1xguest_selinux(8) xguest SELinux Policy documentation xguest_selinux(8)
2
6 xguest_u - Least privileged xwindows user role. - Security Enhanced
7 Linux Policy
8
11 xguest_u is an SELinux User defined in the SELinux policy. SELinux
12 users have default roles, xguest_r. The default role has a default
13 type, xguest_t, associated with it.
14 The SELinux user will usually login to a system with a context that
16 looks like:
17 xguest_u:xguest_r:xguest_t:s0
19 Linux users are automatically assigned an SELinux users at login.
21 Login programs use the SELinux User to assign initial context to the
22 user's shell.
23 SELinux policy uses the context to control the user's access.
25 By default all users are assigned to the SELinux user via the
27 __default__ flag
28 On Targeted policy systems the __default__ user is assigned to the
30 unconfined_u SELinux user.
31 You can list all Linux User to SELinux user mapping using:
33 semanage login -l
35 If you wanted to change the default user mapping to use the xguest_u
37 user, you would execute:
38 semanage login -m -s xguest_u __default__
40 If you want to map the one Linux user (joe) to the SELinux user xguest,
43 you would execute:
44 $ semanage login -a -s xguest_u joe
46
50 The SELinux user xguest_u is defined in policy as a unprivileged user.
51 SELinux prevents unprivileged users from doing administration tasks
52 without transitioning to a different role.
53
57 The SELinux user xguest_u is able to X Windows login.
58
61 The SELinux user xguest_u is able to connect to the following tcp
62 ports.
63 53,853
65 8955
67 4713
69 4331,5001
71 80,81,443,488,8008,8009,8443,9000
73 8080,8118,8123,10001-10010
75 3128,3401,4827
77 843,1935
79 21,989,990
81 631,8610-8614
83 32768-60999
85 all ports with out defined types
87 8000,9433,16001
89 8036
91 8081
93 88,750,4444
95 9080
97 The SELinux user xguest_u is able to connect to the following tcp
100 ports.
101 53,853
103 8955
105 4713
107 4331,5001
109 80,81,443,488,8008,8009,8443,9000
111 8080,8118,8123,10001-10010
113 3128,3401,4827
115 843,1935
117 21,989,990
119 631,8610-8614
121 32768-60999
123 all ports with out defined types
125 8000,9433,16001
127 8036
129 8081
131 88,750,4444
133 9080
135
138 SELinux policy is customizable based on least access required. xguest
139 policy is extremely flexible and has several booleans that allow you to
140 manipulate the policy and run xguest with the tightest access possible.
141 If you want to allow xguest users to configure Network Manager and con‐
145 nect to apache ports, you must turn on the xguest_connect_network bool‐
146 ean. Enabled by default.
147 setsebool -P xguest_connect_network 1
149 If you want to allow xguest users to mount removable media, you must
153 turn on the xguest_mount_media boolean. Enabled by default.
154 setsebool -P xguest_mount_media 1
156 If you want to allow xguest to use blue tooth devices, you must turn on
160 the xguest_use_bluetooth boolean. Enabled by default.
161 setsebool -P xguest_use_bluetooth 1
163 If you want to deny user domains applications to map a memory region as
167 both executable and writable, this is dangerous and the executable
168 should be reported in bugzilla, you must turn on the deny_execmem bool‐
169 ean. Enabled by default.
170 setsebool -P deny_execmem 1
172 If you want to deny any process from ptracing or debugging any other
176 processes, you must turn on the deny_ptrace boolean. Enabled by
177 default.
178 setsebool -P deny_ptrace 1
180 If you want to allow all domains to execute in fips_mode, you must turn
184 on the fips_mode boolean. Enabled by default.
185 setsebool -P fips_mode 1
187 If you want to allow httpd cgi support, you must turn on the
191 httpd_enable_cgi boolean. Enabled by default.
192 setsebool -P httpd_enable_cgi 1
194 If you want to allow confined applications to run with kerberos, you
198 must turn on the kerberos_enabled boolean. Disabled by default.
199 setsebool -P kerberos_enabled 1
201 If you want to allow confined applications to use nscd shared memory,
205 you must turn on the nscd_use_shm boolean. Disabled by default.
206 setsebool -P nscd_use_shm 1
208 If you want to allow unconfined executables to make their stack exe‐
212 cutable. This should never, ever be necessary. Probably indicates a
213 badly coded executable, but could indicate an attack. This executable
214 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
215 stack boolean. Disabled by default.
216 setsebool -P selinuxuser_execstack 1
218 If you want to allow user to r/w files on filesystems that do not have
222 extended attributes (FAT, CDROM, FLOPPY), you must turn on the selin‐
223 uxuser_rw_noexattrfile boolean. Disabled by default.
