staff_sudo_selinux(8)

1staff_sudo_selinux(8)      SELinux Policy staff_sudo     staff_sudo_selinux(8)
2
3
4

NAME

6       staff_sudo_selinux  - Security Enhanced Linux Policy for the staff_sudo
7       processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the staff_sudo processes  via  flexible
11       mandatory access control.
12
13       The  staff_sudo  processes  execute with the staff_sudo_t SELinux type.
14       You can check if you have these processes running by executing  the  ps
15       command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep staff_sudo_t
20
21
22

ENTRYPOINTS

24       The  staff_sudo_t  SELinux type can be entered via the sudo_exec_t file
25       type.
26
27       The default entrypoint paths for the staff_sudo_t domain are  the  fol‐
28       lowing:
29
30       /usr/bin/sudo(edit)?
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       staff_sudo  policy  is  very  flexible  allowing  users  to setup their
40       staff_sudo processes in as secure a method as possible.
41
42       The following process types are defined for staff_sudo:
43
44       staff_sudo_t
45
46       Note: semanage permissive -a staff_sudo_t  can  be  used  to  make  the
47       process  type  staff_sudo_t permissive. SELinux does not deny access to
48       permissive process types, but the AVC (SELinux  denials)  messages  are
49       still generated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       staff_sudo policy is extremely flexible and has several  booleans  that
55       allow you to manipulate the policy and run staff_sudo with the tightest
56       access possible.
57
58
59
60       If you want to allow users to resolve user passwd entries directly from
61       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
62       gin_nsswitch_use_ldap boolean. Disabled by default.
63
64       setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68       If you want to allow users to login using a yubikey OTP server or chal‐
69       lenge  response  mode,  you must turn on the authlogin_yubikey boolean.
70       Disabled by default.
71
72       setsebool -P authlogin_yubikey 1
73
74
75
76       If you want to deny any process from ptracing or  debugging  any  other
77       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
78       default.
79
80       setsebool -P deny_ptrace 1
81
82
83
84       If you want to allow any process  to  mmap  any  file  on  system  with
85       attribute  file_type,  you must turn on the domain_can_mmap_files bool‐
86       ean. Enabled by default.
87
88       setsebool -P domain_can_mmap_files 1
89
90
91
92       If you want to allow all domains write to kmsg_device, while kernel  is
93       executed  with  systemd.log_target=kmsg parameter, you must turn on the
94       domain_can_write_kmsg boolean. Disabled by default.
95
96       setsebool -P domain_can_write_kmsg 1
97
98
99
100       If you want to allow all domains to use other domains file descriptors,
101       you must turn on the domain_fd_use boolean. Enabled by default.
102
103       setsebool -P domain_fd_use 1
104
105
106
107       If  you  want to allow all domains to have the kernel load modules, you
108       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
109       default.
110
111       setsebool -P domain_kernel_load_modules 1
112
113
114
115       If you want to allow all domains to execute in fips_mode, you must turn
116       on the fips_mode boolean. Enabled by default.
117
118       setsebool -P fips_mode 1
119
120
121
122       If you want to enable reading of urandom for all domains, you must turn
123       on the global_ssp boolean. Disabled by default.
124
125       setsebool -P global_ssp 1
126
127
128
129       If  you  want  to allow confined applications to run with kerberos, you
130       must turn on the kerberos_enabled boolean. Enabled by default.
131
132       setsebool -P kerberos_enabled 1
133
134
135
136       If you want to allow system to run with  NIS,  you  must  turn  on  the
137       nis_enabled boolean. Disabled by default.
138
139       setsebool -P nis_enabled 1
140
141
142
143       If  you  want to allow confined applications to use nscd shared memory,
144       you must turn on the nscd_use_shm boolean. Disabled by default.
145
146       setsebool -P nscd_use_shm 1
147
148
149
150       If you want to support ecryptfs home directories, you must turn on  the
151       use_ecryptfs_home_dirs boolean. Disabled by default.
152
153       setsebool -P use_ecryptfs_home_dirs 1
154
155
156
157       If  you  want  to support fusefs home directories, you must turn on the
158       use_fusefs_home_dirs boolean. Disabled by default.
159
160       setsebool -P use_fusefs_home_dirs 1
161
162
163
164       If you want to support NFS home  directories,  you  must  turn  on  the
165       use_nfs_home_dirs boolean. Disabled by default.
166
167       setsebool -P use_nfs_home_dirs 1
168
169
170
171       If  you  want  to  support SAMBA home directories, you must turn on the
172       use_samba_home_dirs boolean. Disabled by default.
173
174       setsebool -P use_samba_home_dirs 1
175
176
177

