user\_contexts(5) SELinux configuration user\_contexts(5)

# [NAME](#NAME)

user\_contexts - The SELinux user contexts configuration files

# [DESCRIPTION](#DESCRIPTION)

These optional user context configuration files contain entries that allow SELinux-aware login applications such as [**PAM**(8)](/man/os/libselinux/PAM.8) (running in their own process context), to determine the context that a users login session should run under.

SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active policy path:

[**get\_default\_context**(3)](/man/os/libselinux/get_default_context.3)  
[**get\_ordered\_context\_list**(3)](/man/os/libselinux/get_ordered_context_list.3)  
[**get\_ordered\_context\_list\_with\_level**(3)](/man/os/libselinux/get_ordered_context_list_with_level.3)  
[**get\_default\_context\_with\_level**(3)](/man/os/libselinux/get_default_context_with_level.3)  
[**get\_default\_context\_with\_role**(3)](/man/os/libselinux/get_default_context_with_role.3)  
[**get\_default\_context\_with\_rolelevel**(3)](/man/os/libselinux/get_default_context_with_rolelevel.3)  
[**query\_user\_context**(3)](/man/os/libselinux/query_user_context.3)  
[**manual\_user\_enter\_context**(3)](/man/os/libselinux/manual_user_enter_context.3)

There can be one file for each SELinux user configured on the system. The file path is formed using the path returned by [**selinux\_user\_contexts\_path**(3)](/man/os/libselinux/selinux_user_contexts_path.3) for the active policy, with the SELinux user name appended, for example:

*/etc/selinux/{SELINUXTYPE}/contexts/users/unconfined\_u*  
*/etc/selinux/{SELINUXTYPE}/contexts/users/xguest\_u*

Where *{SELINUXTYPE}* is the entry from the selinux configuration file *config* (see [**selinux\_config**(5)](/man/os/libselinux/selinux_config.5)).

These files contain context information as described in the **FILE FORMAT** section.

# [FILE FORMAT](#FILE_FORMAT)

Each line in the user context configuration file consists of the following:

*login\_process user\_login\_process*

Where:

*login\_process*

This consists of a *role:type*\[**:range**] entry that represents the login process context.

*user\_login\_process*

This consists of a *role:type*\[**:range**] entry that represents the user login process context.

# [EXAMPLE](#EXAMPLE)

\# Example for xguest\_u at /etc/selinux/targeted/contexts/users/xguest\_u  
system\_r:crond\_t:s0 xguest\_r:xguest\_t:s0  
system\_r:initrc\_t:s0 xguest\_r:xguest\_t:s0  
system\_r:local\_login\_t:s0 xguest\_r:xguest\_t:s0  
system\_r:remote\_login\_t:s0 xguest\_r:xguest\_t:s0  
system\_r:sshd\_t:s0 xguest\_r:xguest\_t:s0  
system\_r:xdm\_t:s0 xguest\_r:xguest\_t:s0  
xguest\_r:xguest\_t:s0 xguest\_r:xguest\_t:s0

# [SEE ALSO](#SEE_ALSO)

[**selinux**(8)](/man/os/libselinux/selinux.8), [**selinux\_user\_contexts\_path**(3)](/man/os/libselinux/selinux_user_contexts_path.3), [**PAM**(8)](/man/os/libselinux/PAM.8), [**get\_ordered\_context\_list**(3)](/man/os/libselinux/get_ordered_context_list.3), [**get\_ordered\_context\_list\_with\_level**(3)](/man/os/libselinux/get_ordered_context_list_with_level.3), [**get\_default\_context\_with\_level**(3)](/man/os/libselinux/get_default_context_with_level.3), [**get\_default\_context\_with\_role**(3)](/man/os/libselinux/get_default_context_with_role.3), [**get\_default\_context\_with\_rolelevel**(3)](/man/os/libselinux/get_default_context_with_rolelevel.3), [**query\_user\_context**(3)](/man/os/libselinux/query_user_context.3), [**manual\_user\_enter\_context**(3)](/man/os/libselinux/manual_user_enter_context.3), [**selinux\_config**(5)](/man/os/libselinux/selinux_config.5)

28-Nov-2011 Security Enhanced Linux

---

Document: user_contexts(5) from libselinux 3.11-r2 (Chainguard OS)
Source: https://github.com/SELinuxProject/selinux.git