Red Hat Training

A Red Hat training course is available for RHEL 8

3.4. Adding a new user as an SELinux-confined user

Use the following steps to add a new SELinux-confined user to the system. This example procedure maps the user to the SELinux staff_u user right with the command for creating the user account.

Prerequisites

  • The root user is running unconfined, as it does by default in Red Hat Enterprise Linux.

Procedure

  1. Enter the following command to create a new Linux user named example.user and map it to the SELinux staff_u user:

    useradd -Z staff_u example.user
  2. To assign a password to the Linux example.user user:

    passwd example.user
    Changing password for user example.user.
    New password:
    Retype new password:
    passwd: all authentication tokens updated successfully.
  3. Log out of your current session.
  4. Log in as the Linux example.user user. The user’s shell launches with the staff_u context.

Verification

  1. When logged in as the example.user user, check the context of a Linux user:

    $ id -Z
    uid=1000(example.user) gid=1000(example.user) groups=1000(example.user) context=staff_u:staff_r:staff_t:s0-s0:c0.c1023

Additional resources

  • pam_selinux(8) man page.