1devicekit_power_selinux(8S)ELinux Policy devicekit_powedrevicekit_power_selinux(8)
2
3
4

NAME

6       devicekit_power_selinux  -  Security  Enhanced  Linux  Policy  for  the
7       devicekit_power processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the devicekit_power processes via flex‐
11       ible mandatory access control.
12
13       The   devicekit_power  processes  execute  with  the  devicekit_power_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep devicekit_power_t
20
21
22

ENTRYPOINTS

24       The   devicekit_power_t   SELinux   type   can   be   entered  via  the
25       devicekit_power_exec_t file type.
26
27       The default entrypoint paths for the devicekit_power_t domain  are  the
28       following:
29
30       /usr/libexec/upowerd,   /usr/lib/upower/upowerd,   /usr/libexec/devkit-
31       power-daemon
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       devicekit_power policy is very flexible allowing users to  setup  their
41       devicekit_power processes in as secure a method as possible.
42
43       The following process types are defined for devicekit_power:
44
45       devicekit_power_t
46
47       Note:  semanage permissive -a devicekit_power_t can be used to make the
48       process type devicekit_power_t permissive. SELinux does not deny access
49       to permissive process types, but the AVC (SELinux denials) messages are
50       still generated.
51
52

BOOLEANS

54       SELinux  policy  is  customizable  based  on  least  access   required.
55       devicekit_power  policy  is extremely flexible and has several booleans
56       that allow you to manipulate the policy and  run  devicekit_power  with
57       the tightest access possible.
58
59
60
61       If you want to allow users to resolve user passwd entries directly from
62       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
63       gin_nsswitch_use_ldap boolean. Disabled by default.
64
65       setsebool -P authlogin_nsswitch_use_ldap 1
66
67
68
69       If you want to allow all daemons to write corefiles to /, you must turn
70       on the daemons_dump_core boolean. Disabled by default.
71
72       setsebool -P daemons_dump_core 1
73
74
75
76       If you want to enable cluster mode for daemons, you must  turn  on  the
77       daemons_enable_cluster_mode boolean. Enabled by default.
78
79       setsebool -P daemons_enable_cluster_mode 1
80
81
82
83       If  you want to allow all daemons to use tcp wrappers, you must turn on
84       the daemons_use_tcp_wrapper boolean. Disabled by default.
85
86       setsebool -P daemons_use_tcp_wrapper 1
87
88
89
90       If you want to allow all daemons the ability to  read/write  terminals,
91       you must turn on the daemons_use_tty boolean. Disabled by default.
92
93       setsebool -P daemons_use_tty 1
94
95
96
97       If you want to deny user domains applications to map a memory region as
98       both executable and writable, this  is  dangerous  and  the  executable
99       should be reported in bugzilla, you must turn on the deny_execmem bool‐
100       ean. Enabled by default.
101
102       setsebool -P deny_execmem 1
103
104
105
106       If you want to deny any process from ptracing or  debugging  any  other
107       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
108       default.
109
110       setsebool -P deny_ptrace 1
111
112
113
114       If you want to allow any process  to  mmap  any  file  on  system  with
115       attribute  file_type,  you must turn on the domain_can_mmap_files bool‐
116       ean. Enabled by default.
117
118       setsebool -P domain_can_mmap_files 1
119
120
121
122       If you want to allow all domains write to kmsg_device, while kernel  is
123       executed  with  systemd.log_target=kmsg parameter, you must turn on the
124       domain_can_write_kmsg boolean. Disabled by default.
125
126       setsebool -P domain_can_write_kmsg 1
127
128
129
130       If you want to allow all domains to use other domains file descriptors,
131       you must turn on the domain_fd_use boolean. Enabled by default.
132
133       setsebool -P domain_fd_use 1
134
135
136
137       If  you  want to allow all domains to have the kernel load modules, you
138       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
139       default.
140
141       setsebool -P domain_kernel_load_modules 1
142
143
144
145       If you want to allow all domains to execute in fips_mode, you must turn
146       on the fips_mode boolean. Enabled by default.
147
148       setsebool -P fips_mode 1
149
150
151
152       If you want to enable reading of urandom for all domains, you must turn
153       on the global_ssp boolean. Disabled by default.
154
155       setsebool -P global_ssp 1
156
157
158
159       If  you  want  to allow confined applications to run with kerberos, you
160       must turn on the kerberos_enabled boolean. Enabled by default.
161
162       setsebool -P kerberos_enabled 1
163
164
165
166       If you want to control the ability to mmap a low area  of  the  address
167       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
168       the mmap_low_allowed boolean. Disabled by default.
169
170       setsebool -P mmap_low_allowed 1
171
172
173
174       If you want to allow system to run with  NIS,  you  must  turn  on  the
175       nis_enabled boolean. Disabled by default.
176
177       setsebool -P nis_enabled 1
178
179
180
181       If  you  want to allow confined applications to use nscd shared memory,
182       you must turn on the nscd_use_shm boolean. Disabled by default.
183
184       setsebool -P nscd_use_shm 1
185
186
187
188       If you want to disable kernel module loading,  you  must  turn  on  the
189       secure_mode_insmod boolean. Enabled by default.
190
191       setsebool -P secure_mode_insmod 1
192
193
194
195       If  you want to boolean to determine whether the system permits loading
196       policy, setting enforcing mode, and changing boolean values.  Set  this
197       to  true  and  you  have to reboot to set it back, you must turn on the
198       secure_mode_policyload boolean. Enabled by default.
199
200       setsebool -P secure_mode_policyload 1
201
202
203
204       If you want to allow unconfined executables to make their  heap  memory
205       executable.   Doing  this  is  a  really bad idea. Probably indicates a
206       badly coded executable, but could indicate an attack.  This  executable
207       should   be   reported  in  bugzilla,  you  must  turn  on  the  selin‐
208       uxuser_execheap boolean. Disabled by default.
209
210       setsebool -P selinuxuser_execheap 1
211
212
213
214       If you want to  allow  all  unconfined  executables  to  use  libraries
215       requiring  text  relocation  that  are not labeled textrel_shlib_t, you
216       must turn on the selinuxuser_execmod boolean. Enabled by default.
217
218       setsebool -P selinuxuser_execmod 1
219
220
221
222       If you want to allow unconfined executables to make  their  stack  exe‐
223       cutable.   This  should  never, ever be necessary. Probably indicates a
224       badly coded executable, but could indicate an attack.  This  executable
225       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
226       stack boolean. Enabled by default.
227
228       setsebool -P selinuxuser_execstack 1
229
230
231
232       If you want to support X userspace object manager, you must turn on the
233       xserver_object_manager boolean. Enabled by default.
234
235       setsebool -P xserver_object_manager 1
236
237
238

