CME-302

SELinux Confined User Mapping

Harden OS/Kernel Unquantified evidence Preventive

Description

Maps Linux login users to SELinux confined user types instead of unconfined_u. Restricts user-level capabilities like running unconfined applications, accessing network, or executing in /tmp.

CVSS Vector Impacts

Metric	Transition	Rationale
Privileges Required (PR)	L → H	Compromised user account has significantly restricted capabilities

CWE Relationships

CWE-269 CWE-284

Verification

Verify no regular users mapped to unconfined_u

$ semanage login -l | grep -v 'unconfined_u\|Login Name'
# Expected: staff_u|user_u|guest_u

Platform: rhel

Remediation

rhel Map login users to SELinux confined types via semanage


semanage login -m -s user_u -r s0 __default__
semanage login -a -s staff_u <admin_user>
restorecon -RvF /home