1user_mail_selinux(8) SELinux Policy user_mail user_mail_selinux(8)
2
3
4
6 user_mail_selinux - Security Enhanced Linux Policy for the user_mail
7 processes
8
10 Security-Enhanced Linux secures the user_mail processes via flexible
11 mandatory access control.
12
13 The user_mail processes execute with the user_mail_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep user_mail_t
20
21
22
24 The user_mail_t SELinux type can be entered via the sendmail_exec_t
25 file type.
26
27 The default entrypoint paths for the user_mail_t domain are the follow‐
28 ing:
29
30 /usr/lib(64)?/sendmail, /bin/mail(x)?, /usr/sbin/sendmail(.sendmail)?,
31 /usr/bin/esmtp, /usr/sbin/ssmtp, /usr/sbin/rmail, /var/qmail/bin/send‐
32 mail, /usr/sbin/sendmail.postfix
33
35 SELinux defines process types (domains) for each process running on the
36 system
37
38 You can see the context of a process using the -Z option to ps
39
40 Policy governs the access confined processes have to files. SELinux
41 user_mail policy is very flexible allowing users to setup their
42 user_mail processes in as secure a method as possible.
43
44 The following process types are defined for user_mail:
45
46 user_mail_t
47
48 Note: semanage permissive -a user_mail_t can be used to make the
49 process type user_mail_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
53
55 SELinux policy is customizable based on least access required.
56 user_mail policy is extremely flexible and has several booleans that
57 allow you to manipulate the policy and run user_mail with the tightest
58 access possible.
59
60
61
62 If you want to allow all domains to use other domains file descriptors,
63 you must turn on the allow_domain_fd_use boolean. Enabled by default.
64
65 setsebool -P allow_domain_fd_use 1
66
67
68
69 If you want to allow confined applications to run with kerberos, you
70 must turn on the allow_kerberos boolean. Enabled by default.
71
72 setsebool -P allow_kerberos 1
73
74
75
76 If you want to allow sysadm to debug or ptrace all processes, you must
77 turn on the allow_ptrace boolean. Disabled by default.
78
79 setsebool -P allow_ptrace 1
80
81
82
83 If you want to allow system to run with NIS, you must turn on the
84 allow_ypbind boolean. Disabled by default.
85
86 setsebool -P allow_ypbind 1
87
88
89
90 If you want to allow all domains to have the kernel load modules, you
91 must turn on the domain_kernel_load_modules boolean. Disabled by
92 default.
93
94 setsebool -P domain_kernel_load_modules 1
95
96
97
98 If you want to allow all domains to execute in fips_mode, you must turn
99 on the fips_mode boolean. Enabled by default.
100
101 setsebool -P fips_mode 1
102
103
104
105 If you want to enable reading of urandom for all domains, you must turn
106 on the global_ssp boolean. Disabled by default.
107
108 setsebool -P global_ssp 1
109
110
111
112 If you want to allow confined applications to use nscd shared memory,
113 you must turn on the nscd_use_shm boolean. Enabled by default.
114
115 setsebool -P nscd_use_shm 1
116
117
118
119 If you want to support SAMBA home directories, you must turn on the
120 use_samba_home_dirs boolean. Disabled by default.
121
122 setsebool -P use_samba_home_dirs 1
123
124
125
127 The SELinux process type user_mail_t can manage files labeled with the
128 following file types. The paths listed are the default paths for these
129 file types. Note the processes UID still need to have DAC permissions.
130
131 cifs_t
132
133
134 courier_spool_t
135
136 /var/spool/courier(/.*)?
137 /var/spool/authdaemon(/.*)?
138
139 exim_log_t
140
141 /var/log/exim[0-9]?(/.*)?
142
143 exim_spool_t
144
145 /var/spool/exim[0-9]?(/.*)?
146
147 initrc_tmp_t
148
149
150 mail_home_rw_t
151
152 /root/Maildir(/.*)?
153 /home/[^/]*/Maildir(/.*)?
154 /home/staff/Maildir(/.*)?
155
156 mail_spool_t
157
158 /var/mail(/.*)?
159 /var/spool/mail(/.*)?
160 /var/spool/imap(/.*)?
161
162 mnt_t
163
164 /mnt(/[^/]*)
165 /mnt(/[^/]*)?
166 /rhev(/[^/]*)?
167 /media(/[^/]*)
168 /media(/[^/]*)?
169 /etc/rhgb(/.*)?
170 /media/.hal-.*
171 /net
172 /afs
173 /rhev
174 /misc
175
176 mqueue_spool_t
177
178 /var/spool/(client)?mqueue(/.*)?
179
180 sendmail_log_t
181
182 /var/log/mail(/.*)?
183 /var/log/sendmail.st.*
184
185 tmp_t
186
187 /tmp
188 /usr/tmp
189 /var/tmp
190 /tmp-inst
191 /var/tmp-inst
192 /var/tmp/vi.recover
193
194 user_home_t
195
196 /home/[^/]*/.+
197 /home/staff/.+
198
199 user_mail_tmp_t
200
201
202 user_tmp_t
203
204 /tmp/gconfd-.*
205 /tmp/gconfd-staff
206
207 uucpd_spool_t
208
209 /var/spool/uucp(/.*)?
210 /var/spool/uucppublic(/.*)?
211
212
214 semanage fcontext can also be used to manipulate default file context
215 mappings.
216
217 semanage permissive can also be used to manipulate whether or not a
218 process type is permissive.
219
220 semanage module can also be used to enable/disable/install/remove pol‐
221 icy modules.
222
223 semanage boolean can also be used to manipulate the booleans
224
225
226 system-config-selinux is a GUI tool available to customize SELinux pol‐
227 icy settings.
228
229
231 This manual page was auto-generated using sepolicy manpage .
232
233
235 selinux(8), user_mail(8), semanage(8), restorecon(8), chcon(1) , setse‐
236 bool(8)
237
238
239
240user_mail 15-06-03 user_mail_selinux(8)