1initrc_selinux(8) SELinux Policy initrc initrc_selinux(8)
2
6 initrc_selinux - Security Enhanced Linux Policy for the initrc pro‐
7 cesses
8
10 Security-Enhanced Linux secures the initrc processes via flexible
11 mandatory access control.
12 The initrc processes execute with the initrc_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep initrc_t
20
24 The initrc_t SELinux type can be entered via the openct_initrc_exec_t,
25 smsd_initrc_exec_t, cfengine_initrc_exec_t, zabbix_initrc_exec_t,
26 pcp_pmcd_initrc_exec_t, rpcbind_initrc_exec_t, dnsmasq_initrc_exec_t,
27 mysqlmanagerd_initrc_exec_t, pcp_pmproxy_initrc_exec_t, rpcd_ini‐
28 trc_exec_t, shell_exec_t, dspam_initrc_exec_t, acct_initrc_exec_t,
29 gpsd_initrc_exec_t, tgtd_initrc_exec_t, cpuplug_initrc_exec_t,
30 abrt_initrc_exec_t, glance_scrubber_initrc_exec_t, qpidd_initrc_exec_t,
31 mysqld_initrc_exec_t, cluster_initrc_exec_t, foghorn_initrc_exec_t,
32 glusterd_initrc_exec_t, wdmd_initrc_exec_t, openhpid_initrc_exec_t,
33 kdump_initrc_exec_t, sslh_initrc_exec_t, auditd_initrc_exec_t, lld‐
34 pad_initrc_exec_t, ciped_initrc_exec_t, tor_initrc_exec_t, postfix_ini‐
35 trc_exec_t, pppd_initrc_exec_t, syslogd_initrc_exec_t, ntop_ini‐
36 trc_exec_t, svnserve_initrc_exec_t, cyphesis_initrc_exec_t, virt‐
37 logd_initrc_exec_t, rhsmcertd_initrc_exec_t, bluetooth_initrc_exec_t,
38 certmaster_initrc_exec_t, rabbitmq_initrc_exec_t, canna_initrc_exec_t,
39 rngd_initrc_exec_t, sendmail_initrc_exec_t, ipsec_initrc_exec_t,
40 apcupsd_initrc_exec_t, automount_initrc_exec_t, denyhosts_ini‐
41 trc_exec_t, pingd_initrc_exec_t, saslauthd_initrc_exec_t, couchdb_ini‐
42 trc_exec_t, arpwatch_initrc_exec_t, postgrey_initrc_exec_t, nscd_ini‐
43 trc_exec_t, spamd_initrc_exec_t, varnishlog_initrc_exec_t, slpd_ini‐
44 trc_exec_t, sysstat_initrc_exec_t, snort_initrc_exec_t, openvpn_ini‐
45 trc_exec_t, puppetmaster_initrc_exec_t, pcp_pmlogger_initrc_exec_t,
46 cvs_initrc_exec_t, roundup_initrc_exec_t, pcp_pmie_initrc_exec_t,
47 cupsd_initrc_exec_t, cobblerd_initrc_exec_t, pads_initrc_exec_t,
48 smokeping_initrc_exec_t, cgconfig_initrc_exec_t, sensord_initrc_exec_t,
49 dhcpd_initrc_exec_t, keystone_initrc_exec_t, zoneminder_initrc_exec_t,
50 ypbind_initrc_exec_t, drbd_initrc_exec_t, entropyd_initrc_exec_t, ajax‐
51 term_initrc_exec_t, uuidd_initrc_exec_t, httpd_initrc_exec_t, bitl‐
52 bee_initrc_exec_t, piranha_pulse_initrc_exec_t, ctdbd_initrc_exec_t,
53 portreserve_initrc_exec_t, minissdpd_initrc_exec_t, cyrus_ini‐
54 trc_exec_t, bcfg2_initrc_exec_t, portmap_initrc_exec_t, pcp_plugin_ini‐
55 trc_exec_t, ksmtuned_initrc_exec_t, neutron_initrc_exec_t, dictd_ini‐
56 trc_exec_t, asterisk_initrc_exec_t, minidlna_initrc_exec_t,
