Users, permissions and SELinux

useradd -m -s /bin/bash -c 'Alice Example' -G wheel,developers alice   # -m creates the home from /etc/skel
useradd -r -s /usr/sbin/nologin -d /var/lib/my-app -M my-app            # -r: UID below SYS_UID_MAX; -M: no home directory
useradd -u 2001 -g developers -e 2026-12-31 contractor                   # fixed UID, primary group, expiry date

usermod -aG docker alice        # -a is essential: without it the user is removed from every other supplementary group
usermod -s /usr/sbin/nologin alice
usermod -d /home/alice2 -m alice # -m moves the existing home directory contents
usermod -L alice                 # lock: prefixes the hash in /etc/shadow with "!"
usermod -U alice                 # unlock
usermod -e 1 alice               # account expired on 1970-01-02: blocks every login method, including SSH keys
usermod -e '' alice              # remove the expiry

userdel alice                    # keeps the home directory and mail spool
userdel -r alice                 # deletes them; files owned by the UID elsewhere on disk remain: find / -xdev -nouser

passwd alice                     # interactive; as root no old password is asked for
passwd -S alice                  # status: L locked, NP no password, P usable password, plus ageing fields
passwd -e alice                  # expire now; user must change at next login
passwd -d alice                  # remove the password: empty password, allowed only where nullok is configured
chage -l alice                   # human-readable ageing
chage -M 90 -m 1 -W 14 alice     # max 90 days, min 1 day between changes, warn 14 days ahead
chage -E 2026-12-31 alice        # account (not password) expiry; -E -1 removes it
chage -d 0 alice                 # last change "never": forces a change at next login

groupadd developers
groupadd -r -g 950 my-app        # system group, fixed GID
gpasswd -a alice developers      # add a member
gpasswd -d alice developers      # remove a member
groupmems -g developers -l       # list members
groupdel developers              # refused while it is any user's primary group
getent group developers          # name:x:gid:member,member
id alice                         # uid, primary gid and every group, from the databases, not a running session

visudo                              # /etc/sudoers
visudo -f /etc/sudoers.d/my-app     # a drop-in; created with mode 0440
visudo -c                           # parse every file; run after any change made by configuration management
visudo -cf /path/to/candidate       # check a file before installing it
sudo -l                             # rules that apply to me
sudo -l -U alice                    # rules that apply to alice (root only)
sudo -u my-app -i                   # login shell as another user
sudo -k                             # drop the cached credential
sudo -n true                        # non-interactive: fails instead of prompting; use in scripts
sudoedit /etc/my-app/config.ini     # edit as root through a copy, with your own editor, no shell escape as root

# /etc/sudoers.d/my-app  (0440 root:root)
Cmnd_Alias MY_APP = /usr/bin/systemctl restart my-app.service, \
                    /usr/bin/systemctl status my-app.service, \
                    /usr/bin/journalctl -u my-app.service *
deploy ALL=(root) NOPASSWD: MY_APP
%developers ALL=(root) /usr/bin/journalctl -u my-app.service *
Defaults:deploy !requiretty

Defaults use_pty                    # commands run in a pseudo-terminal; blocks a background process from stealing the tty
Defaults log_output                 # record sessions under /var/log/sudo-io; replay with sudoreplay -l
Defaults!/usr/bin/sudoreplay !log_output
Defaults timestamp_timeout=5        # minutes the cached credential lasts; 0 asks every time
Defaults passwd_tries=3
Defaults env_reset, secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"
Defaults env_keep += "HTTPS_PROXY NO_PROXY"
Defaults logfile=/var/log/sudo.log  # in addition to the journal

