1mock_selinux(8) SELinux Policy mock mock_selinux(8)
2
3
4
6 mock_selinux - Security Enhanced Linux Policy for the mock processes
7
9 Security-Enhanced Linux secures the mock processes via flexible manda‐
10 tory access control.
11
12 The mock processes execute with the mock_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep mock_t
19
20
21
23 The mock_t SELinux type can be entered via the mock_exec_t file type.
24
25 The default entrypoint paths for the mock_t domain are the following:
26
27 /usr/sbin/mock, /usr/libexec/mock/mock
28
30 SELinux defines process types (domains) for each process running on the
31 system
32
33 You can see the context of a process using the -Z option to ps
34
35 Policy governs the access confined processes have to files. SELinux
36 mock policy is very flexible allowing users to setup their mock pro‐
37 cesses in as secure a method as possible.
38
39 The following process types are defined for mock:
40
41 mock_t, mock_build_t
42
43 Note: semanage permissive -a mock_t can be used to make the process
44 type mock_t permissive. SELinux does not deny access to permissive
45 process types, but the AVC (SELinux denials) messages are still gener‐
46 ated.
47
48
50 SELinux policy is customizable based on least access required. mock
51 policy is extremely flexible and has several booleans that allow you to
52 manipulate the policy and run mock with the tightest access possible.
53
54
55
56 If you want to allow mock to read files in home directories, you must
57 turn on the mock_enable_homedirs boolean. Disabled by default.
58
59 setsebool -P mock_enable_homedirs 1
60
61
62
63 If you want to allow users to resolve user passwd entries directly from
64 ldap rather then using a sssd server, you must turn on the authlo‐
65 gin_nsswitch_use_ldap boolean. Disabled by default.
66
67 setsebool -P authlogin_nsswitch_use_ldap 1
68
69
70
71 If you want to deny any process from ptracing or debugging any other
72 processes, you must turn on the deny_ptrace boolean. Enabled by
73 default.
74
75 setsebool -P deny_ptrace 1
76
77
78
79 If you want to allow any process to mmap any file on system with
80 attribute file_type, you must turn on the domain_can_mmap_files bool‐
81 ean. Enabled by default.
82
83 setsebool -P domain_can_mmap_files 1
84
85
86
87 If you want to allow all domains write to kmsg_device, while kernel is
88 executed with systemd.log_target=kmsg parameter, you must turn on the
89 domain_can_write_kmsg boolean. Disabled by default.
90
91 setsebool -P domain_can_write_kmsg 1
92
93
94
95 If you want to allow all domains to use other domains file descriptors,
96 you must turn on the domain_fd_use boolean. Enabled by default.
97
98 setsebool -P domain_fd_use 1
99
100
101
102 If you want to allow all domains to have the kernel load modules, you
103 must turn on the domain_kernel_load_modules boolean. Disabled by
104 default.
105
106 setsebool -P domain_kernel_load_modules 1
107
108
109
110 If you want to allow all domains to execute in fips_mode, you must turn
111 on the fips_mode boolean. Enabled by default.
112
113 setsebool -P fips_mode 1
114
115
116
117 If you want to enable reading of urandom for all domains, you must turn
118 on the global_ssp boolean. Disabled by default.
119
120 setsebool -P global_ssp 1
121
122
123
124 If you want to allow confined applications to run with kerberos, you
125 must turn on the kerberos_enabled boolean. Enabled by default.
126
127 setsebool -P kerberos_enabled 1
128
129
130
131 If you want to allow system to run with NIS, you must turn on the
132 nis_enabled boolean. Disabled by default.
133
134 setsebool -P nis_enabled 1
135
136
137
138 If you want to allow confined applications to use nscd shared memory,
139 you must turn on the nscd_use_shm boolean. Disabled by default.
140
141 setsebool -P nscd_use_shm 1
142
143
144
145 If you want to support NFS home directories, you must turn on the
146 use_nfs_home_dirs boolean. Disabled by default.
147
148 setsebool -P use_nfs_home_dirs 1
149
150
151
152 If you want to support SAMBA home directories, you must turn on the
153 use_samba_home_dirs boolean. Disabled by default.
154
155 setsebool -P use_samba_home_dirs 1
156
157
158
160 The SELinux process type mock_t can manage files labeled with the fol‐
161 lowing file types. The paths listed are the default paths for these
162 file types. Note the processes UID still need to have DAC permissions.
163
164 cifs_t
165
166
167 lvm_lock_t
168
169 /etc/lvm/lock(/.*)?