MANAGED FILES

179       The SELinux process type staff_sudo_t can manage files labeled with the
180       following file types.  The paths listed are the default paths for these
181       file types.  Note the processes UID still need to have DAC permissions.
182
183       auth_home_t
184
185            /root/.yubico(/.*)?
186            /root/.google_authenticator
187            /root/.google_authenticator~
188            /home/[^/]+/.yubico(/.*)?
189            /home/[^/]+/.google_authenticator
190            /home/[^/]+/.google_authenticator~
191
192       cifs_t
193
194
195       ecryptfs_t
196
197            /home/[^/]+/.Private(/.*)?
198            /home/[^/]+/.ecryptfs(/.*)?
199
200       faillog_t
201
202            /var/log/btmp.*
203            /var/log/faillog.*
204            /var/log/tallylog.*
205            /var/run/faillock(/.*)?
206
207       fusefs_t
208
209            /var/run/user/[^/]*/gvfs
210
211       initrc_var_run_t
212
213            /var/run/utmp
214            /var/run/random-seed
215            /var/run/runlevel.dir
216            /var/run/setmixer_flag
217
218       krb5_host_rcache_t
219
220            /var/cache/krb5rcache(/.*)?
221            /var/tmp/nfs_0
222            /var/tmp/DNS_25
223            /var/tmp/host_0
224            /var/tmp/imap_0
225            /var/tmp/HTTP_23
226            /var/tmp/HTTP_48
227            /var/tmp/ldap_55
228            /var/tmp/ldap_487
229            /var/tmp/ldapmap1_0
230
231       nfs_t
232
233
234       pam_var_run_t
235
236            /var/(db|adm)/sudo(/.*)?
237            /var/run/sudo(/.*)?
238            /var/lib/sudo(/.*)?
239            /var/run/sepermit(/.*)?
240            /var/run/pam_mount(/.*)?
241
242       security_t
243
244            /selinux
245
246       staff_sudo_tmp_t
247
248
249       sudo_db_t
250
251            /var/db/sudo(/.*)?
252
253       sudo_log_t
254
255            /var/log/sudo-io(/.*)?
256
257       user_home_t
258
259            /home/[^/]+/.+
260
261       user_tmp_t
262
263            /dev/shm/mono.*
264            /var/run/user(/.*)?
265            /tmp/.X11-unix(/.*)?
266            /tmp/.ICE-unix(/.*)?
267            /dev/shm/pulse-shm.*
268            /tmp/.X0-lock
269            /tmp/hsperfdata_root
270            /var/tmp/hsperfdata_root
271            /home/[^/]+/tmp
272            /home/[^/]+/.tmp
273            /tmp/gconfd-[^/]+
274
275

COMMANDS

277       semanage fcontext can also be used to manipulate default  file  context
278       mappings.
279
280       semanage  permissive  can  also  be used to manipulate whether or not a
281       process type is permissive.
282
283       semanage module can also be used to enable/disable/install/remove  pol‐
284       icy modules.
285
286       semanage boolean can also be used to manipulate the booleans
287
288
289       system-config-selinux is a GUI tool available to customize SELinux pol‐
290       icy settings.
291
292

AUTHOR

294       This manual page was auto-generated using sepolicy manpage .
295
296