57 antivirus_initrc_exec_t, watchdog_initrc_exec_t, aiccu_initrc_exec_t,
58 varnishd_initrc_exec_t, likewise_initrc_exec_t, psad_initrc_exec_t,
59 kismet_initrc_exec_t, iwhd_initrc_exec_t, vdagentd_initrc_exec_t,
60 shorewall_initrc_exec_t, radvd_initrc_exec_t, blkmapd_initrc_exec_t,
61 fail2ban_initrc_exec_t, snmpd_initrc_exec_t, radiusd_initrc_exec_t,
62 ntpd_initrc_exec_t, named_initrc_exec_t, cgred_initrc_exec_t, puppeta‐
63 gent_initrc_exec_t, l2tpd_initrc_exec_t, soundd_initrc_exec_t,
64 virtd_initrc_exec_t, afs_initrc_exec_t, conntrackd_initrc_exec_t,
65 lircd_initrc_exec_t, slapd_initrc_exec_t, mdadm_initrc_exec_t,
66 pcscd_initrc_exec_t, rhnsd_initrc_exec_t, postgresql_initrc_exec_t,
67 vnstatd_initrc_exec_t, polipo_initrc_exec_t, callweaver_initrc_exec_t,
68 ddclient_initrc_exec_t, tuned_initrc_exec_t, amtu_initrc_exec_t, zab‐
69 bix_agent_initrc_exec_t, vhostmd_initrc_exec_t, mcelog_initrc_exec_t,
70 hddtemp_initrc_exec_t, nis_initrc_exec_t, crond_initrc_exec_t,
71 exim_initrc_exec_t, innd_initrc_exec_t, sanlock_initrc_exec_t, dlm_con‐
72 trold_initrc_exec_t, iodined_initrc_exec_t, sshd_initrc_exec_t, ice‐
73 cast_initrc_exec_t, collectd_initrc_exec_t, pcp_pmwebd_initrc_exec_t,
74 pki_tps_script_exec_t, uucpd_initrc_exec_t, mscan_initrc_exec_t, hyper‐
75 vkvp_initrc_exec_t, irqbalance_initrc_exec_t, chronyd_initrc_exec_t,
76 boinc_initrc_exec_t, naemon_initrc_exec_t, pki_ra_script_exec_t, con‐
77 dor_initrc_exec_t, sblim_initrc_exec_t, osad_initrc_exec_t, bin_t,
78 dovecot_initrc_exec_t, rwho_initrc_exec_t, fcoemon_initrc_exec_t,
79 nfsd_initrc_exec_t, gpm_initrc_exec_t, mpd_initrc_exec_t, kerberos_ini‐
80 trc_exec_t, munin_initrc_exec_t, fsdaemon_initrc_exec_t, tcsd_ini‐
81 trc_exec_t, squid_initrc_exec_t, pkcs_slotd_initrc_exec_t, rtkit_dae‐
82 mon_initrc_exec_t, apmd_initrc_exec_t, fetchmail_initrc_exec_t,
83 pcp_pmmgr_initrc_exec_t, NetworkManager_initrc_exec_t, cmirrord_ini‐
84 trc_exec_t, glance_api_initrc_exec_t, sssd_initrc_exec_t, samba_ini‐
85 trc_exec_t, bacula_initrc_exec_t, ulogd_initrc_exec_t, ccs_ini‐
86 trc_exec_t, ricci_initrc_exec_t, setrans_initrc_exec_t, nslcd_ini‐
87 trc_exec_t, prelude_initrc_exec_t, iptables_initrc_exec_t, ora‐
88 cleasm_initrc_exec_t, mon_statd_initrc_exec_t, gdomap_initrc_exec_t,
89 zebra_initrc_exec_t, redis_initrc_exec_t, dhcpc_helper_exec_t, mon‐
90 god_initrc_exec_t, usr_t, ftpd_initrc_exec_t, isnsd_initrc_exec_t,
91 privoxy_initrc_exec_t, firewalld_initrc_exec_t, mrtg_initrc_exec_t,
92 certmonger_initrc_exec_t, jabberd_initrc_exec_t, clvmd_initrc_exec_t,
93 glance_registry_initrc_exec_t, avahi_initrc_exec_t, memcached_ini‐
94 trc_exec_t, initrc_exec_t, nagios_initrc_exec_t file types.
