1User Statements
2===============
3
4user
5----
6
7Declares an SELinux user identifier in the current namespace.
8
9**Statement definition:**
10
11    (user user_id)
12
13**Where:**
14
15<table>
16<colgroup>
17<col width="25%" />
18<col width="75%" />
19</colgroup>
20<tbody>
21<tr class="odd">
22<td align="left"><p><code>user</code></p></td>
23<td align="left"><p>The <code>user</code> keyword.</p></td>
24</tr>
25<tr class="even">
26<td align="left"><p><code>user_id</code></p></td>
27<td align="left"><p>The SELinux <code>user</code> identifier.</p></td>
28</tr>
29</tbody>
30</table>
31
32**Example:**
33
34This will declare an SELinux user as `unconfined.user`:
35
36    (block unconfined
37        (user user)
38    )
39
40userrole
41--------
42
43Associates a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared [`role`](cil_role_statements.md#role) identifier.
44
45**Statement definition:**
46
47    (userrole user_id role_id)
48
49**Where:**
50
51<table>
52<colgroup>
53<col width="25%" />
54<col width="75%" />
55</colgroup>
56<tbody>
57<tr class="odd">
58<td align="left"><p><code>userrole</code></p></td>
59<td align="left"><p>The <code>userrole</code> keyword.</p></td>
60</tr>
61<tr class="even">
62<td align="left"><p><code>user_id</code></p></td>
63<td align="left"><p>A previously declared SELinux <code>user</code> or <code>userattribute</code> identifier.</p></td>
64</tr>
65<tr class="odd">
66<td align="left"><p><code>role_id</code></p></td>
67<td align="left"><p>A previously declared <code>role</code> or <code>roleattribute</code> identifier.</p></td>
68</tr>
69</tbody>
70</table>
71
72**Example:**
73
74This example will associate `unconfined.user` to `unconfined.role`:
75
76    (block unconfined
77        (user user)
78        (role role)
79        (userrole user role)
80    )
81
82userattribute
83-------------
84
85Declares a user attribute identifier in the current namespace. The identifier may have zero or more [`user`](cil_user_statements.md#user) and [`userattribute`](cil_user_statements.md#userattribute) identifiers associated to it via the [`userattributeset`](cil_user_statements.md#userattributeset) statement.
86
87**Statement definition:**
88
89    (userattribute userattribute_id)
90
91**Where:**
92
93<table>
94<colgroup>
95<col width="25%" />
96<col width="75%" />
97</colgroup>
98<tbody>
99<tr class="odd">
100<td align="left"><p><code>userattribute</code></p></td>
101<td align="left"><p>The <code>userattribute</code> keyword.</p></td>
102</tr>
103<tr class="even">
104<td align="left"><p><code>userattribute_id</code></p></td>
105<td align="left"><p>The <code>userattribute</code> identifier.</p></td>
106</tr>
107</tbody>
108</table>
109
110**Example:**
111
112This example will declare a user attribute `users.user_holder` that will have an empty set:
113
114    (block users
115        (userattribute user_holder)
116    )
117
118userattributeset
119----------------
120
121Allows the association of one or more previously declared [`user`](cil_user_statements.md#user) or [`userattribute`](cil_user_statements.md#userattribute) identifiers to a [`userattribute`](cil_user_statements.md#userattribute) identifier. Expressions may be used to refine the associations as shown in the examples.
122
123**Statement definition:**
124
125    (userattributeset userattribute_id (user_id ... | expr ...))
126
127**Where:**
128
129<table>
130<colgroup>
131<col width="25%" />
132<col width="75%" />
133</colgroup>
134<tbody>
135<tr class="odd">
136<td align="left"><p><code>userattributeset</code></p></td>
137<td align="left"><p>The <code>userattributeset</code> keyword.</p></td>
138</tr>
139<tr class="even">
140<td align="left"><p><code>userattribute_id</code></p></td>
141<td align="left"><p>A single previously declared <code>userattribute</code> identifier.</p></td>
142</tr>
143<tr class="odd">
144<td align="left"><p><code>user_id</code></p></td>
145<td align="left"><p>Zero or more previously declared <code>user</code> or <code>userattribute</code> identifiers.</p>
146<p>Note that there must be at least one <code>user_id</code> or <code>expr</code> parameter declared.</p></td>
147</tr>
148<tr class="even">
149<td align="left"><p><code>expr</code></p></td>
150<td align="left"><p>Zero or more <code>expr</code>'s, the valid operators and syntax are:</p>
151<p><code>    (and (user_id ...) (user_id ...))</code></p>
152<p><code>    (or  (user_id ...) (user_id ...))</code></p>
153<p><code>    (xor (user_id ...) (user_id ...))</code></p>
154<p><code>    (not (user_id ...))</code></p>
155<p><code>    (all)</code></p></td>
156</tr>
157</tbody>
158</table>
159
160**Example:**
161
162This example will declare three users and two user attributes, then associate all the users to them as shown:
163
164    (block users
165        (user user_1)
166        (user user_2)
167        (user user_3)
168
169        (userattribute user_holder)
170        (userattributeset user_holder (user_1 user_2 user_3))
171
172        (userattribute user_holder_all)
173        (userattributeset user_holder_all (all))
174    )
175
176userlevel
177---------
178
179Associates a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared [`level`](cil_mls_labeling_statements.md#level) identifier. The [`level`](cil_mls_labeling_statements.md#level) may be named or anonymous.
