xdm_selinux(8)

1xdm_selinux(8)                SELinux Policy xdm                xdm_selinux(8)
2
3
4

NAME

6       xdm_selinux - Security Enhanced Linux Policy for the xdm processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the xdm processes via flexible manda‐
10       tory access control.
11
12       The xdm processes execute with the xdm_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep xdm_t
19
20
21

ENTRYPOINTS

23       The xdm_t SELinux type can be entered via the xdm_exec_t file type.
24
25       The default entrypoint paths for the xdm_t domain are the following:
26
27       /usr/s?bin/nodm,        /usr/s?bin/gdm(3)?,        /usr/s?bin/lightdm*,
28       /usr/s?bin/[mxgkw]dm, /usr/s?bin/gdm-binary, /usr/s?bin/lxdm(-binary)?,
29       /usr/X11R6/bin/[xgkw]dm,   /usr/bin/razor-lightdm-.*,    /usr/bin/sddm,
30       /usr/bin/slim,   /usr/bin/gpe-dm,   /opt/kde3/bin/kdm,   /usr/sbin/mdm-
31       binary,       /usr/bin/sddm-greeter,       /etc/rc.d/init.d/x11-common,
32       /usr/libexec/gdm-disable-wayland
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       xdm policy is very flexible allowing users to setup their xdm processes
42       in as secure a method as possible.
43
44       The following process types are defined for xdm:
45
46       xdm_t, xdm_unconfined_t
47
48       Note: semanage permissive -a xdm_t can be used to make the process type
49       xdm_t  permissive.  SELinux  does not deny access to permissive process
50       types, but the AVC (SELinux denials) messages are still generated.
51
52

BOOLEANS

54       SELinux policy is customizable based on  least  access  required.   xdm
55       policy is extremely flexible and has several booleans that allow you to
56       manipulate the policy and run xdm with the tightest access possible.
57
58
59
60       If you want to allows xdm_t to bind on vnc_port_t(5910), you must  turn
61       on the xdm_bind_vnc_tcp_port boolean. Disabled by default.
62
63       setsebool -P xdm_bind_vnc_tcp_port 1
64
65
66
67       If you want to allow the graphical login program to execute bootloader,
68       you must turn on the xdm_exec_bootloader boolean. Disabled by default.
69
70       setsebool -P xdm_exec_bootloader 1
71
72
73
74       If you want to allow the graphical login program to login  directly  as
75       sysadm_r:sysadm_t,  you must turn on the xdm_sysadm_login boolean. Dis‐
76       abled by default.
77
78       setsebool -P xdm_sysadm_login 1
79
80
81
82       If you want to allow the graphical login program  to  create  files  in
83       HOME  dirs  as xdm_home_t, you must turn on the xdm_write_home boolean.
84       Disabled by default.
85
86       setsebool -P xdm_write_home 1
87
88
89
90       If you want to allow users to resolve user passwd entries directly from
91       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
92       gin_nsswitch_use_ldap boolean. Disabled by default.
93
94       setsebool -P authlogin_nsswitch_use_ldap 1
95
96
97
98       If you want to deny user domains applications to map a memory region as
99       both  executable  and  writable,  this  is dangerous and the executable
100       should be reported in bugzilla, you must turn on the deny_execmem bool‐
101       ean. Enabled by default.
102
103       setsebool -P deny_execmem 1
104
105
106
107       If  you  want  to deny any process from ptracing or debugging any other
108       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
109       default.
110
111       setsebool -P deny_ptrace 1
112
113
114
115       If you want to allow all domains to execute in fips_mode, you must turn
116       on the fips_mode boolean. Enabled by default.
117
118       setsebool -P fips_mode 1
119
120
121
122       If you want to allow confined applications to run  with  kerberos,  you
123       must turn on the kerberos_enabled boolean. Enabled by default.
124
125       setsebool -P kerberos_enabled 1
126
127
128
129       If  you  want  to  allow  system  to run with NIS, you must turn on the
130       nis_enabled boolean. Disabled by default.
131
132       setsebool -P nis_enabled 1
133
134
135
136       If you want to allow confined applications to use nscd  shared  memory,
137       you must turn on the nscd_use_shm boolean. Disabled by default.
138
139       setsebool -P nscd_use_shm 1
140
141
142
143       If you want to enable polyinstantiated directory support, you must turn
144       on the polyinstantiation_enabled boolean. Disabled by default.
145
146       setsebool -P polyinstantiation_enabled 1
147
148
149
150       If you want to allow unconfined executables to make  their  stack  exe‐
151       cutable.   This  should  never, ever be necessary. Probably indicates a
152       badly coded executable, but could indicate an attack.  This  executable
153       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
154       stack boolean. Enabled by default.
155
156       setsebool -P selinuxuser_execstack 1
157
158
159
160       If you want to support ecryptfs home directories, you must turn on  the
161       use_ecryptfs_home_dirs boolean. Disabled by default.
162
163       setsebool -P use_ecryptfs_home_dirs 1
164
165
166
167       If  you  want  to support fusefs home directories, you must turn on the
168       use_fusefs_home_dirs boolean. Disabled by default.
169
170       setsebool -P use_fusefs_home_dirs 1
171
172
173
174       If you want to support NFS home  directories,  you  must  turn  on  the
175       use_nfs_home_dirs boolean. Disabled by default.
176
177       setsebool -P use_nfs_home_dirs 1
178
179
180
181       If  you  want  to  support SAMBA home directories, you must turn on the
182       use_samba_home_dirs boolean. Disabled by default.
183
184       setsebool -P use_samba_home_dirs 1
185
186
187