95 The default entrypoint paths for the initrc_t domain are the following:
97 All executeables with the default executable label, usually stored in
99 /usr/bin and /usr/sbin. /etc/rc.d/init.d/openct,
100 /etc/rc.d/init.d/smsd, /etc/rc.d/init.d/((cf-serverd)|(cf-moni‐
101 tord)|(cf-execd)), /etc/rc.d/init.d/(zabbix|zabbix-server),
102 /etc/rc.d/init.d/pmcd, /etc/rc.d/init.d/rpcbind, /etc/rc.d/init.d/dns‐
103 masq, /etc/rc.d/init.d/mysqlmanager, /etc/rc.d/init.d/pmproxy,
104 /etc/rc.d/init.d/nfslock, /etc/rc.d/init.d/rpcidmapd, /bin/d?ash,
105 /bin/ksh.*, /bin/zsh.*, /usr/bin/d?ash, /usr/bin/ksh.*, /usr/bin/zsh.*,
106 /bin/esh, /bin/bash, /bin/fish, /bin/mksh, /bin/sash, /bin/tcsh,
107 /bin/yash, /bin/bash2, /usr/bin/esh, /sbin/nologin, /usr/bin/bash,
108 /usr/bin/fish, /usr/bin/mksh, /usr/bin/sash, /usr/bin/tcsh,
109 /usr/bin/yash, /usr/bin/bash2, /usr/sbin/sesh, /usr/sbin/smrsh,
110 /usr/bin/scponly, /usr/libexec/sesh, /usr/sbin/nologin, /usr/bin/git-
111 shell, /usr/sbin/scponlyc, /usr/libexec/sudo/sesh, /usr/bin/cockpit-
112 bridge, /usr/libexec/cockpit-agent, /usr/libexec/git-core/git-shell,
113 /etc/rc.d/init.d/dspam, /etc/rc.d/init.d/psacct, /etc/rc.d/init.d/gpsd,
114 /etc/rc.d/init.d/tgtd, /etc/rc.d/init.d/cpuplugd,
115 /etc/rc.d/init.d/abrt, /etc/rc.d/init.d/openstack-glance-scrubber,
116 /etc/rc.d/init.d/qpidd, /etc/rc.d/init.d/mysqld, /etc/rc.d/init.d/ope‐
117 nais, /etc/rc.d/init.d/corosync, /etc/rc.d/init.d/cpglockd,
118 /etc/rc.d/init.d/heartbeat, /etc/rc.d/init.d/pacemaker,
119 /etc/rc.d/init.d/rgmanager, /etc/rc.d/init.d/gluster.*, /usr/sbin/glus‐
120 terd, /etc/rc.d/init.d/wdmd, /etc/rc.d/init.d/openhpid,
121 /etc/rc.d/init.d/kdump, /etc/rc.d/init.d/sslh, /etc/rc.d/init.d/auditd,
122 /etc/rc.d/init.d/lldpad, /etc/rc.d/init.d/ciped.*,
123 /etc/rc.d/init.d/tor, /etc/rc.d/init.d/postfix,
124 /etc/ppp/(auth|ip(v6|x)?)-(up|down), /etc/rc.d/init.d/ppp,
125 /etc/rc.d/init.d/rsyslog, /etc/rc.d/init.d/ntop,
126 /etc/rc.d/init.d/svnserve, /etc/rc.d/init.d/cyphesis,
127 /etc/rc.d/init.d/virtlogd, /etc/rc.d/init.d/rhsmcertd,
128 /etc/rc.d/init.d/dund, /etc/rc.d/init.d/pand, /etc/rc.d/init.d/blue‐
129 tooth, /etc/rc.d/init.d/certmaster, /etc/rc.d/init.d/rabbitmq-server,
130 /etc/rc.d/init.d/canna, /etc/rc.d/init.d/rngd, /etc/rc.d/init.d/send‐
131 mail, /etc/rc.d/init.d/ipsec, /etc/rc.d/init.d/racoon,
132 /etc/rc.d/init.d/strongswan, /etc/rc.d/init.d/apcupsd,
133 /etc/rc.d/init.d/autofs, /etc/rc.d/init.d/denyhosts,
134 /etc/rc.d/init.d/whatsup-pingd, /etc/rc.d/init.d/sasl,
135 /etc/rc.d/init.d/couchdb, /etc/rc.d/init.d/arpwatch,
136 /etc/rc.d/init.d/postgrey, /etc/rc.d/init.d/nscd,
137 /etc/rc.d/init.d/mimedefang.*, /etc/rc.d/init.d/spamd,
138 /etc/rc.d/init.d/pyzord, /etc/rc.d/init.d/spampd, /etc/rc.d/init.d/var‐
139 nishlog, /etc/rc.d/init.d/varnishncsa, /etc/rc.d/init.d/slpd,
