xm_ssh_selinux(8)

1xm_ssh_selinux(8)            SELinux Policy xm_ssh           xm_ssh_selinux(8)
2
3
4

NAME

6       xm_ssh_selinux  -  Security  Enhanced  Linux Policy for the xm_ssh pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  xm_ssh  processes  via  flexible
11       mandatory access control.
12
13       The  xm_ssh  processes  execute with the xm_ssh_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep xm_ssh_t
20
21
22

ENTRYPOINTS

24       The xm_ssh_t SELinux type can be entered via the ssh_exec_t file type.
25
26       The default entrypoint paths for the xm_ssh_t domain are the following:
27
28       /usr/bin/ssh
29

PROCESS TYPES

31       SELinux defines process types (domains) for each process running on the
32       system
33
34       You can see the context of a process using the -Z option to ps
35
36       Policy governs the access confined processes have  to  files.   SELinux
37       xm_ssh  policy  is  very  flexible allowing users to setup their xm_ssh
38       processes in as secure a method as possible.
39
40       The following process types are defined for xm_ssh:
41
42       xm_ssh_t
43
44       Note: semanage permissive -a xm_ssh_t can be used to make  the  process
45       type  xm_ssh_t  permissive.  SELinux does not deny access to permissive
46       process types, but the AVC (SELinux denials) messages are still  gener‐
47       ated.
48
49

BOOLEANS

51       SELinux  policy is customizable based on least access required.  xm_ssh
52       policy is extremely flexible and has several booleans that allow you to
53       manipulate the policy and run xm_ssh with the tightest access possible.
54
55
56
57       If you want to allow all domains to use other domains file descriptors,
58       you must turn on the allow_domain_fd_use boolean. Enabled by default.
59
60       setsebool -P allow_domain_fd_use 1
61
62
63
64       If you want to allow confined applications to run  with  kerberos,  you
65       must turn on the allow_kerberos boolean. Enabled by default.
66
67       setsebool -P allow_kerberos 1
68
69
70
71       If  you want to allow sysadm to debug or ptrace all processes, you must
72       turn on the allow_ptrace boolean. Disabled by default.
73
74       setsebool -P allow_ptrace 1
75
76
77
78       If you want to allow system to run with  NIS,  you  must  turn  on  the
79       allow_ypbind boolean. Disabled by default.
80
81       setsebool -P allow_ypbind 1
82
83
84
85       If  you  want to allow all domains to have the kernel load modules, you
86       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
87       default.
88
89       setsebool -P domain_kernel_load_modules 1
90
91
92
93       If you want to allow all domains to execute in fips_mode, you must turn
94       on the fips_mode boolean. Enabled by default.
95
96       setsebool -P fips_mode 1
97
98
99
100       If you want to enable reading of urandom for all domains, you must turn
101       on the global_ssp boolean. Disabled by default.
102
103       setsebool -P global_ssp 1
104
105
106
107       If  you  want to allow confined applications to use nscd shared memory,
108       you must turn on the nscd_use_shm boolean. Enabled by default.
109
110       setsebool -P nscd_use_shm 1
111
112
113

MANAGED FILES

115       The SELinux process type xm_ssh_t can manage  files  labeled  with  the
116       following file types.  The paths listed are the default paths for these
117       file types.  Note the processes UID still need to have DAC permissions.
118
119       initrc_tmp_t
120
121
122       mnt_t
123
124            /mnt(/[^/]*)
125            /mnt(/[^/]*)?
126            /rhev(/[^/]*)?
127            /media(/[^/]*)
128            /media(/[^/]*)?
129            /etc/rhgb(/.*)?
130            /media/.hal-.*
131            /net
132            /afs
133            /rhev
134            /misc
135
136       ssh_home_t
137
138            /root/.ssh(/.*)?
139            /var/lib/gitolite(3)?/.ssh(/.*)?
140            /var/lib/pgsql/.ssh(/.*)?
141            /var/lib/openshift/[^/]+/.ssh(/.*)?
142            /var/lib/amanda/.ssh(/.*)?
143            /var/lib/stickshift/[^/]+/.ssh(/.*)?
144            /root/.shosts
145            /home/[^/]*/.ssh(/.*)?
146            /home/[^/]*/.shosts
147            /home/staff/.ssh(/.*)?
148            /home/staff/.shosts
149
150       tmp_t
151
152            /tmp
153            /usr/tmp
154            /var/tmp
155            /tmp-inst
156            /var/tmp-inst
157            /var/tmp/vi.recover
158
159       user_tmp_t
160
161            /tmp/gconfd-.*
162            /tmp/gconfd-staff
163
164       xenfs_t
165
166
167

COMMANDS

169       semanage fcontext can also be used to manipulate default  file  context
170       mappings.
171
172       semanage  permissive  can  also  be used to manipulate whether or not a
173       process type is permissive.
174
175       semanage module can also be used to enable/disable/install/remove  pol‐
176       icy modules.
177
178       semanage boolean can also be used to manipulate the booleans
179
180
181       system-config-selinux is a GUI tool available to customize SELinux pol‐
182       icy settings.
183
184

AUTHOR

186       This manual page was auto-generated using sepolicy manpage .
187
188