---
name: "user_contexts"
section: "5"
platform: "linux"
package: "selinux-utils"
version: "3.8.1-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/user_contexts"
---

# user\_contexts(5)

The SELinux user contexts configuration files

## NAME

user\_contexts - The SELinux user contexts configuration files

## DESCRIPTION

These optional user context configuration files contain entries that allow SELinux-aware login applications such as [**PAM**(8)](/PAM/8.md) (running in their own process context), to determine the context that a users login session should run under.

SELinux-aware login applications generally use one or more of the following libselinux functions that read these files from the active policy path:

[**get\_default\_context**(3)](/get_default_context/3.md)\
 [**get\_ordered\_context\_list**(3)](/get_ordered_context_list/3.md)\
 [**get\_ordered\_context\_list\_with\_level**(3)](/get_ordered_context_list_with_level/3.md)\
 [**get\_default\_context\_with\_level**(3)](/get_default_context_with_level/3.md)\
 [**get\_default\_context\_with\_role**(3)](/get_default_context_with_role/3.md)\
 [**get\_default\_context\_with\_rolelevel**(3)](/get_default_context_with_rolelevel/3.md)\
 [**query\_user\_context**(3)](/query_user_context/3.md)\
 [**manual\_user\_enter\_context**(3)](/manual_user_enter_context/3.md)

There can be one file for each SELinux user configured on the system. The file  path is formed using the path returned by [**selinux\_user\_contexts\_path**(3)](/selinux_user_contexts_path/3.md) for the active policy, with the SELinux user name appended, for example:

*/etc/selinux/{SELINUXTYPE}/contexts/users/unconfined\_u*\
 */etc/selinux/{SELINUXTYPE}/contexts/users/xguest\_u*

Where *{SELINUXTYPE}* is the entry from the selinux configuration file *config* (see [**selinux\_config**(5)](/selinux_config/5.md)).

These files contain context information as described in the **FILE FORMAT** section.

## FILE FORMAT

Each line in the user context configuration file consists of the following:

*login\_process user\_login\_process*

Where:

*login\_process*

This consists of a *role***:***type*\[**:***range*\] entry that represents the login process context.

*user\_login\_process*

This consists of a *role***:***type*\[**:***range*\] entry that represents the user login process context.

## EXAMPLE

\# Example for xguest\_u at /etc/selinux/default/contexts/users/xguest\_u\
 system\_r:crond\_t:s0			xguest\_r:xguest\_t:s0\
 system\_r:initrc\_t:s0		xguest\_r:xguest\_t:s0\
 system\_r:local\_login\_t:s0	xguest\_r:xguest\_t:s0\
 system\_r:remote\_login\_t:s0	xguest\_r:xguest\_t:s0\
 system\_r:sshd\_t:s0			xguest\_r:xguest\_t:s0\
 system\_r:xdm\_t:s0			xguest\_r:xguest\_t:s0\
 xguest\_r:xguest\_t:s0		xguest\_r:xguest\_t:s0

## SEE ALSO

[**selinux**(8)](/selinux/8.md), [**selinux\_user\_contexts\_path**(3)](/selinux_user_contexts_path/3.md), [**PAM**(8)](/PAM/8.md), [**get\_ordered\_context\_list**(3)](/get_ordered_context_list/3.md), [**get\_ordered\_context\_list\_with\_level**(3)](/get_ordered_context_list_with_level/3.md), [**get\_default\_context\_with\_level**(3)](/get_default_context_with_level/3.md), [**get\_default\_context\_with\_role**(3)](/get_default_context_with_role/3.md), [**get\_default\_context\_with\_rolelevel**(3)](/get_default_context_with_rolelevel/3.md), [**query\_user\_context**(3)](/query_user_context/3.md), [**manual\_user\_enter\_context**(3)](/manual_user_enter_context/3.md), [**selinux\_config**(5)](/selinux_config/5.md)