140 /etc/rc.d/init.d/sysstat, /etc/rc.d/init.d/snortd,
141 /etc/rc.d/init.d/openvpn, /etc/rc.d/init.d/puppetmaster,
142 /etc/rc.d/init.d/pmlogger, /etc/rc.d/init.d/cvs,
143 /etc/rc.d/init.d/roundup, /etc/rc.d/init.d/pmie, /etc/rc.d/init.d/cups,
144 /etc/rc.d/init.d/cobblerd, /etc/rc.d/init.d/pads,
145 /etc/rc.d/init.d/smokeping, /etc/rc.d/init.d/cgconfig,
146 /etc/rc.d/init.d/sensord, /etc/rc.d/init.d/dhcpd(6)?,
147 /etc/rc.d/init.d/dhcrelay(6)?, /etc/rc.d/init.d/openstack-keystone,
148 /etc/rc.d/init.d/zoneminder, /etc/rc.d/init.d/ypbind,
149 /etc/rc.d/init.d/drbd, /etc/rc.d/init.d/((audio-entropyd)|(haveged)),
150 /etc/rc.d/init.d/ajaxterm, /etc/rc.d/init.d/uuidd, /etc/init.d/chero‐
151 kee, /etc/rc.d/init.d/httpd, /etc/rc.d/init.d/lighttpd,
152 /etc/rc.d/init.d/bitlbee, /etc/rc.d/init.d/pulse,
153 /etc/rc.d/init.d/ctdb, /etc/rc.d/init.d/portreserve,
154 /etc/rc.d/init.d/minissdpd, /etc/rc.d/init.d/cyrus.*,
155 /etc/rc.d/init.d/bcfg2-server, /etc/rc.d/init.d/portmap,
156 /etc/rc.d/init.d/ksmtuned, /etc/rc.d/init.d/neutron.*,
157 /etc/rc.d/init.d/quantum.*, /etc/rc.d/init.d/dictd,
158 /etc/rc.d/init.d/asterisk, /etc/rc.d/init.d/minidlna,
159 /etc/rc.d/init.d/clamd.*, /etc/rc.d/init.d/amavis,
160 /etc/rc.d/init.d/amavisd-snmp, /etc/rc.d/init.d/watchdog,
161 /etc/rc.d/init.d/aiccu, /etc/rc.d/init.d/varnish,
162 /etc/rc.d/init.d/lwiod, /etc/rc.d/init.d/lwsmd,
163 /etc/rc.d/init.d/lsassd, /etc/rc.d/init.d/lwregd,
164 /etc/rc.d/init.d/dcerpcd, /etc/rc.d/init.d/srvsvcd,
165 /etc/rc.d/init.d/likewise, /etc/rc.d/init.d/eventlogd,
166 /etc/rc.d/init.d/netlogond, /etc/rc.d/init.d/psad,
167 /etc/rc.d/init.d/kismet.*, /etc/rc.d/init.d/iwhd,
168 /etc/rc.d/init.d/spice-vdagentd, /etc/rc.d/init.d/shorewall.*,
169 /etc/rc.d/init.d/radvd, /etc/rc.d/init.d/blkmapd,
170 /etc/rc.d/init.d/fail2ban, /etc/rc.d/init.d/(snmpd|snmptrapd),
171 /etc/rc.d/init.d/radiusd, /etc/rc.d/init.d/ntpd,
172 /etc/rc.d/init.d/named, /etc/rc.d/init.d/unbound,
173 /etc/rc.d/init.d/named-sdb, /etc/rc.d/init.d/cgred,
174 /etc/rc.d/init.d/puppet, /etc/rc.d/init.d/.*l2tpd,
175 /etc/rc.d/init.d/nasd, /etc/rc.d/init.d/libvirtd,
176 /etc/rc.d/init.d/(open)?afs, /etc/rc.d/init.d/openafs-client,
177 /etc/rc.d/init.d/lirc, /etc/rc.d/init.d/slapd, /etc/rc.d/init.d/mdmoni‐
178 tor, /etc/rc.d/init.d/pcscd, /etc/rc.d/init.d/rhnsd,
179 /etc/rc.d/init.d/(se)?postgresql, /etc/rc.d/init.d/vnstat,
180 /etc/rc.d/init.d/polipo, /etc/rc.d/init.d/callweaver,
181 /etc/rc.d/init.d/ddclient, /etc/rc.d/init.d/tuned,
182 /etc/rc.d/init.d/amtu, /etc/rc.d/init.d/zabbix-agentd,
183 /etc/rc.d/init.d/vhostmd, /etc/rc.d/init.d/mcelog,
184 /etc/rc.d/init.d/hddtemp, /etc/rc.d/init.d/ypserv,
185 /etc/rc.d/init.d/ypxfrd, /etc/rc.d/init.d/yppasswd,
186 /etc/rc.d/init.d/atd, /etc/rc.d/init.d/exim, /etc/rc.d/init.d/innd,