224 setsebool -P selinuxuser_rw_noexattrfile 1
226 If you want to allow user to use ssh chroot environment, you must turn
230 on the selinuxuser_use_ssh_chroot boolean. Disabled by default.
231 setsebool -P selinuxuser_use_ssh_chroot 1
233 If you want to support NFS home directories, you must turn on the
237 use_nfs_home_dirs boolean. Enabled by default.
238 setsebool -P use_nfs_home_dirs 1
240 If you want to support SAMBA home directories, you must turn on the
244 use_samba_home_dirs boolean. Disabled by default.
245 setsebool -P use_samba_home_dirs 1
247
251 The SELinux user xguest_u is able execute home content files.
252
255 Three things can happen when xguest_t attempts to execute a program.
256 1. SELinux Policy can deny xguest_t from executing the program.
258 2. SELinux Policy can allow xguest_t to execute the program in the cur‐
262 rent user type.
263 Execute the following to see the types that the SELinux user
265 xguest_t can execute without transitioning:
266 sesearch -A -s xguest_t -c file -p execute_no_trans
268 3. SELinux can allow xguest_t to execute the program and transition to
272 a new type.
273 Execute the following to see the types that the SELinux user
275 xguest_t can execute and transition:
276 $ sesearch -A -s xguest_t -c process -p transition
278
282 The SELinux process type xguest_t can manage files labeled with the
283 following file types. The paths listed are the default paths for these
284 file types. Note the processes UID still need to have DAC permissions.
285 alsa_home_t
287 /home/[^/]+/.asoundrc
289 anon_inodefs_t
291 auth_cache_t
294 /var/cache/coolkey(/.*)?
296 chrome_sandbox_tmpfs_t
298 cifs_t
301 dosfs_t
304 gconf_tmp_t
307 /tmp/gconfd-[^/]+/.*
309 gkeyringd_tmp_t
311 /var/run/user/[^/]*/keyring.*
313 gnome_home_type
315 httpd_user_content_t
318 /home/[^/]+/((www)|(web)|(public_html))(/.+)?
320 httpd_user_htaccess_t
322 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
324 httpd_user_ra_content_t
326 /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
328 httpd_user_rw_content_t
330 httpd_user_script_exec_t
333 /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
335 nfs_t
337 noxattrfs
340 all files on file systems which do not support extended attributes
342 pulseaudio_tmpfs_t
344 pulseaudio_tmpfsfile
347 session_dbusd_tmp_t
350 /var/run/user(/.*)?/dbus-[0-9]*(/.*)?
352 /var/run/user/[^/]*/systemd(/.*)?
353 usbfs_t
355 user_fonts_cache_t
358 /root/.fontconfig(/.*)?
360 /root/.fonts/auto(/.*)?
361 /root/.fonts.cache-.*
362 /root/.cache/fontconfig(/.*)?
363 /home/[^/]+/.fontconfig(/.*)?
364 /home/[^/]+/.fonts/auto(/.*)?
365 /home/[^/]+/.fonts.cache-.*
366 /home/[^/]+/.cache/fontconfig(/.*)?
367 user_home_type
369 all user home files
371 user_tmp_t
373 /dev/shm/mono.*
375 /var/run/user(/.*)?
376 /tmp/.ICE-unix(/.*)?
377 /tmp/.X11-unix(/.*)?
378 /dev/shm/pulse-shm.*
379 /tmp/.X0-lock
380 /tmp/hsperfdata_root
381 /var/tmp/hsperfdata_root
382 /home/[^/]+/tmp
383 /home/[^/]+/.tmp
384 /tmp/gconfd-[^/]+
385 user_tmp_type
387 all user tmp files
389 xserver_tmpfs_t
391
395 semanage fcontext can also be used to manipulate default file context
396 mappings.
397 semanage permissive can also be used to manipulate whether or not a
399 process type is permissive.
400 semanage module can also be used to enable/disable/install/remove pol‐
402 icy modules.
403 semanage boolean can also be used to manipulate the booleans
405 system-config-selinux is a GUI tool available to customize SELinux pol‐
408 icy settings.
409
412 This manual page was auto-generated using sepolicy manpage .
413
416 selinux(8), xguest(8), semanage(8), restorecon(8), chcon(1), sepol‐
417 icy(8), setsebool(8), xguest_dbusd_selinux(8), xguest_dbusd_selinux(8),
418 xguest_gkeyringd_selinux(8), xguest_gkeyringd_selinux(8)
419mgrepl@redhat.com xguest xguest_selinux(8)