PORT TYPES

189       SELinux defines port types to represent TCP and UDP ports.
190
191       You can see the types associated with a port  by  using  the  following
192       command:
193
194       semanage port -l
195
196
197       Policy  governs  the  access  confined  processes  have to these ports.
198       SELinux xdm policy is very flexible allowing users to setup  their  xdm
199       processes in as secure a method as possible.
200
201       The following port types are defined for xdm:
202
203
204       xdmcp_port_t
205
206
207
208       Default Defined Ports:
209                 tcp 177
210                 udp 177
211

MANAGED FILES

213       The  SELinux  process type xdm_t can manage files labeled with the fol‐
214       lowing file types.  The paths listed are the default  paths  for  these
215       file types.  Note the processes UID still need to have DAC permissions.
216
217       anon_inodefs_t
218
219
220       auth_cache_t
221
222            /var/cache/coolkey(/.*)?
223
224       auth_home_t
225
226            /root/.yubico(/.*)?
227            /root/.google_authenticator
228            /root/.google_authenticator~
229            /home/[^/]+/.yubico(/.*)?
230            /home/[^/]+/.google_authenticator
231            /home/[^/]+/.google_authenticator~
232
233       cgroup_t
234
235            /sys/fs/cgroup
236
237       cifs_t
238
239
240       dosfs_t
241
242
243       ecryptfs_t
244
245            /home/[^/]+/.Private(/.*)?
246            /home/[^/]+/.ecryptfs(/.*)?
247
248       etc_runtime_t
249
250            /[^/]+
251            /etc/mtab.*
252            /etc/blkid(/.*)?
253            /etc/nologin.*
254            /etc/.fstab.hal..+
255            /halt
256            /fastboot
257            /poweroff
258            /.autofsck
259            /etc/cmtab
260            /forcefsck
261            /.suspended
262            /fsckoptions
263            /.autorelabel
264            /etc/.updated
265            /var/.updated
266            /etc/killpower
267            /etc/nohotplug
268            /etc/securetty
269            /etc/ioctl.save
270            /etc/fstab.REVOKE
271            /etc/network/ifstate
272            /etc/sysconfig/hwconf
273            /etc/ptal/ptal-printd-like
274            /etc/sysconfig/iptables.save
275            /etc/xorg.conf.d/00-system-setup-keyboard.conf
276            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
277
278       faillog_t
279
280            /var/log/btmp.*
281            /var/log/faillog.*
282            /var/log/tallylog.*
283            /var/run/faillock(/.*)?
284
285       fonts_cache_t
286
287            /var/cache/fontconfig(/.*)?
288            /usr/lib/fontconfig/cache(/.*)?
289
290       fusefs_t
291
292            /var/run/user/[^/]*/gvfs
293
294       gconf_home_t
295
296            /root/.local.*
297            /root/.gconf(d)?(/.*)?