MANAGED FILES

240       The  SELinux  process  type  devicekit_power_t can manage files labeled
241       with the following file types.  The paths listed are the default  paths
242       for  these  file  types.  Note the processes UID still need to have DAC
243       permissions.
244
245       file_type
246
247            all files on the system
248
249

FILE CONTEXTS

251       SELinux requires files to have an extended attribute to define the file
252       type.
253
254       You can see the context of a file using the -Z option to ls
255
256       Policy  governs  the  access  confined  processes  have to these files.
257       SELinux devicekit_power policy is very flexible allowing users to setup
258       their devicekit_power processes in as secure a method as possible.
259
260       The following file types are defined for devicekit_power:
261
262
263
264       devicekit_power_exec_t
265
266       -  Set files with the devicekit_power_exec_t type, if you want to tran‐
267       sition an executable to the devicekit_power_t domain.
268
269
270       Paths:
271            /usr/libexec/upowerd,                     /usr/lib/upower/upowerd,
272            /usr/libexec/devkit-power-daemon
273
274
275       Note:  File context can be temporarily modified with the chcon command.
276       If you want to permanently change the file context you need to use  the
277       semanage fcontext command.  This will modify the SELinux labeling data‐
278       base.  You will need to use restorecon to apply the labels.
279
280

COMMANDS

282       semanage fcontext can also be used to manipulate default  file  context
283       mappings.
284
285       semanage  permissive  can  also  be used to manipulate whether or not a
286       process type is permissive.
287
288       semanage module can also be used to enable/disable/install/remove  pol‐
289       icy modules.
290
291       semanage boolean can also be used to manipulate the booleans
292
293
294       system-config-selinux is a GUI tool available to customize SELinux pol‐
295       icy settings.
296
297

AUTHOR

299       This manual page was auto-generated using sepolicy manpage .
300
301

SEE ALSO

303       selinux(8), devicekit_power(8), semanage(8),  restorecon(8),  chcon(1),
304       sepolicy(8) , setsebool(8)
305
306
307
308devicekit_power                    19-04-25         devicekit_power_selinux(8)
Impressum