mozilla_plugin_selinux(8)

1mozilla_plugin_selinux(8)SELinux Policy mozilla_pluginmozilla_plugin_selinux(8)
2
3
4

NAME

6       mozilla_plugin_selinux   -  Security  Enhanced  Linux  Policy  for  the
7       mozilla_plugin processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the mozilla_plugin processes via flexi‐
11       ble mandatory access control.
12
13       The  mozilla_plugin processes execute with the mozilla_plugin_t SELinux
14       type. You can check if you have these processes  running  by  executing
15       the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep mozilla_plugin_t
20
21
22

ENTRYPOINTS

24       The  mozilla_plugin_t SELinux type can be entered via the mozilla_plug‐
25       in_exec_t file type.
26
27       The default entrypoint paths for the mozilla_plugin_t  domain  are  the
28       following:
29
30       /usr/lib(64)?/xulrunner[^/]*/plugin-container
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       mozilla_plugin  policy  is  very flexible allowing users to setup their
40       mozilla_plugin processes in as secure a method as possible.
41
42       The following process types are defined for mozilla_plugin:
43
44       mozilla_plugin_config_t, mozilla_plugin_t
45
46       Note: semanage permissive -a mozilla_plugin_t can be used to  make  the
47       process  type mozilla_plugin_t permissive. SELinux does not deny access
48       to permissive process types, but the AVC (SELinux denials) messages are
49       still generated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       mozilla_plugin policy is extremely flexible and  has  several  booleans
55       that allow you to manipulate the policy and run mozilla_plugin with the
56       tightest access possible.
57
58
59
60       If you want to allow all domains to use other domains file descriptors,
61       you must turn on the allow_domain_fd_use boolean. Enabled by default.
62
63       setsebool -P allow_domain_fd_use 1
64
65
66
67       If  you  want  to allow confined applications to run with kerberos, you
68       must turn on the allow_kerberos boolean. Enabled by default.
69
70       setsebool -P allow_kerberos 1
71
72
73
74       If you want to allow sysadm to debug or ptrace all processes, you  must
75       turn on the allow_ptrace boolean. Disabled by default.
76
77       setsebool -P allow_ptrace 1
78
79
80
81       If  you  want  to  allow  system  to run with NIS, you must turn on the
82       allow_ypbind boolean. Disabled by default.
83
84       setsebool -P allow_ypbind 1
85
86
87
88       If you want to allow all domains to have the kernel load  modules,  you
89       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
90       default.
91
92       setsebool -P domain_kernel_load_modules 1
93
94
95
96       If you want to allow all domains to execute in fips_mode, you must turn
97       on the fips_mode boolean. Enabled by default.
98
99       setsebool -P fips_mode 1
100
101
102
103       If you want to enable reading of urandom for all domains, you must turn
104       on the global_ssp boolean. Disabled by default.
105
106       setsebool -P global_ssp 1
107
108
109
110       If you want to allow confined applications to use nscd  shared  memory,
111       you must turn on the nscd_use_shm boolean. Enabled by default.
112
113       setsebool -P nscd_use_shm 1
114
115
116
117       If  you  want  to  allow  unconfined users to transition to the Mozilla
118       plugin domain when running xulrunner plugin-container, you must turn on
119       the unconfined_mozilla_plugin_transition boolean. Enabled by default.
120
121       setsebool -P unconfined_mozilla_plugin_transition 1
122
123
124
125       If  you  want  to  support  NFS  home directories, you must turn on the
126       use_nfs_home_dirs boolean. Disabled by default.
127
128       setsebool -P use_nfs_home_dirs 1
129
130
131
132       If you want to support SAMBA home directories, you  must  turn  on  the
133       use_samba_home_dirs boolean. Disabled by default.
134
135       setsebool -P use_samba_home_dirs 1
136
137
138