298            /home/[^/]+/.local.*
299            /home/[^/]+/.gconf(d)?(/.*)?
300
301       gnome_home_type
302
303
304       initrc_var_run_t
305
306            /var/run/utmp
307            /var/run/random-seed
308            /var/run/runlevel.dir
309            /var/run/setmixer_flag
310
311       kdbusfs_t
312
313
314       krb5_host_rcache_t
315
316            /var/cache/krb5rcache(/.*)?
317            /var/tmp/nfs_0
318            /var/tmp/DNS_25
319            /var/tmp/host_0
320            /var/tmp/imap_0
321            /var/tmp/HTTP_23
322            /var/tmp/HTTP_48
323            /var/tmp/ldap_55
324            /var/tmp/ldap_487
325            /var/tmp/ldapmap1_0
326
327       lastlog_t
328
329            /var/log/lastlog.*
330
331       locale_t
332
333            /etc/locale.conf
334            /etc/vconsole.conf
335            /usr/lib/locale(/.*)?
336            /usr/share/locale(/.*)?
337            /usr/share/zoneinfo(/.*)?
338            /usr/share/X11/locale(/.*)?
339            /etc/timezone
340            /etc/localtime
341            /etc/sysconfig/clock
342            /etc/avahi/etc/localtime
343            /var/empty/sshd/etc/localtime
344            /var/named/chroot/etc/localtime
345            /var/spool/postfix/etc/localtime
346
347       nfs_t
348
349
350       pam_var_console_t
351
352            /var/run/console(/.*)?
353
354       pam_var_run_t
355
356            /var/(db|adm)/sudo(/.*)?
357            /var/lib/sudo(/.*)?
358            /var/run/sudo(/.*)?
359            /var/run/motd.d(/.*)?
360            /var/run/sepermit(/.*)?
361            /var/run/pam_mount(/.*)?
362            /var/run/motd
363
364       security_t
365
366            /selinux
367
368       sysfs_t
369
370            /sys(/.*)?
371
372       systemd_passwd_var_run_t
373
374            /var/run/systemd/ask-password(/.*)?
375            /var/run/systemd/ask-password-block(/.*)?
376
377       user_fonts_t
378
379            /root/.fonts(/.*)?
380            /tmp/.font-unix(/.*)?
381            /home/[^/]+/.fonts(/.*)?
382            /home/[^/]+/.local/share/fonts(/.*)?
383
384       user_tmp_t
385
386            /dev/shm/mono.*
387            /var/run/user(/.*)?
388            /tmp/.ICE-unix(/.*)?
389            /tmp/.X11-unix(/.*)?
390            /dev/shm/pulse-shm.*
391            /tmp/.X0-lock
392            /tmp/hsperfdata_root
393            /var/tmp/hsperfdata_root
394            /home/[^/]+/tmp
395            /home/[^/]+/.tmp
396            /tmp/gconfd-[^/]+
397
398       user_tmp_type
399
400            all user tmp files
401
402       var_auth_t
403
404            /var/ace(/.*)?
405            /var/rsa(/.*)?
406            /var/lib/abl(/.*)?
407            /var/lib/rsa(/.*)?
408            /var/lib/pam_ssh(/.*)?
409            /var/run/pam_ssh(/.*)?
410            /var/lib/pam_shield(/.*)?
