2 - Raspberry PI Community Projects

# semanage login -a -s user_u rhertzog
# semanage login -l
Login Name SELinux User MLS/MCS Range
__default__ unconfined_u s0-s0:c0.c1023
rhertzog user_u None
root unconfined_u s0-s0:c0.c1023
system_u system_u s0-s0:c0.c1023
# semanage login -d rhertzog
semanage user -l lists the mapping between SELinux user identities and allowed roles. Adding
a new identity requires to define both the corresponding roles and a labeling prefix which is
used to assign a type to personal files (/home/user/*). The prefix must be picked among user,
staff, and sysadm. The “staff” prefix results in files of type “staff_home_dir_t”. Creating a
new SELinux user identity is done with semanage user -a -R roles -P prefix identity.
Finally, you can remove an SELinux user identity with semanage user -d identity.
# semanage user -a -R 'staff_r user_r' -P staff test_u
# semanage user -l
Labeling MLS/ MLS/
SELinux User Prefix MCS Level MCS Range SELinux Roles
root sysadm s0 s0-s0:c0.c1023 staff_r sysadm_r
➥ system_r
staff_u staff s0 s0-s0:c0.c1023 staff_r sysadm_r
sysadm_u sysadm s0 s0-s0:c0.c1023 sysadm_r
system_u user s0 s0-s0:c0.c1023 system_r
test_u staff s0 s0 staff_r user_r
unconfined_u unconfined s0 s0-s0:c0.c1023 system_r unconfined_r
user_u user s0 s0 user_r
# semanage user -d test_u
14.4.3.3. Managing File Contexts, Ports and Booleans
Each SELinux module provides a set of file labeling rules, but it is also possible to add custom
labeling rules to cater to a specific case. For example, if you want the web server to be able to
read files within the /srv/www/ file hierarchy, you could execute semanage fcontext -a -
t httpd_sys_content_t "/srv/www(/.*)?" followed by restorecon -R /srv/www/. The
former command registers the new labeling rules and the latter resets the file types according
to the current labeling rules.
Chapter 14 — Security
393