stat -c '%A %a %U:%G %n' /srv/www/html      # drwxr-sr-x 2755 root:www /srv/www/html
namei -l /srv/www/html/index.html            # each component with its owner and mode; the fastest answer to "why can't I open this"
chown alice:developers file
chown -R --reference=/srv/www/html /srv/www/staging   # copy owner and group from another path
chmod 640 file                               # u=rw g=r o=
chmod -R u=rwX,g=rX,o= /srv/app              # X: execute only on directories and files already executable
chmod g+s /srv/shared                        # setgid directory: new files inherit the directory's group
chmod +t /srv/shared                         # sticky: only a file's owner (or root) can delete it
chmod u+s /usr/local/bin/my-tool             # setuid: runs as the file's owner; audit every one of these
umask                                        # 0022 (or 0077 for root on Fedora/RHEL); subtracted from 666/777 for new files
find / -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls   # every setuid/setgid binary
find /srv -xdev -perm -o+w -not -type l -ls  # world-writable without the sticky bit protection
find / -xdev \( -nouser -o -nogroup \) -ls   # owned by a deleted UID/GID

groupadd developers
mkdir -p /srv/shared
chgrp developers /srv/shared
chmod 2770 /srv/shared                        # setgid: new entries get group developers
setfacl -m d:g:developers:rwx /srv/shared     # default ACL: new entries are group-writable regardless of umask

getfacl file                                  # owner, group, every entry, mask
getfacl -R /srv/shared > /root/shared.acl     # backup in a format setfacl can restore
setfacl -m u:alice:rw file                    # user entry
setfacl -m g:developers:rx,o::- file          # several entries; o::- removes other's bits
setfacl -m m::r file                          # tighten the mask: no named entry exceeds read
setfacl -x u:alice file                       # remove one entry
setfacl -b file                               # remove every extended entry; the mode bits stay
setfacl -R -m u:alice:rX /srv/shared          # recursive; X as in chmod
setfacl -m d:u:alice:rwx /srv/shared          # default entry: inherited by new children of this directory
setfacl -k /srv/shared                        # remove the default entries
setfacl --restore=/root/shared.acl            # restore the backup, including owners and modes

getcap /usr/bin/ping                          # /usr/bin/ping cap_net_raw=ep
getcap -r / 2>/dev/null                       # every file capability on the system
setcap cap_net_bind_service=+ep /usr/local/bin/my-app   # bind ports below 1024 as a normal user
setcap -r /usr/local/bin/my-app               # remove
getpcaps "$(pidof my-app)"                    # effective capabilities of a running process
grep Cap /proc/"$(pidof my-app)"/status       # CapInh, CapPrm, CapEff, CapBnd, CapAmb as hex
capsh --decode=0000000000000400               # cap_net_bind_service
capsh --print                                 # capabilities of the current shell

authselect current                            # profile and enabled features
authselect list                               # local, sssd, winbind, ...
authselect list-features sssd
authselect select sssd with-faillock with-mkhomedir --force   # rewrites /etc/pam.d/{system,password}-auth and nsswitch.conf
authselect enable-feature with-pamaccess      # then edit /etc/security/access.conf
authselect check                              # reports files changed outside authselect
authselect create-profile my-site -b sssd     # custom profile under /etc/authselect/custom when a feature is not enough

faillock --user alice                         # failed attempts recorded
faillock --user alice --reset                 # clear them
journalctl -t sshd -t login -t sudo --since -1h   # PAM messages are logged under the service's tag

getenforce                                    # Enforcing, Permissive or Disabled
sestatus                                      # mode, policy name, and whether the config file and runtime differ
setenforce 0                                  # permissive until reboot: denials are logged, not enforced
setenforce 1
grep ^SELINUX= /etc/selinux/config            # boot-time mode; disabled here needs a reboot and a relabel to re-enable
ls -Z /srv/www/html                           # file contexts
ps -eZ | grep -w httpd                        # process domains: httpd_t
id -Z                                         # unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
ss -ltnZ                                      # listening sockets with their domain

matchpathcon /srv/www/html/index.html         # what the policy says the label should be
semanage fcontext -l | grep -E '^/var/www'    # rules shipped by the policy
semanage fcontext -l -C                       # local additions only
semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?'   # add a rule; regex, anchored at the start
semanage fcontext -a -e /var/www /srv/www     # equivalence: label /srv/www exactly as /var/www would be
semanage fcontext -d '/srv/www(/.*)?'         # remove the rule
restorecon -Rv /srv/www                       # apply rules; -v prints each change
restorecon -RvF /srv/www                      # -F also resets the user and role fields, not only the type
restorecon -Rvn /                             # dry run: what a full relabel would change
chcon -t httpd_sys_content_t /srv/www/index.html   # temporary: undone by the next restorecon or relabel
fixfiles -F onboot                            # relabel everything at next boot (writes /.autorelabel); slow on large disks