180
181**Statement definition:**
182
183    (userlevel user_id level_id)
184
185**Where:**
186
187<table>
188<colgroup>
189<col width="25%" />
190<col width="75%" />
191</colgroup>
192<tbody>
193<tr class="odd">
194<td align="left"><p><code>userlevel</code></p></td>
195<td align="left"><p>The <code>userlevel</code> keyword.</p></td>
196</tr>
197<tr class="even">
198<td align="left"><p><code>user_id</code></p></td>
199<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
200</tr>
201<tr class="odd">
202<td align="left"><p><code>level_id</code></p></td>
203<td align="left"><p>A previously declared <code>level</code> identifier. This may consist of a single <code>sensitivity</code> with zero or more mixed named and anonymous <code>category</code>'s as discussed in the <code>level</code> statement.</p></td>
204</tr>
205</tbody>
206</table>
207
208**Example:**
209
210This example will associate `unconfined.user` with a named [`level`](cil_mls_labeling_statements.md#level) of `systemlow`:
211
212    (sensitivity s0)
213    (level systemlow (s0))
214
215    (block unconfined
216        (user user)
217         (userlevel user systemlow)
218        ; An anonymous example:
219        ;(userlevel user (s0))
220    )
221
222userrange
223---------
224
225Associates a previously declared [`user`](cil_user_statements.md#user) identifer with a previously declared [`levelrange`](cil_mls_labeling_statements.md#levelrange) identifier. The [`levelrange`](cil_mls_labeling_statements.md#levelrange) may be named or anonymous.
226
227**Statement definition:**
228
229    (userrange user_id levelrange_id)
230
231**Where:**
232
233<table>
234<colgroup>
235<col width="25%" />
236<col width="75%" />
237</colgroup>
238<tbody>
239<tr class="odd">
240<td align="left"><p><code>userrange</code></p></td>
241<td align="left"><p>The <code>userrange</code> keyword.</p></td>
242</tr>
243<tr class="even">
244<td align="left"><p><code>user_id</code></p></td>
245<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
246</tr>
247<tr class="odd">
248<td align="left"><p><code>levelrange_id</code></p></td>
249<td align="left"><p>A previously declared <code>levelrange</code> identifier. This may be formed by named or anonymous components as discussed in the <code>levelrange</code> statement and shown in the examples.</p></td>
250</tr>
251</tbody>
252</table>
253
254**Example:**
255
256This example will associate `unconfined.user` with a named [`levelrange`](cil_mls_labeling_statements.md#levelrange) of `low_high`, other anonymous examples are also shown:
257
258    (category c0)
259    (category c1)
260    (categoryorder (c0 c1))
261    (sensitivity s0)
262    (sensitivity s1)
263    (dominance (s0 s1))
264    (sensitivitycategory s0 (c0 c1))
265    (level systemLow (s0))
266    (level systemHigh (s0 (c0 c1)))
267    (levelrange low_high (systemLow systemHigh))
268
269    (block unconfined
270        (user user)
271        (role role)
272        (userrole user role)
273        ; Named example:
274        (userrange user low_high)
275        ; Anonymous examples:
276        ;(userrange user (systemLow systemHigh))
277        ;(userrange user (systemLow (s0 (c0 c1))))
278        ;(userrange user ((s0) (s0 (c0 c1))))
279    )
280
281userbounds
282----------
283
284Defines a hierarchical relationship between users where the child user cannot have more priviledges than the parent.
285
286Notes:
287
288-   It is not possible to bind the parent to more than one child.
289
290-   While this is added to the binary policy, it is not enforced by the SELinux kernel services.