170 /var/lock/lvm(/.*)?
171 /var/lock/dmraid(/.*)?
172
173 mock_cache_t
174
175 /var/cache/mock(/.*)?
176
177 mock_tmp_t
178
179
180 mock_var_lib_t
181
182 /var/lib/mock(/.*)?
183
184 mock_var_run_t
185
186
187 mount_var_run_t
188
189 /run/mount(/.*)?
190 /dev/.mount(/.*)?
191 /var/run/mount(/.*)?
192 /var/run/davfs2(/.*)?
193 /var/cache/davfs2(/.*)?
194
195 nfs_t
196
197
198 rpm_tmp_t
199
200
201 rpm_var_cache_t
202
203 /var/cache/yum(/.*)?
204 /var/cache/dnf(/.*)?
205 /var/spool/up2date(/.*)?
206 /var/cache/PackageKit(/.*)?
207
208 rpm_var_lib_t
209
210 /var/lib/rpm(/.*)?
211 /var/lib/yum(/.*)?
212 /var/lib/dnf(/.*)?
213 /usr/share/rpm(/.*)?
214 /var/lib/PackageKit(/.*)?
215 /var/lib/alternatives(/.*)?
216 /var/lib/rpmrebuilddb.*(/.*)?
217
218 sysfs_t
219
220 /sys(/.*)?
221
222 systemd_passwd_var_run_t
223
224 /var/run/systemd/ask-password(/.*)?
225 /var/run/systemd/ask-password-block(/.*)?
226
227 user_home_t
228
229 /home/[^/]+/.+
230
231
233 SELinux requires files to have an extended attribute to define the file
234 type.
235
236 You can see the context of a file using the -Z option to ls
237
238 Policy governs the access confined processes have to these files.
239 SELinux mock policy is very flexible allowing users to setup their mock
240 processes in as secure a method as possible.
241
242 STANDARD FILE CONTEXT
243
244 SELinux defines the file context types for the mock, if you wanted to
245 store files with these types in a diffent paths, you need to execute
246 the semanage command to sepecify alternate labeling and then use
247 restorecon to put the labels on disk.
248
249 semanage fcontext -a -t mock_var_run_t '/srv/mymock_content(/.*)?'
250 restorecon -R -v /srv/mymock_content
251
252 Note: SELinux often uses regular expressions to specify labels that
253 match multiple files.
254
255 The following file types are defined for mock:
256
257
258
259 mock_build_exec_t
260
261 - Set files with the mock_build_exec_t type, if you want to transition
262 an executable to the mock_build_t domain.
263
264
265
266 mock_cache_t
267
268 - Set files with the mock_cache_t type, if you want to store the files
269 under the /var/cache directory.
270
271
272
273 mock_etc_t
274
275 - Set files with the mock_etc_t type, if you want to store mock files
276 in the /etc directories.
277
278
279
280 mock_exec_t
281
282 - Set files with the mock_exec_t type, if you want to transition an
283 executable to the mock_t domain.
284
285
286 Paths:
287 /usr/sbin/mock, /usr/libexec/mock/mock
288
289
290 mock_tmp_t
291
292 - Set files with the mock_tmp_t type, if you want to store mock tempo‐
293 rary files in the /tmp directories.
294
295
296
297 mock_var_lib_t
298
299 - Set files with the mock_var_lib_t type, if you want to store the mock
300 files under the /var/lib directory.
301
302
303
304 mock_var_run_t
305
306 - Set files with the mock_var_run_t type, if you want to store the mock
307 files under the /run or /var/run directory.
308
309
310
311 Note: File context can be temporarily modified with the chcon command.
312 If you want to permanently change the file context you need to use the
313 semanage fcontext command. This will modify the SELinux labeling data‐
314 base. You will need to use restorecon to apply the labels.
315
316
318 semanage fcontext can also be used to manipulate default file context
319 mappings.
320
321 semanage permissive can also be used to manipulate whether or not a
322 process type is permissive.
323
324 semanage module can also be used to enable/disable/install/remove pol‐
325 icy modules.
326
327 semanage boolean can also be used to manipulate the booleans
328
329
330 system-config-selinux is a GUI tool available to customize SELinux pol‐
331 icy settings.
332
333
335 This manual page was auto-generated using sepolicy manpage .
336
337
339 selinux(8), mock(8), semanage(8), restorecon(8), chcon(1), sepolicy(8)
340 , setsebool(8), mock_build_selinux(8), mock_build_selinux(8)
341
342
343
344mock 19-04-25 mock_selinux(8)