411            /var/opt/quest/vas/vasd(/.*)?
412            /var/lib/google-authenticator(/.*)?
413
414       wtmp_t
415
416            /var/log/wtmp.*
417
418       xauth_home_t
419
420            /root/.Xauth.*
421            /root/.xauth.*
422            /root/.Xauthority.*
423            /root/.serverauth.*
424            /var/lib/pqsql/.xauth.*
425            /var/lib/pqsql/.Xauthority.*
426            /var/lib/nxserver/home/.xauth.*
427            /var/lib/nxserver/home/.Xauthority.*
428            /home/[^/]+/.Xauth.*
429            /home/[^/]+/.xauth.*
430            /home/[^/]+/.Xauthority.*
431            /home/[^/]+/.serverauth.*
432
433       xdm_home_t
434
435            /root/.dmrc.*
436            /root/.wayland-errors.*
437            /root/.xsession-errors.*
438            /home/[^/]+/.dmrc.*
439            /home/[^/]+/.cache/gdm(/.*)?
440            /home/[^/]+/.wayland-errors.*
441            /home/[^/]+/.xsession-errors.*
442            /home/[^/]+/.local/share/xorg(/.*)?
443
444       xdm_lock_t
445
446
447       xdm_log_t
448
449            /var/log/[mkwx]dm.log.*
450            /var/log/mdm(/.*)?
451            /var/log/lxdm.log.*
452            /var/log/slim.log.*
453
454       xdm_rw_etc_t
455
456            /etc/X11/wdm(/.*)?
457            /etc/opt/VirtualGL(/.*)?
458
459       xdm_spool_t
460
461            /var/spool/[mg]dm(/.*)?
462
463       xdm_tmpfs_t
464
465
466       xdm_var_lib_t
467
468            /var/lib/[mxkwg]dm(/.*)?
469            /var/cache/[mg]dm(/.*)?
470            /var/lib/gdm(3)?(/.*)?
471            /var/lib/lxdm(/.*)?
472            /var/lib/sddm(/.*)?
473            /var/lib/lightdm(/.*)?
474            /var/cache/lightdm(/.*)?
475            /var/lib/lightdm-data(/.*)?
476
477       xdm_var_run_t
478
479            /etc/kde[34]?/kdm/backgroundrc
480            /var/run/[kgm]dm(/.*)?
481            /var/run/gdm(3)?.pid
482            /var/run/gdm(3)?(/.*)?
483            /usr/lib/qt-.*/etc/settings(/.*)?
484            /var/run/slim.*
485            /var/run/lxdm(/.*)?
486            /var/run/sddm(/.*)?
487            /var/run/xauth(/.*)?
488            /var/run/xdmctl(/.*)?
489            /var/run/lightdm(/.*)?
490            /var/run/systemd/multi-session-x(/.*)?
491            /var/run/xdm.pid
492            /var/run/lxdm.pid
493            /var/run/lxdm.auth
494            /var/run/gdm_socket
495
496       xkb_var_lib_t
497
498            /var/lib/xkb(/.*)?
499            /usr/X11R6/lib/X11/xkb/.*
500            /usr/X11R6/lib/X11/xkb
501
502       xserver_log_t
503
504            /var/[xgkw]dm(/.*)?
505            /usr/var/[xgkw]dm(/.*)?
506            /var/log/gdm(3)?(/.*)?
507            /var/log/Xorg.*
508            /var/log/XFree86.*
509            /var/log/lightdm(/.*)?
510            /var/log/nvidia-installer.log.*
511
512       xserver_tmpfs_t
513
514
515