MANAGED FILES

140       The SELinux process type mozilla_plugin_t can manage files labeled with
141       the following file types.  The paths listed are the default  paths  for
142       these  file  types.  Note the processes UID still need to have DAC per‐
143       missions.
144
145       gnome_home_type
146
147
148       initrc_tmp_t
149
150
151       mnt_t
152
153            /mnt(/[^/]*)
154            /mnt(/[^/]*)?
155            /rhev(/[^/]*)?
156            /media(/[^/]*)
157            /media(/[^/]*)?
158            /etc/rhgb(/.*)?
159            /media/.hal-.*
160            /net
161            /afs
162            /rhev
163            /misc
164
165       mozilla_home_t
166
167            /home/[^/]*/.java(/.*)?
168            /home/[^/]*/.galeon(/.*)?
169            /home/[^/]*/.mozilla(/.*)?
170            /home/[^/]*/.phoenix(/.*)?
171            /home/[^/]*/.netscape(/.*)?
172            /home/[^/]*/.thunderbird(/.*)?
173            /home/staff/.java(/.*)?
174            /home/staff/.galeon(/.*)?
175            /home/staff/.mozilla(/.*)?
176            /home/staff/.phoenix(/.*)?
177            /home/staff/.netscape(/.*)?
178            /home/staff/.thunderbird(/.*)?
179
180       mozilla_plugin_tmp_t
181
182
183       mozilla_plugin_tmpfs_t
184
185
186       nsplugin_home_t
187
188            /home/[^/]*/.adobe(/.*)?
189            /home/[^/]*/.macromedia(/.*)?
190            /home/[^/]*/.gcjwebplugin(/.*)?
191            /home/[^/]*/.icedteaplugin(/.*)?
192            /home/staff/.adobe(/.*)?
193            /home/staff/.macromedia(/.*)?
194            /home/staff/.gcjwebplugin(/.*)?
195            /home/staff/.icedteaplugin(/.*)?
196
197       pulseaudio_home_t
198
199            /home/[^/]*/.pulse(/.*)?
200            /home/[^/]*/.pulse-cookie
201            /home/staff/.pulse(/.*)?
202            /home/staff/.pulse-cookie
203
204       tmp_t
205
206            /tmp
207            /usr/tmp
208            /var/tmp
209            /tmp-inst
210            /var/tmp-inst
211            /var/tmp/vi.recover
212
213       user_fonts_cache_t
214
215            /home/[^/]*/.fonts/auto(/.*)?
216            /home/[^/]*/.fontconfig(/.*)?
217            /home/[^/]*/.fonts.cache-.*
218            /home/staff/.fonts/auto(/.*)?
219            /home/staff/.fontconfig(/.*)?
220            /home/staff/.fonts.cache-.*
221
222       user_tmpfs_t
223
224            /dev/shm/mono.*
225            /dev/shm/pulse-shm.*
226
227

FILE CONTEXTS

229       SELinux requires files to have an extended attribute to define the file
230       type.
231
232       You can see the context of a file using the -Z option to ls
233
234       Policy  governs  the  access  confined  processes  have to these files.
235       SELinux mozilla_plugin policy is very flexible allowing users to  setup
236       their mozilla_plugin processes in as secure a method as possible.
237
238       STANDARD FILE CONTEXT
239
240       SELinux  defines  the file context types for the mozilla_plugin, if you
241       wanted to store files with these types in a diffent paths, you need  to
242       execute  the  semanage  command to sepecify alternate labeling and then
243       use restorecon to put the labels on disk.
244
245       semanage fcontext -a  -t  mozilla_plugin_tmpfs_t  '/srv/mymozilla_plug‐
246       in_content(/.*)?'
247       restorecon -R -v /srv/mymozilla_plugin_content
248
249       Note:  SELinux  often  uses  regular expressions to specify labels that
250       match multiple files.
251
252       The following file types are defined for mozilla_plugin:
253
254
255
256       mozilla_plugin_config_exec_t
257
258       - Set files with the mozilla_plugin_config_exec_t type, if you want  to
259       transition an executable to the mozilla_plugin_config_t domain.
260
261
262
263       mozilla_plugin_exec_t
264
265       - Set files with the mozilla_plugin_exec_t type, if you want to transi‐
266       tion an executable to the mozilla_plugin_t domain.
267
268
269
270       mozilla_plugin_rw_t
271
272       - Set files with the mozilla_plugin_rw_t type, if you want to treat the
273       files as mozilla plugin read/write content.
274
275
276
277       mozilla_plugin_tmp_t
278
279       -  Set  files  with the mozilla_plugin_tmp_t type, if you want to store
280       mozilla plugin temporary files in the /tmp directories.
281
282
283
284       mozilla_plugin_tmpfs_t
285
286       - Set files with the mozilla_plugin_tmpfs_t type, if you want to  store
287       mozilla plugin files on a tmpfs file system.
288
289
290
291       Note:  File context can be temporarily modified with the chcon command.
292       If you want to permanently change the file context you need to use  the
293       semanage fcontext command.  This will modify the SELinux labeling data‐
294       base.  You will need to use restorecon to apply the labels.
295
296

COMMANDS

298       semanage fcontext can also be used to manipulate default  file  context
299       mappings.
300
301       semanage  permissive  can  also  be used to manipulate whether or not a
302       process type is permissive.
303
304       semanage module can also be used to enable/disable/install/remove  pol‐
305       icy modules.
306
307       semanage boolean can also be used to manipulate the booleans
308
309
310       system-config-selinux is a GUI tool available to customize SELinux pol‐
311       icy settings.
312
313

AUTHOR

315       This manual page was auto-generated using sepolicy manpage .
316
317