semanage port -l | grep -E '^(ssh|http)_port_t'
semanage port -a -t ssh_port_t -p tcp 2222    # add; fails with "already defined" if another type owns that port
semanage port -m -t http_port_t -p tcp 8081   # modify an existing assignment instead
semanage port -d -t ssh_port_t -p tcp 2222
sepolicy network -p 2222                      # which types may use a port

getsebool -a | grep httpd                     # every boolean for a domain
semanage boolean -l -C                        # booleans changed from the default
setsebool httpd_can_network_connect on        # runtime only
setsebool -P httpd_can_network_connect on     # -P persists; it rebuilds the policy and takes a few seconds
sesearch -A -s httpd_t -t httpd_sys_content_t -c file -p read   # is there an allow rule (setools-console)
sesearch -A -s httpd_t -c tcp_socket -p name_connect -b httpd_can_network_connect  # rules a boolean enables

ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent -i      # last 10 minutes, interpreted
ausearch -m AVC -ts today -c httpd                      # by command name
ausearch -m AVC -ts today | audit2why                   # explains each: missing rule, boolean, or mislabelled file
journalctl -t setroubleshoot --since -1h                # "SELinux is preventing ... For complete message run sealert -l UUID"
sealert -l 8c4a...                                      # full analysis with the suggested fix, ranked by confidence
sealert -a /var/log/audit/audit.log                     # analyse every denial in the file

type=AVC msg=audit(1758700000.123:4567): avc:  denied  { read } for  pid=1234 comm="httpd" name="index.html" dev="dm-0" ino=98765 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=0

ausearch -m AVC -ts recent -c my-app | audit2allow -M my-app   # writes my-app.te (source) and my-app.pp (compiled)
cat my-app.te                                                  # review every allow line
semodule -i my-app.pp                                          # install; persists across reboots
semodule -l | grep my-app
semodule -r my-app                                             # remove
semanage permissive -a my_app_t                                # one domain permissive, the rest enforcing
semanage permissive -d my_app_t
semanage export > selinux-local.conf                           # every local customisation: fcontext, port, boolean, permissive

# Accounts that can log in: a real shell and a usable password or an SSH key
awk -F: '$7 !~ /(nologin|false)$/ {print $1}' /etc/passwd

# Accounts with UID 0 other than root
awk -F: '$3 == 0 && $1 != "root"' /etc/passwd

# Accounts with an empty password field
awk -F: '$2 == ""' /etc/shadow

# Password expiry for every human user
for u in $(awk -F: '$3 >= 1000 && $3 < 60000 {print $1}' /etc/passwd); do printf '%-16s %s\n' "$u" "$(chage -l "$u" | awk -F: '/Password expires/ {print $2}')"; done

# Members of wheel, from every source
getent group wheel | cut -d: -f4 | tr , '\n'

# Every sudo rule in effect for a user, including from sudoers.d
sudo -l -U alice

# Who used sudo today
journalctl _COMM=sudo --since today -o cat | grep -E 'COMMAND='

# Failed logins in the last hour by user
journalctl -t sshd --since -1h -o cat | grep -oE 'Failed password for (invalid user )?\S+' | sort | uniq -c | sort -rn

# Currently logged-in sessions
loginctl list-sessions

# Setuid and setgid files outside the package database (unowned by any rpm)
find / -xdev -type f -perm /6000 -exec sh -c 'rpm -qf "$1" >/dev/null 2>&1 || echo "$1"' _ {} \;

