Procedure 10.25. Creating a User With a Specific MLS Range
useradd
command and map the new Linux user to an existing SELinux user (in this case, user_u
):
~]#
useradd -Z user_u john
prompt~]# passwd john
~]#
semanage login -l
Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * john user_u s0 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *
john
:
~]#
semanage login --modify --seuser user_u --range s2:c100 john
john
now has a specific MLS range defined:
~]#
semanage login -l
Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * john user_u s2:c100 * root unconfined_u s0-s0:c0.c1023 * system_u system_u s0-s0:c0.c1023 *
~]#
chcon -R -l s2:c100 /home/john