User Statements =============== user ---- Declares an SELinux user identifier in the current namespace. **Statement definition:** ```secil (user user_id) ``` **Where:**

`user`	The `user` keyword.
`user_id`	The SELinux `user` identifier.

**Example:** This will declare an SELinux user as `unconfined.user`: ```secil (block unconfined (user user) ) ``` userrole -------- Associates a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared [`role`](cil_role_statements.md#role) identifier. **Statement definition:** ```secil (userrole user_id role_id) ``` **Where:**

`userrole`	The `userrole` keyword.
`user_id`	A previously declared SELinux `user` or `userattribute` identifier.
`role_id`	A previously declared `role` or `roleattribute` identifier.

**Example:** This example will associate `unconfined.user` to `unconfined.role`: ```secil (block unconfined (user user) (role role) (userrole user role) ) ``` userattribute ------------- Declares a user attribute identifier in the current namespace. The identifier may have zero or more [`user`](cil_user_statements.md#user) and [`userattribute`](cil_user_statements.md#userattribute) identifiers associated to it via the [`userattributeset`](cil_user_statements.md#userattributeset) statement. **Statement definition:** ```secil (userattribute userattribute_id) ``` **Where:**

`userattribute`	The `userattribute` keyword.
`userattribute_id`	The `userattribute` identifier.

**Example:** This example will declare a user attribute `users.user_holder` that will have an empty set: ```secil (block users (userattribute user_holder) ) ``` userattributeset ---------------- Allows the association of one or more previously declared [`user`](cil_user_statements.md#user) or [`userattribute`](cil_user_statements.md#userattribute) identifiers to a [`userattribute`](cil_user_statements.md#userattribute) identifier. Expressions may be used to refine the associations as shown in the examples. **Statement definition:** ```secil (userattributeset userattribute_id (user_id ... | expr ...)) ``` **Where:**

`userattributeset`	The `userattributeset` keyword.
`userattribute_id`	A single previously declared `userattribute` identifier.
`user_id`	Zero or more previously declared `user` or `userattribute` identifiers. Note that there must be at least one `user_id` or `expr` parameter declared.
`expr`	Zero or more `expr`'s, the valid operators and syntax are: `(and (user_id ...) (user_id ...))` `(or (user_id ...) (user_id ...))` `(xor (user_id ...) (user_id ...))` `(not (user_id ...))` `(all)`

**Example:** This example will declare three users and two user attributes, then associate all the users to them as shown: ```secil (block users (user user_1) (user user_2) (user user_3) (userattribute user_holder) (userattributeset user_holder (user_1 user_2 user_3)) (userattribute user_holder_all) (userattributeset user_holder_all (all)) ) ``` userlevel --------- Associates a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared [`level`](cil_mls_labeling_statements.md#level) identifier. The [`level`](cil_mls_labeling_statements.md#level) may be named or anonymous. **Statement definition:** ```secil (userlevel user_id level_id) ``` **Where:**

`userlevel`	The `userlevel` keyword.
`user_id`	A previously declared SELinux `user` identifier.
`level_id`	A previously declared `level` identifier. This may consist of a single `sensitivity` with zero or more mixed named and anonymous `category`'s as discussed in the `level` statement.

**Example:** This example will associate `unconfined.user` with a named [`level`](cil_mls_labeling_statements.md#level) of `systemlow`: ```secil (sensitivity s0) (level systemlow (s0)) (block unconfined (user user) (userlevel user systemlow) ; An anonymous example: ;(userlevel user (s0)) ) ``` userrange --------- Associates a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared [`levelrange`](cil_mls_labeling_statements.md#levelrange) identifier. The [`levelrange`](cil_mls_labeling_statements.md#levelrange) may be named or anonymous. **Statement definition:** ```secil (userrange user_id levelrange_id) ``` **Where:**

`userrange`	The `userrange` keyword.
`user_id`	A previously declared SELinux `user` identifier.
`levelrange_id`	A previously declared `levelrange` identifier. This may be formed by named or anonymous components as discussed in the `levelrange` statement and shown in the examples.