# World-writable directories without the sticky bit
find / -xdev -type d -perm -0002 -not -perm -1000 -ls

# Files with ACLs under a tree
getfacl -Rs /srv 2>/dev/null | grep '^# file:'

# Copy ACLs, owner and mode from one tree to another with the same layout
getfacl -R /srv/prod | sed 's#^# file: prod#\# file: staging#' | (cd /srv && setfacl --restore=-)

# Every file capability on the system
getcap -r / 2>/dev/null

# Effective capabilities of every process that has any
for p in /proc/[0-9]*; do c=$(awk '/CapEff/ {print $2}' "$p/status"); [ "$c" != 0000000000000000 ] && printf '%s %s %s\n' "${p#/proc/}" "$(cat "$p/comm")" "$c"; done

# Denials since boot, one line each, deduplicated by domain, target type and class
ausearch -m AVC -ts boot 2>/dev/null | grep -oE 'scontext=\S+ tcontext=\S+ tclass=\S+' | sort | uniq -c | sort -rn

# Files under a path whose label differs from the policy
restorecon -Rvn /srv

# Processes running in unconfined_service_t (a service without a policy)
ps -eo pid,comm,label | awk '$3 ~ /unconfined_service_t/'

# Which service unit a denied PID belongs to
systemctl status 1234 --no-pager | head -1

# Port labels for a service
semanage port -l | grep -w http_port_t

# Everything SELinux-related changed locally on this host, for reproducing on another
semanage export

#!/usr/bin/env bash
set -euo pipefail
# Human accounts (UID_MIN..60000) with a login shell, their password ageing and last login.
printf '%-16s %-8s %-12s %-12s %s\n' USER STATUS CHANGED EXPIRES LAST_LOGIN
while IFS=: read -r user _ uid _ _ _ shell; do
  (( uid >= 1000 && uid < 60000 )) || continue
  case $shell in */nologin|*/false) continue ;; esac
  status=$(passwd -S "$user" | awk '{print $2}')          # P, L or NP
  changed=$(chage -l "$user" | awk -F': ' '/Last password change/ {print $2}')
  expires=$(chage -l "$user" | awk -F': ' '/^Account expires/ {print $2}')
  last=$(lastlog -u "$user" | awk 'NR==2 {print ($3 ~ /Never/) ? "never" : $(NF-5)" "$(NF-4)" "$(NF-3)" "$NF}')
  printf '%-16s %-8s %-12s %-12s %s\n' "$user" "$status" "${changed:0:12}" "${expires:0:12}" "$last"
done < /etc/passwd

#!/usr/bin/env bash
set -euo pipefail
csv=${1:?usage: mkusers users.csv}
while IFS=, read -r name fullname groups; do
  [[ -z $name || $name == \#* ]] && continue
  if getent passwd "$name" >/dev/null; then printf 'skip %s: exists\n' "$name"; continue; fi
  useradd -m -s /bin/bash -c "$fullname" ${groups:+-G "$groups"} "$name"
  pw=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 20)
  printf '%s:%s\n' "$name" "$pw" | chpasswd
  chage -d 0 -M 90 -W 14 "$name"                            # change at first login, then every 90 days
  printf 'created %s (initial password delivered out of band: %s)\n' "$name" "$pw" >&2   # stderr only; never log this
done < "$csv"

#!/usr/bin/env bash
set -euo pipefail
# Group AVC denials since boot and print audit2why's verdict for each distinct one.
ausearch -m AVC,USER_AVC -ts boot -i 2>/dev/null > "${TMPDIR:-/var/tmp}/avc.$$" || { echo "no denials since boot"; exit 0; }
trap 'rm -f "${TMPDIR:-/var/tmp}/avc.$$"' EXIT
grep -oE 'comm=\S+ .*scontext=\S+ tcontext=\S+ tclass=\S+' "${TMPDIR:-/var/tmp}/avc.$$" \
  | sed -E 's/ (pid|name|dev|ino|path)=\S+//g' | sort | uniq -c | sort -rn | head -20
echo
echo '--- audit2why ---'
ausearch -m AVC,USER_AVC -ts boot 2>/dev/null | audit2why | grep -E '^\s+(Was caused by|You can use|Missing|Unknown)' | sort | uniq -c | sort -rn