Ensure non-privileged users are confined by SELinux user mapping

command -v semanage >/dev/null 2>&1 || { echo "NOT APPLICABLE: semanage not available"; exit 0; }
# The default __default__ login must not map ordinary users to unconfined_u.
def=$(semanage login -l 2>/dev/null | awk '$1=="__default__"{print $2}')
if [ -n "$def" ] && [ "$def" = "unconfined_u" ]; then
  echo "FAIL: __default__ login maps to unconfined_u (non-privileged users unconfined)"
  exit 1
fi
echo "OK: __default__ SELinux login is $def (review individual mappings against the authorized-user list)"
exit 0

expected_exit:

0

note:

Map users to appropriate SELinux users, e.g.: semanage login -a -s user_u <username> and set a confined default if required: semanage login -m -s user_u __default__ The authorized administrator list is site-defined.