I did it already with rbash (restricted bash) but now I want to use SELinux.

So I created new user and add him to guest_u:

semanage login -a -s guest_u restricteduser

also I forbid him to execute anything:

setsebool allow_guest_exec_content=0

And here I should allow him only ping to execute.

And also I need somehow allow him some network. How can I do this?

  • Does your user needs a shell too? And - just wondering - since ping is setuid root, does the guest user actually need any network access? – roaima Aug 30 '18 at 21:31
  • What do you mean by shell? sh scripts? And yes I want to add some more network utilities for him ex. ssh client, so I need to enable port 22 – GarfieldCat Aug 31 '18 at 5:21

allow_guest_exec_content boolean controls whether user in guest_t can execute files in home or temporary directories. User is otherwise still allowed to run other executables as policy permits.

SELinux reference policy provides interfaces to allow specific access. These interfaces are listed in SELinux policy documentation (your distribution likely provides them in selinux-policy-doc package).

To allow guest user to use ping, you could use netutils_exec_ping interface.

Then create a module for your custom policy, for example my_guest.te:

policy_module(my_guest, 1.0)

    type guest_t;
    role guest_r;

netutils_run_ping(guest_t, guest_r)

and compile it with:

make -f /usr/share/selinux/devel/Makefile my_guest.pp

Depending on what kind of network access you want to allow, you can look for suitable interface and use it in same way to extend my_guest module.

  • If I want to forbid execution any file I must write files_exec_usr_files (guest_t, guest_r) netutils_run_ping(guest_t, guest_r)? What about shell itself? – GarfieldCat Aug 31 '18 at 8:35
  • SELinux should already allow guest_t to execute a file with bin_t label (you can verify with sesearch -A -s guest_t -t bin_t), which is applied on many installed executables as default (see semanage fcontext -l|grep bin_t). SELinux confines all processes in guest_t domain. Other applications executed run in the same guest_t domain (unless the policy contains a rule allowing transition to another domain). – sebasth Aug 31 '18 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.