187 /etc/rc.d/init.d/sanlock, /etc/rc.d/init.d/((iodined)|(iodine-server)),
188 /etc/rc.d/init.d/sshd, /etc/rc.d/init.d/icecast, /etc/rc.d/init.d/col‐
189 lectd, /etc/rc.d/init.d/pmwebd, /etc/rc.d/init.d/uucp,
190 /etc/rc.d/init.d/MailScanner, /etc/rc.d/init.d/hypervkvpd,
191 /etc/rc.d/init.d/irqbalance, /etc/rc.d/init.d/chronyd,
192 /etc/rc.d/init.d/boinc-client, /etc/rc.d/init.d/naemon,
193 /etc/rc.d/init.d/condor, /etc/rc.d/init.d/gatherer,
194 /etc/rc.d/init.d/sblim-sfcbd, /etc/rc.d/init.d/osad,
195 /etc/rc.d/init.d/dovecot, /etc/rc.d/init.d/rwhod,
196 /etc/rc.d/init.d/fcoe, /etc/rc.d/init.d/nfs, /etc/rc.d/init.d/gpm,
197 /etc/rc.d/init.d/mpd, /etc/rc.d/init.d/kprop, /etc/rc.d/init.d/kadmind,
198 /etc/rc.d/init.d/krb524d, /etc/rc.d/init.d/krb5kdc,
199 /etc/rc.d/init.d/munin-node, /etc/rc.d/init.d/(smartd|smartmontools),
200 /etc/rc.d/init.d/(tcsd|trousers), /etc/rc.d/init.d/squid,
201 /etc/rc.d/init.d/pkcsslotd, /etc/rc.d/init.d/rtkit-daemon,
202 /etc/rc.d/init.d/acpid, /etc/rc.d/init.d/fetchmail,
203 /etc/rc.d/init.d/pmmgr, /etc/NetworkManager/dispatcher.d(/.*)?,
204 /etc/rc.d/init.d/wicd, /etc/rc.d/init.d/cmirrord,
205 /etc/rc.d/init.d/openstack-glance-api, /etc/rc.d/init.d/sssd,
206 /etc/rc.d/init.d/nmb, /etc/rc.d/init.d/smb, /etc/rc.d/init.d/winbind,
207 /etc/rc.d/init.d/bacula.*, /etc/rc.d/init.d/ulogd,
208 /etc/rc.d/init.d/((ccs)|(ccsd)), /etc/rc.d/init.d/ricci,
209 /etc/rc.d/init.d/mcstrans, /etc/rc.d/init.d/nslcd,
210 /etc/rc.d/init.d/prelude-lml, /etc/rc.d/init.d/prelude-manager,
211 /etc/rc.d/init.d/prelude-correlator, /etc/rc.d/init.d/ip6?tables,
212 /etc/rc.d/init.d/ebtables, /etc/rc.d/init.d/nftables,
213 /etc/rc.d/init.d/oracleasm, /etc/rc.d/init.d/mon_statd,
214 /etc/rc.d/init.d/gdomap, /etc/rc.d/init.d/bgpd, /etc/rc.d/init.d/ripd,
215 /etc/rc.d/init.d/isisd, /etc/rc.d/init.d/ospfd, /etc/rc.d/init.d/zebra,
216 /etc/rc.d/init.d/babeld, /etc/rc.d/init.d/ospf6d, /etc/rc.d/init.d/rip‐
217 ngd, /etc/rc.d/init.d/redis, /etc/firestarter/firestarter.sh,
218 /etc/rc.d/init.d/mongod, /etc/rc.d/init.d/mongos, /opt/.*, /usr/.*,
219 /emul/.*, /export(/.*)?, /ostree(/.*)?, /usr/doc(/.*)?/lib(/.*)?,
220 /usr/inclu.e(/.*)?, /usr/share/rpm(/.*)?,
221 /usr/share/doc(/.*)?/README.*, /usr/lib/modules(/.*)/vmlinuz,
222 /usr/lib/modules(/.*)/initramfs.img, /usr/lib/sysimage(/.*)?,
223 /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul, /etc/rc.d/init.d/vsftpd,
224 /etc/rc.d/init.d/proftpd, /etc/rc.d/init.d/isnsd,
225 /etc/rc.d/init.d/privoxy, /etc/rc.d/init.d/firewalld,
226 /etc/rc.d/init.d/mrtg, /etc/rc.d/init.d/certmonger,
227 /etc/rc.d/init.d/jabberd, /etc/rc.d/init.d/openstack-glance-registry,
228 /etc/rc.d/init.d/avahi.*, /etc/rc.d/init.d/memcached, /etc/init.d/.*,
229 /etc/rc.d/rc.[^/]+, /etc/rc.d/init.d/.*, /opt/nfast/sbin/init.d-nci‐
230 pher, /usr/libexec/dcc/stop-.*, /usr/libexec/dcc/start-.*,
