Declares an SELinux user identifier in the current namespace.
Statement definition:
(user user_id)
Where:
Example:
This will declare an SELinux user as unconfined.user:
(block unconfined
(user user)
)
Associates a previously declared user identifier with a previously declared role identifier.
Statement definition:
(userrole user_id role_id)
Where:
Example:
This example will associate unconfined.user to unconfined.role:
(block unconfined
(user user)
(role role)
(userrole user role)
)
Declares a user attribute identifier in the current namespace. The identifier may have zero or more user and userattribute identifiers associated to it via the userattributeset statement.
Statement definition:
(userattribute userattribute_id)
Where:
Example:
This example will declare a user attribute users.user_holder that will have an empty set:
(block users
(userattribute user_holder)
)
Allows the association of one or more previously declared user or userattribute identifiers to a userattribute identifier. Expressions may be used to refine the associations as shown in the examples.
Statement definition:
(userattributeset userattribute_id (user_id ... | expr ...))
Where:
Example:
This example will declare three users and two user attributes, then associate all the users to them as shown:
(block users
(user user_1)
(user user_2)
(user user_3)
(userattribute user_holder)
(userattributeset user_holder (user_1 user_2 user_3))
(userattribute user_holder_all)
(userattributeset user_holder_all (all))
)
Associates a previously declared user identifier with a previously declared level identifier. The level may be named or anonymous.
Statement definition:
(userlevel user_id level_id)
Where:
Example:
This example will associate unconfined.user with a named level of systemlow:
(sensitivity s0)
(level systemlow (s0))
(block unconfined
(user user)
(userlevel user systemlow)
; An anonymous example:
;(userlevel user (s0))
)
Associates a previously declared user identifer with a previously declared levelrange identifier. The levelrange may be named or anonymous.
Statement definition:
(userrange user_id levelrange_id)
Where:
Example:
This example will associate unconfined.user with a named levelrange of low_high, other anonymous examples are also shown:
(category c0)
(category c1)
(categoryorder (c0 c1))
(sensitivity s0)
(sensitivity s1)
(dominance (s0 s1))
(sensitivitycategory s0 (c0 c1))
(level systemLow (s0))
(level systemHigh (s0 (c0 c1)))
(levelrange low_high (systemLow systemHigh))
(block unconfined
(user user)
(role role)
(userrole user role)
; Named example:
(userrange user low_high)
; Anonymous examples:
;(userrange user (systemLow systemHigh))
;(userrange user (systemLow (s0 (c0 c1))))
;(userrange user ((s0) (s0 (c0 c1))))
)
Defines a hierarchical relationship between users where the child user cannot have more priviledges than the parent.
Notes:
It is not possible to bind the parent to more than one child.
While this is added to the binary policy, it is not enforced by the SELinux kernel services.
Statement definition:
(userbounds parent_user_id child_user_id)
Where:
Example:
The user test cannot have greater priviledges than unconfined.user:
(user test)
(unconfined
(user user)
(userbounds user .test)
)
Declare a user prefix that will be replaced by the file labeling utilities described at http://selinuxproject.org/page/PolicyStoreConfigurationFiles that details the file_contexts entries.
Statement definition:
(userprefix user_id prefix)
Where:
Example:
This example will associate unconfined.admin user with a prefix of “user”:
(block unconfined
(user admin
(userprefix admin user)
)
Associates a GNU/Linux user to a previously declared user identifier with a previously declared MLS userrange. Note that the userrange is required even if the policy is non-MCS/MLS.
Statement definition:
(selinuxuser user_name user_id userrange_id)
Where:
Example:
This example will associate unconfined.admin user with a GNU / Linux user “admin_1”:
(block unconfined
(user admin)
(selinuxuser admin_1 admin low_low)
)
Declares the default SELinux user. Only one selinuxuserdefault statement is allowed in the policy. Note that the userrange identifier is required even if the policy is non-MCS/MLS.
Statement definition:
(selinuxuserdefault user_id userrange_id)
Where:
Example:
This example will define the unconfined.user as the default SELinux user:
(block unconfined
(user user)
(selinuxuserdefault user low_low)
)