SELinux user maps
Change the SELinux user an IPA login runs as from the default unconfined_u to a confined one; how maps match, the list of available SELinux users and its order.
A SELinux user map decides which SELinux user identity a login's processes run under. By default everyone is unconfined_u, i.e. unrestricted. A map makes selected users on selected hosts log in as a confined identity such as staff_u, user_u or guest_u; sssd writes it to /etc/selinux/targeted/logins/ when the PAM session opens. Not gated by a licence module.
Rule
| Field | Meaning |
|---|---|
| SELinux user | user:MLS:MCS, e.g. staff_u:s0-s0:c0.c1023. Must be in the SELinux user list on the Configuration page |
| Users / user groups | who; "any user" = everyone |
| Hosts / host groups | where; "any host" = every host |
| HBAC rule | alternative form: reference an HBAC rule and its user + host sets become the scope. With an HBAC rule set, users / hosts cannot be given separately |
When several maps match, the one whose SELinux user comes first in the Configuration page's list wins. The default list:
guest_u:s0 $ xguest_u:s0 $ user_u:s0 $ staff_u:s0-s0:c0.c1023 $ sysadm_u:s0-s0:c0.c1023 $ unconfined_u:s0-s0:c0.c1023The default SELinux user (no map matched) is also set on the Configuration page; factory value unconfined_u:s0-s0:c0.c1023.
Common choices
| Goal | SELinux user |
|---|---|
| developers / ops who may sudo | staff_u, switching to sysadm_r through sudo |
| runs applications, no administration | user_u, no su / sudo |
| temporary accounts | guest_u, no network, no X |
Boundaries
- The client must run SELinux enforcing or permissive; with
disabledthe map has no effect. - A changed map applies at the next login; open sessions keep their identity.
- Maps change the process identity, not file labels; paths
staff_ucannot reach need policy work of their own.
Sudo
Central sudo rules: who, on which host, as whom, which commands; commands and command groups, deny lists, options, and what sudo order does.
Password policies
Requires the pwpolicy module. Global versus per-group policies, how priority picks the one a user gets, field defaults and meanings, lockout and unlock.