# User Statements

## user

Declares an SELinux user identifier in the current namespace.

Statement definition:

    (user user_id)

Where:

`user` | The `user` keyword.
`user_id` | The SELinux `user` identifier.

Example:

This will declare an SELinux user as `unconfined.user`:

    (block unconfined
        (user user)
    )

## userrole

Associates a previously declared `user` identifier with a previously declared `role` identifier.

Statement definition:

    (userrole user_id role_id)

Where:

`userrole` | The `userrole` keyword.
`user_id` | A previously declared SELinux `user` identifier.
`role_id` | A previously declared `role` or `roleattribute` identifier.

Example:

This example will associate `unconfined.user` to `unconfined.role`:

    (block unconfined
        (user user)
        (role role)
        (userrole user role)
    )

## userlevel

Associates a previously declared `user` identifier with a previously declared `level` identifier. The `level` may be named or anonymous.

Statement definition:

    (userlevel user_id level_id)

Where:

`userlevel` | The `userlevel` keyword.
`user_id` | A previously declared SELinux `user` identifier.
`level_id` | A previously declared `level` identifier. This may consist of a single `sensitivity` with zero or more mixed named and anonymous `category`'s as discussed in the `level` statement.

Example:

This example will associate `unconfined.user` with a named `level` of `systemlow`:

    (sensitivity s0)
    (level systemlow (s0))

    (block unconfined
        (user user)
         (userlevel user systemlow)
        ; An anonymous example:
        ;(userlevel user (s0))
    )

## userrange

Associates a previously declared `user` identifer with a previously declared `levelrange` identifier. The `levelrange` may be named or anonymous.

Statement definition:

    (userrange user_id levelrange_id)

Where:

`userrange` | The `userrange` keyword.
`user_id` | A previously declared SELinux `user` identifier.
`levelrange_id` | A previously declared `levelrange` identifier. This may be formed by named or anonymous components as discussed in the `levelrange` statement and shown in the examples.

Example:

This example will associate `unconfined.user` with a named `levelrange` of `low_high`, other anonymous examples are also shown:

    (category c0)
    (category c1)
    (categoryorder (c0 c1))
    (sensitivity s0)
    (sensitivity s1)
    (dominance (s0 s1))
    (sensitivitycategory s0 (c0 c1))
    (level systemLow (s0))
    (level systemHigh (s0 (c0 c1)))
    (levelrange low_high (systemLow systemHigh))

    (block unconfined
        (user user)
        (role role)
        (userrole user role)
        ; Named example:
        (userrange user low_high)
        ; Anonymous examples:
        ;(userrange user (systemLow systemHigh))
        ;(userrange user (systemLow (s0 (c0 c1))))
        ;(userrange user ((s0) (s0 (c0 c1))))
    )

## userbounds

Defines a hierarchical relationship between users where the child user cannot have more priviledges than the parent.

Notes:

- It is not possible to bind the parent to more than one child.

- While this is added to the binary policy, it is not enforced by the SELinux kernel services.

Statement definition:

    (userbounds parent_user_id child_user_id)

Where:

`userbounds` | The `userbounds` keyword.
`parent_user_id` | A previously declared SELinux `user` identifier.
`child_user_id` | A previously declared SELinux `user` identifier.

Example:

The user `test` cannot have greater priviledges than `unconfined.user`:

    (user test)

    (unconfined
        (user user)
        (userbounds user .test)
    )

## userprefix

Declare a user prefix that will be replaced by the file labeling utilities described at http://selinuxproject.org/page/PolicyStoreConfigurationFiles that details the `file_contexts` entries.

Statement definition:

    (userprefix user_id prefix)

Where:

`userprefix` | The `userprefix` keyword.
`user_id` | A previously declared SELinux `user` identifier.
`prefix` | The string to be used by the file labeling utilities.

Example:

This example will associate `unconfined.admin` user with a prefix of "`user`":

    (block unconfined
        (user admin
        (userprefix admin user)
    )

## selinuxuser

Associates a GNU/Linux user to a previously declared `user` identifier with a previously declared MLS `userrange`. Note that the `userrange` is required even if the policy is non-MCS/MLS.

Statement definition:

    (selinuxuser user_name user_id userrange_id)

Where:

`selinuxuser` | The `selinuxuser` keyword.
`user_name` | A string representing the GNU/Linux user name
`user_id` | A previously declared SELinux `user` identifier.
`userrange_id` | A previously declared `userrange` identifier that has been associated to the `user` identifier. This may be formed by named or anonymous components as discussed in the `userrange` statement and shown in the examples.

Example:

This example will associate `unconfined.admin` user with a GNU / Linux user "`admin_1`":

    (block unconfined
        (user admin)
        (selinuxuser admin_1 admin low_low)
    )

## selinuxuserdefault

Declares the default SELinux user. Only one `selinuxuserdefault` statement is allowed in the policy. Note that the `userrange` identifier is required even if the policy is non-MCS/MLS.

Statement definition:

    (selinuxuserdefault user_id userrange_id)

Where:

`selinuxuserdefault` | The `selinuxuserdefault` keyword.
`user_id` | A previously declared SELinux `user` identifier.
`userrange_id` | A previously declared `userrange` identifier that has been associated to the `user` identifier. This may be formed by named or anonymous components as discussed in the `userrange` statement and shown in the examples.

Example:

This example will define the `unconfined.user` as the default SELinux user:

    (block unconfined
        (user user)
        (selinuxuserdefault user low_low)
    )