FILE CONTEXTS

517       SELinux requires files to have an extended attribute to define the file
518       type.
519
520       You can see the context of a file using the -Z option to ls
521
522       Policy governs the access  confined  processes  have  to  these  files.
523       SELinux  xdm  policy is very flexible allowing users to setup their xdm
524       processes in as secure a method as possible.
525
526       EQUIVALENCE DIRECTORIES
527
528
529       xdm policy stores data with multiple different file context types under
530       the /var/lib/lightdm directory.  If you would like to store the data in
531       a different directory you can use the semanage  command  to  create  an
532       equivalence  mapping.   If you wanted to store this data under the /srv
533       dirctory you would execute the following command:
534
535       semanage fcontext -a -e /var/lib/lightdm /srv/lightdm
536       restorecon -R -v /srv/lightdm
537
538       xdm policy stores data with multiple different file context types under
539       the /var/run/gdm(3)? directory.  If you would like to store the data in
540       a different directory you can use the semanage  command  to  create  an
541       equivalence  mapping.   If you wanted to store this data under the /srv
542       dirctory you would execute the following command:
543
544       semanage fcontext -a -e /var/run/gdm(3)? /srv/gdm(3)?
545       restorecon -R -v /srv/gdm(3)?
546
547       xdm policy stores data with multiple different file context types under
548       the  /var/run/lxdm directory.  If you would like to store the data in a
549       different directory you can use  the  semanage  command  to  create  an
550       equivalence  mapping.   If you wanted to store this data under the /srv
551       dirctory you would execute the following command:
552
553       semanage fcontext -a -e /var/run/lxdm /srv/lxdm
554       restorecon -R -v /srv/lxdm
555
556       STANDARD FILE CONTEXT
557
558       SELinux defines the file context types for the xdm, if  you  wanted  to
559       store  files  with  these types in a diffent paths, you need to execute
560       the semanage command  to  sepecify  alternate  labeling  and  then  use
561       restorecon to put the labels on disk.
562
563       semanage fcontext -a -t xdm_log_t '/srv/myxdm_content(/.*)?'
564       restorecon -R -v /srv/myxdm_content
565
566       Note:  SELinux  often  uses  regular expressions to specify labels that
567       match multiple files.
568
569       The following file types are defined for xdm:
570
571
572
573       xdm_etc_t
574
575       - Set files with the xdm_etc_t type, if you want to store xdm files  in
576       the /etc directories.
577
578
579
580       xdm_exec_t
581
582       - Set files with the xdm_exec_t type, if you want to transition an exe‐
583       cutable to the xdm_t domain.
584
585
586       Paths:
587            /usr/s?bin/nodm,     /usr/s?bin/gdm(3)?,      /usr/s?bin/lightdm*,
588            /usr/s?bin/[mxgkw]dm,                       /usr/s?bin/gdm-binary,
589            /usr/s?bin/lxdm(-binary)?,                /usr/X11R6/bin/[xgkw]dm,
590            /usr/bin/razor-lightdm-.*,      /usr/bin/sddm,      /usr/bin/slim,
591            /usr/bin/gpe-dm,     /opt/kde3/bin/kdm,      /usr/sbin/mdm-binary,
592            /usr/bin/sddm-greeter,                /etc/rc.d/init.d/x11-common,
593            /usr/libexec/gdm-disable-wayland
594
595
596       xdm_home_t
597
598       - Set files with the xdm_home_t type, if you want to store xdm files in
599       the users home directory.
600
601
602       Paths:
603            /root/.dmrc.*,  /root/.wayland-errors.*, /root/.xsession-errors.*,
604            /home/[^/]+/.dmrc.*,                 /home/[^/]+/.cache/gdm(/.*)?,