291
292**Statement definition:**
293
294    (userbounds parent_user_id child_user_id)
295
296**Where:**
297
298<table>
299<colgroup>
300<col width="25%" />
301<col width="75%" />
302</colgroup>
303<tbody>
304<tr class="odd">
305<td align="left"><p><code>userbounds</code></p></td>
306<td align="left"><p>The <code>userbounds</code> keyword.</p></td>
307</tr>
308<tr class="even">
309<td align="left"><p><code>parent_user_id</code></p></td>
310<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
311</tr>
312<tr class="odd">
313<td align="left"><p><code>child_user_id</code></p></td>
314<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
315</tr>
316</tbody>
317</table>
318
319**Example:**
320
321The user `test` cannot have greater priviledges than `unconfined.user`:
322
323    (user test)
324
325    (unconfined
326        (user user)
327        (userbounds user .test)
328    )
329
330userprefix
331----------
332
333Declare a user prefix that will be replaced by the file labeling utilities described at [http://selinuxproject.org/page/PolicyStoreConfigurationFiles](http://selinuxproject.org/page/PolicyStoreConfigurationFiles#file_contexts.template_File) that details the `file_contexts` entries.
334
335**Statement definition:**
336
337    (userprefix user_id prefix)
338
339**Where:**
340
341<table>
342<colgroup>
343<col width="25%" />
344<col width="75%" />
345</colgroup>
346<tbody>
347<tr class="odd">
348<td align="left"><p><code>userprefix</code></p></td>
349<td align="left"><p>The <code>userprefix</code> keyword.</p></td>
350</tr>
351<tr class="even">
352<td align="left"><p><code>user_id</code></p></td>
353<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
354</tr>
355<tr class="odd">
356<td align="left"><p><code>prefix</code></p></td>
357<td align="left"><p>The string to be used by the file labeling utilities.</p></td>
358</tr>
359</tbody>
360</table>
361
362**Example:**
363
364This example will associate `unconfined.admin` user with a prefix of "[`user`](cil_user_statements.md#user)":
365
366    (block unconfined
367        (user admin
368        (userprefix admin user)
369    )
370
371selinuxuser
372-----------
373
374Associates a GNU/Linux user to a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared MLS [`userrange`](cil_user_statements.md#userrange). Note that the [`userrange`](cil_user_statements.md#userrange) is required even if the policy is non-MCS/MLS.
375
376**Statement definition:**
377
378    (selinuxuser user_name user_id userrange_id)
379
380**Where:**
381
382<table>
383<colgroup>
384<col width="25%" />
385<col width="75%" />
386</colgroup>
387<tbody>
388<tr class="odd">
389<td align="left"><p><code>selinuxuser</code></p></td>
390<td align="left"><p>The <code>selinuxuser</code> keyword.</p></td>
391</tr>
392<tr class="even">
393<td align="left"><p><code>user_name</code></p></td>
394<td align="left"><p>A string representing the GNU/Linux user name</p></td>
395</tr>
396<tr class="odd">
397<td align="left"><p><code>user_id</code></p></td>
398<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
399</tr>
400<tr class="even">
401<td align="left"><p><code>userrange_id</code></p></td>
402<td align="left"><p>A previously declared <code>userrange</code> identifier that has been associated to the <code>user</code> identifier. This may be formed by named or anonymous components as discussed in the <code>userrange</code> statement and shown in the examples.</p></td>
403</tr>
404</tbody>
405</table>
406
407**Example:**
408
409This example will associate `unconfined.admin` user with a GNU / Linux user "`admin_1`":
410
411    (block unconfined
412        (user admin)
413        (selinuxuser admin_1 admin low_low)
414    )
415
416selinuxuserdefault
417------------------
418
419Declares the default SELinux user. Only one [`selinuxuserdefault`](cil_user_statements.md#selinuxuserdefault) statement is allowed in the policy. Note that the [`userrange`](cil_user_statements.md#userrange) identifier is required even if the policy is non-MCS/MLS.
420
421**Statement definition:**
422
423    (selinuxuserdefault user_id userrange_id)
424
425**Where:**
426
427<table>
428<colgroup>
429<col width="25%" />
430<col width="75%" />
431</colgroup>
432<tbody>
433<tr class="odd">
434<td align="left"><p><code>selinuxuserdefault</code></p></td>
435<td align="left"><p>The <code>selinuxuserdefault</code> keyword.</p></td>
436</tr>
437<tr class="even">
438<td align="left"><p><code>user_id</code></p></td>
439<td align="left"><p>A previously declared SELinux <code>user</code> identifier.</p></td>
440</tr>
441<tr class="odd">
442<td align="left"><p><code>userrange_id</code></p></td>
443<td align="left"><p>A previously declared <code>userrange</code> identifier that has been associated to the <code>user</code> identifier. This may be formed by named or anonymous components as discussed in the <code>userrange</code> statement and shown in the examples.</p></td>
444</tr>
445</tbody>
446</table>
447
448**Example:**
449
450This example will define the `unconfined.user` as the default SELinux user:
451
452    (block unconfined
453        (user user)
454        (selinuxuserdefault user low_low)
455    )
456