CME-302
SELinux Confined User Mapping
Description
Maps Linux login users to SELinux confined user types instead of unconfined_u. Restricts user-level capabilities like running unconfined applications, accessing network, or executing in /tmp.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | L → H | Compromised user account has significantly restricted capabilities |
CWE Relationships
Verification
Verify no regular users mapped to unconfined_u
$ semanage login -l | grep -v 'unconfined_u\|Login Name'
# Expected: staff_u|user_u|guest_u
# Expected: staff_u|user_u|guest_u
Platform: rhel