SELinux user maps
Change the SELinux user an IPA login runs as from the default unconfined_u to a confined one; how maps match, the list of available SELinux users and its order.
This page covers the SELinux user maps page under Policy. A SELinux user map decides which SELinux user identity a login's processes run under. By default everyone is unconfined_u, that is unrestricted. A map makes selected users on selected hosts log in as a confined identity such as staff_u, user_u or guest_u; sssd writes it to /etc/selinux/targeted/logins/ when the PAM session opens. Not gated by a licence module.
Rule
| Field | Meaning |
|---|---|
| SELinux user | user:MLS:MCS, such as staff_u:s0-s0:c0.c1023. Must be in the SELinux user list on the Configuration page |
| Users, User groups | Who. Any user means everyone |
| Hosts, Host groups | Where. Any host means every host |
| HBAC rule | Alternative form: reference an HBAC rule and its user and host sets become the scope. With an HBAC rule set, users and hosts cannot be given separately |
When several maps match, the one whose SELinux user comes first in the Configuration page's list wins. The default list:
guest_u:s0 $ xguest_u:s0 $ user_u:s0 $ staff_u:s0-s0:c0.c1023 $ sysadm_u:s0-s0:c0.c1023 $ unconfined_u:s0-s0:c0.c1023The default SELinux user (no map matched) is also set on the Configuration page; the factory value is unconfined_u:s0-s0:c0.c1023.
Common choices
| Goal | SELinux user |
|---|---|
| Developers and operators who may sudo | staff_u, switching to sysadm_r through sudo |
| Runs applications, no administration | user_u, no su or sudo |
| Temporary accounts | guest_u, no network, no X |
Boundaries
| Topic | Notes |
|---|---|
| Client SELinux state | Must be enforcing or permissive. With disabled the map has no effect |
| Timing | A changed map applies at the next login; open sessions keep their identity |
| Scope | Maps change the process identity, not file labels. Paths staff_u cannot reach need policy work of their own |
Sudo
Central sudo rules covering who, on which host, as whom and which commands; commands and command groups, deny lists, options, and what sudo order does.
Password policies
Requires the pwpolicy module. Global versus per-group policies, how priority picks the one a user gets, field defaults and meanings, lockout and unlock.