605            /home/[^/]+/.wayland-errors.*,     /home/[^/]+/.xsession-errors.*,
606            /home/[^/]+/.local/share/xorg(/.*)?
607
608
609       xdm_lock_t
610
611       - Set files with the xdm_lock_t type, if you want to treat the files as
612       xdm lock data, stored under the /var/lock directory
613
614
615
616       xdm_log_t
617
618       -  Set  files with the xdm_log_t type, if you want to treat the data as
619       xdm log data, usually stored under the /var/log directory.
620
621
622       Paths:
623            /var/log/[mkwx]dm.log.*, /var/log/mdm(/.*)?,  /var/log/lxdm.log.*,
624            /var/log/slim.log.*
625
626
627       xdm_rw_etc_t
628
629       -  Set  files  with  the xdm_rw_etc_t type, if you want to store xdm rw
630       files in the /etc directories.
631
632
633       Paths:
634            /etc/X11/wdm(/.*)?, /etc/opt/VirtualGL(/.*)?
635
636
637       xdm_spool_t
638
639       - Set files with the xdm_spool_t type, if you want  to  store  the  xdm
640       files under the /var/spool directory.
641
642
643
644       xdm_tmpfs_t
645
646       -  Set  files with the xdm_tmpfs_t type, if you want to store xdm files
647       on a tmpfs file system.
648
649
650
651       xdm_unconfined_exec_t
652
653       - Set files with the xdm_unconfined_exec_t type, if you want to transi‐
654       tion an executable to the xdm_unconfined_t domain.
655
656
657       Paths:
658            /etc/[mg]dm/Init(/.*)?,               /etc/[mg]dm/PostLogin(/.*)?,
659            /etc/[mg]dm/PreSession(/.*)?, /etc/[mg]dm/PostSession(/.*)?
660
661
662       xdm_var_lib_t
663
664       - Set files with the xdm_var_lib_t type, if you want to store  the  xdm
665       files under the /var/lib directory.
666
667
668       Paths:
669            /var/lib/[mxkwg]dm(/.*)?,                 /var/cache/[mg]dm(/.*)?,
670            /var/lib/gdm(3)?(/.*)?, /var/lib/lxdm(/.*)?,  /var/lib/sddm(/.*)?,
671            /var/lib/lightdm(/.*)?,                  /var/cache/lightdm(/.*)?,
672            /var/lib/lightdm-data(/.*)?
673
674
675       xdm_var_run_t
676
677       - Set files with the xdm_var_run_t type, if you want to store  the  xdm
678       files under the /run or /var/run directory.
679
680
681       Paths:
682            /etc/kde[34]?/kdm/backgroundrc,            /var/run/[kgm]dm(/.*)?,
683            /var/run/gdm(3)?.pid,                      /var/run/gdm(3)?(/.*)?,
684            /usr/lib/qt-.*/etc/settings(/.*)?,                /var/run/slim.*,
685            /var/run/lxdm(/.*)?,  /var/run/sddm(/.*)?,   /var/run/xauth(/.*)?,
686            /var/run/xdmctl(/.*)?,    /var/run/lightdm(/.*)?,    /var/run/sys‐
687            temd/multi-session-x(/.*)?,  /var/run/xdm.pid,  /var/run/lxdm.pid,
688            /var/run/lxdm.auth, /var/run/gdm_socket
689
690
691       Note:  File context can be temporarily modified with the chcon command.
692       If you want to permanently change the file context you need to use  the
693       semanage fcontext command.  This will modify the SELinux labeling data‐
694       base.  You will need to use restorecon to apply the labels.
695
696

COMMANDS

698       semanage fcontext can also be used to manipulate default  file  context
699       mappings.
700
701       semanage  permissive  can  also  be used to manipulate whether or not a
702       process type is permissive.
703
704       semanage module can also be used to enable/disable/install/remove  pol‐
705       icy modules.
706
707       semanage port can also be used to manipulate the port definitions
708
709       semanage boolean can also be used to manipulate the booleans
710
711
712       system-config-selinux is a GUI tool available to customize SELinux pol‐
713       icy settings.
714
715

AUTHOR

717       This manual page was auto-generated using sepolicy manpage .
718
719