231 /usr/lib/systemd/fedora[^/]*, /opt/nfast/scripts/init.d/(.*),
232 /etc/rc.d/rc, /etc/X11/prefdm, /usr/sbin/startx, /usr/bin/sepg_ctl,
233 /usr/sbin/start-dirsrv, /usr/sbin/open_init_pty, /usr/sbin/restart-
234 dirsrv, /etc/sysconfig/network-scripts/ifup-ipsec, /usr/share/system-
235 config-services/system-config-services-mechanism.py,
236 /etc/rc.d/init.d/nrpe, /etc/rc.d/init.d/nagios
237
239 SELinux defines process types (domains) for each process running on the
240 system
241 You can see the context of a process using the -Z option to ps
243 Policy governs the access confined processes have to files. SELinux
245 initrc policy is very flexible allowing users to setup their initrc
246 processes in as secure a method as possible.
247 The following process types are defined for initrc:
249 initrc_t
251 Note: semanage permissive -a initrc_t can be used to make the process
253 type initrc_t permissive. SELinux does not deny access to permissive
254 process types, but the AVC (SELinux denials) messages are still gener‐
255 ated.
256
259 SELinux policy is customizable based on least access required. initrc
260 policy is extremely flexible and has several booleans that allow you to
261 manipulate the policy and run initrc with the tightest access possible.
262 If you want to allow users to resolve user passwd entries directly from
266 ldap rather then using a sssd server, you must turn on the authlo‐
267 gin_nsswitch_use_ldap boolean. Disabled by default.
268 setsebool -P authlogin_nsswitch_use_ldap 1
270 If you want to deny user domains applications to map a memory region as
274 both executable and writable, this is dangerous and the executable
275 should be reported in bugzilla, you must turn on the deny_execmem bool‐
276 ean. Enabled by default.
277 setsebool -P deny_execmem 1
279 If you want to allow all domains to execute in fips_mode, you must turn
283 on the fips_mode boolean. Enabled by default.
284 setsebool -P fips_mode 1
286 If you want to allow confined applications to run with kerberos, you
290 must turn on the kerberos_enabled boolean. Enabled by default.
291 setsebool -P kerberos_enabled 1
293 If you want to control the ability to mmap a low area of the address
297 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
298 the mmap_low_allowed boolean. Disabled by default.
299 setsebool -P mmap_low_allowed 1
301 If you want to allow system to run with NIS, you must turn on the
305 nis_enabled boolean. Disabled by default.
306 setsebool -P nis_enabled 1
308 If you want to allow confined applications to use nscd shared memory,
312 you must turn on the nscd_use_shm boolean. Disabled by default.
313 setsebool -P nscd_use_shm 1
315 If you want to disable kernel module loading, you must turn on the
319 secure_mode_insmod boolean. Enabled by default.
