpd_user_rw_content_t
451 httpd_user_script_exec_t
454 /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
456 noxattrfs
458 all files on file systems which do not support extended attributes
460 pulseaudio_tmpfs_t
462 pulseaudio_tmpfsfile
465 usbfs_t
468 user_fonts_cache_t
471 /root/.fontconfig(/.*)?
473 /root/.fonts/auto(/.*)?
474 /root/.fonts.cache-.*
475 /home/[^/]+/.fontconfig(/.*)?
476 /home/[^/]+/.fonts/auto(/.*)?
477 /home/[^/]+/.fonts.cache-.*
478 user_home_type
480 all user home files
482 user_tmp_t
484 /dev/shm/mono.*
486 /var/run/user(/.*)?
487 /tmp/.X11-unix(/.*)?
488 /tmp/.ICE-unix(/.*)?
489 /dev/shm/pulse-shm.*
490 /tmp/.X0-lock
491 /tmp/hsperfdata_root
492 /var/tmp/hsperfdata_root
493 /home/[^/]+/tmp
494 /home/[^/]+/.tmp
495 /tmp/gconfd-[^/]+
496 user_tmp_type
498 all user tmp files
500 xserver_tmpfs_t
502
506 semanage fcontext can also be used to manipulate default file context
507 mappings.
508 semanage permissive can also be used to manipulate whether or not a
510 process type is permissive.
511 semanage module can also be used to enable/disable/install/remove pol‐
513 icy modules.
514 semanage boolean can also be used to manipulate the booleans
516 system-config-selinux is a GUI tool available to customize SELinux pol‐
519 icy settings.
520
523 This manual page was auto-generated using sepolicy manpage .
524
527 selinux(8), xguest(8), semanage(8), restorecon(8), chcon(1), sepol‐
528 icy(8) , setsebool(8), xguest_dbusd_selinux(8),
529 xguest_dbusd_selinux(8), xguest_gkeyringd_selinux(8),
530 xguest_gkeyringd_selinux(8)
531mgrepl@redhat.com xguest xguest_selinux(8)