**Example:** This example will associate `unconfined.user` with a named [`levelrange`](cil_mls_labeling_statements.md#levelrange) of `low_high`, other anonymous examples are also shown: ```secil (category c0) (category c1) (categoryorder (c0 c1)) (sensitivity s0) (sensitivity s1) (sensitivityorder (s0 s1)) (sensitivitycategory s0 (c0 c1)) (level systemLow (s0)) (level systemHigh (s0 (c0 c1))) (levelrange low_high (systemLow systemHigh)) (block unconfined (user user) (role role) (userrole user role) ; Named example: (userrange user low_high) ; Anonymous examples: ;(userrange user (systemLow systemHigh)) ;(userrange user (systemLow (s0 (c0 c1)))) ;(userrange user ((s0) (s0 (c0 c1)))) ) ``` userbounds ---------- Defines a hierarchical relationship between users where the child user cannot have more privileges than the parent. Notes: - It is not possible to bind the parent to more than one child. - While this is added to the binary policy, it is not enforced by the SELinux kernel services. **Statement definition:** ```secil (userbounds parent_user_id child_user_id) ``` **Where:**

`userbounds`	The `userbounds` keyword.
`parent_user_id`	A previously declared SELinux `user` identifier.
`child_user_id`	A previously declared SELinux `user` identifier.

**Example:** The user `test` cannot have greater privileges than `unconfined.user`: ```secil (user test) (unconfined (user user) (userbounds user .test) ) ``` userprefix ---------- Declare a user prefix that will be replaced by the file labeling utilities described at [http://selinuxproject.org/page/PolicyStoreConfigurationFiles](http://selinuxproject.org/page/PolicyStoreConfigurationFiles#file_contexts.template_File) that details the `file_contexts` entries. **Statement definition:** ```secil (userprefix user_id prefix) ``` **Where:**

`userprefix`	The `userprefix` keyword.
`user_id`	A previously declared SELinux `user` identifier.
`prefix`	The string to be used by the file labeling utilities.

**Example:** This example will associate `unconfined.admin` user with a prefix of "[`user`](cil_user_statements.md#user)": ```secil (block unconfined (user admin) (userprefix admin user) ) ``` selinuxuser ----------- Associates a GNU/Linux user to a previously declared [`user`](cil_user_statements.md#user) identifier with a previously declared MLS [`userrange`](cil_user_statements.md#userrange). Note that the [`userrange`](cil_user_statements.md#userrange) is required even if the policy is non-MCS/MLS. **Statement definition:** ```secil (selinuxuser user_name user_id userrange_id) ``` **Where:**

`selinuxuser`	The `selinuxuser` keyword.
`user_name`	A string representing the GNU/Linux user name
`user_id`	A previously declared SELinux `user` identifier.
`userrange_id`	A previously declared `userrange` identifier that has been associated to the `user` identifier. This may be formed by named or anonymous components as discussed in the `userrange` statement and shown in the examples.

**Example:** This example will associate `unconfined.admin` user with a GNU / Linux user "`admin_1`": ```secil (block unconfined (user admin) (selinuxuser admin_1 admin low_low) ) ``` selinuxuserdefault ------------------ Declares the default SELinux user. Only one [`selinuxuserdefault`](cil_user_statements.md#selinuxuserdefault) statement is allowed in the policy. Note that the [`userrange`](cil_user_statements.md#userrange) identifier is required even if the policy is non-MCS/MLS. **Statement definition:** ```secil (selinuxuserdefault user_id userrange_id) ``` **Where:**

`selinuxuserdefault`	The `selinuxuserdefault` keyword.
`user_id`	A previously declared SELinux `user` identifier.
`userrange_id`	A previously declared `userrange` identifier that has been associated to the `user` identifier. This may be formed by named or anonymous components as discussed in the `userrange` statement and shown in the examples.

**Example:** This example will define the `unconfined.user` as the default SELinux user: ```secil (block unconfined (user user) (selinuxuserdefault user low_low) ) ```