320 setsebool -P secure_mode_insmod 1
322 If you want to allow unconfined executables to make their heap memory
326 executable. Doing this is a really bad idea. Probably indicates a
327 badly coded executable, but could indicate an attack. This executable
328 should be reported in bugzilla, you must turn on the selin‐
329 uxuser_execheap boolean. Disabled by default.
330 setsebool -P selinuxuser_execheap 1
332 If you want to allow unconfined executables to make their stack exe‐
336 cutable. This should never, ever be necessary. Probably indicates a
337 badly coded executable, but could indicate an attack. This executable
338 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
339 stack boolean. Enabled by default.
340 setsebool -P selinuxuser_execstack 1
342
346 The SELinux process type initrc_t can manage files labeled with the
347 following file types. The paths listed are the default paths for these
348 file types. Note the processes UID still need to have DAC permissions.
349 file_type
351 all files on the system
353
356 SELinux requires files to have an extended attribute to define the file
357 type.
358 You can see the context of a file using the -Z option to ls
360 Policy governs the access confined processes have to these files.
362 SELinux initrc policy is very flexible allowing users to setup their
363 initrc processes in as secure a method as possible.
364 STANDARD FILE CONTEXT
366 SELinux defines the file context types for the initrc, if you wanted to
368 store files with these types in a diffent paths, you need to execute
369 the semanage command to sepecify alternate labeling and then use
370 restorecon to put the labels on disk.
371 semanage fcontext -a -t initrc_var_run_t '/srv/myinitrc_content(/.*)?'
373 restorecon -R -v /srv/myinitrc_content
374 Note: SELinux often uses regular expressions to specify labels that
376 match multiple files.
377 The following file types are defined for initrc:
379 initrc_devpts_t
383 - Set files with the initrc_devpts_t type, if you want to treat the
385 files as initrc devpts data.
386 initrc_exec_t
390 - Set files with the initrc_exec_t type, if you want to transition an
392 executable to the initrc_t domain.
393 Paths:
396 /etc/init.d/.*, /etc/rc.d/rc.[^/]+, /etc/rc.d/init.d/.*,
397 /opt/nfast/sbin/init.d-ncipher, /usr/libexec/dcc/stop-.*,
398 /usr/libexec/dcc/start-.*, /usr/lib/systemd/fedora[^/]*,
399 /opt/nfast/scripts/init.d/(.*), /etc/rc.d/rc, /etc/X11/prefdm,
400 /usr/sbin/startx, /usr/bin/sepg_ctl, /usr/sbin/start-dirsrv,
401 /usr/sbin/open_init_pty, /usr/sbin/restart-dirsrv, /etc/syscon‐
402 fig/network-scripts/ifup-ipsec, /usr/share/system-config-ser‐
403 vices/system-config-services-mechanism.py
404 initrc_state_t
407 - Set files with the initrc_state_t type, if you want to treat the
409 files as initrc state data.
410 initrc_tmp_t
414 - Set files with the initrc_tmp_t type, if you want to store initrc
416 temporary files in the /tmp directories.
417 initrc_var_log_t
421 - Set files with the initrc_var_log_t type, if you want to treat the
423 data as initrc var log data, usually stored under the /var/log direc‐
424 tory.
425 initrc_var_run_t
429 - Set files with the initrc_var_run_t type, if you want to store the
431 initrc files under the /run or /var/run directory.
432 Paths:
435 /var/run/utmp, /var/run/random-seed, /var/run/runlevel.dir,
436 /var/run/setmixer_flag
437 Note: File context can be temporarily modified with the chcon command.
440 If you want to permanently change the file context you need to use the
441 semanage fcontext command. This will modify the SELinux labeling data‐
442 base. You will need to use restorecon to apply the labels.
443
446 semanage fcontext can also be used to manipulate default file context
447 mappings.
448 semanage permissive can also be used to manipulate whether or not a
450 process type is permissive.
451 semanage module can also be used to enable/disable/install/remove pol‐
453 icy modules.
454 semanage boolean can also be used to manipulate the booleans
456 system-config-selinux is a GUI tool available to customize SELinux pol‐
459 icy settings.
460
463 This manual page was auto-generated using sepolicy manpage .
464
467 selinux(8), initrc(8), semanage(8), restorecon(8), chcon(1), sepol‐
468 icy(8), setsebool(8)
469initrc 19-06-18 initrc_selinux(8)