1mozilla_selinux(8) SELinux Policy mozilla mozilla_selinux(8)
2
6 mozilla_selinux - Security Enhanced Linux Policy for the mozilla pro‐
7 cesses
8
10 Security-Enhanced Linux secures the mozilla processes via flexible
11 mandatory access control.
12 The mozilla processes execute with the mozilla_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep mozilla_t
20
24 The mozilla_t SELinux type can be entered via the mozilla_exec_t file
25 type.
26 The default entrypoint paths for the mozilla_t domain are the follow‐
28 ing:
29 /usr/lib/[^/]*firefox[^/]*/firefox, /usr/lib/[^/]*firefox[^/]*/firefox-
31 bin, /usr/lib/mozilla[^/]*/reg.+, /usr/lib/firefox[^/]*/mozilla-.*,
32 /usr/lib/mozilla[^/]*/mozilla-.*, /usr/bin/mozilla-[0-9].*,
33 /usr/lib/netscape/.+/communicator/communicator-smotif.real,
34 /usr/bin/mozilla-bin-[0-9].*, /usr/bin/mozilla, /usr/bin/epiphany,
35 /usr/bin/netscape, /usr/bin/epiphany-bin, /usr/lib/galeon/galeon,
36 /usr/bin/mozilla-snapshot, /usr/lib/netscape/base-4/wrapper
37
39 SELinux defines process types (domains) for each process running on the
40 system
41 You can see the context of a process using the -Z option to ps
43 Policy governs the access confined processes have to files. SELinux
45 mozilla policy is very flexible allowing users to setup their mozilla
46 processes in as secure a method as possible.
47 The following process types are defined for mozilla:
49 mozilla_t, mozilla_plugin_t, mozilla_plugin_config_t
51 Note: semanage permissive -a mozilla_t can be used to make the process
53 type mozilla_t permissive. SELinux does not deny access to permissive
54 process types, but the AVC (SELinux denials) messages are still gener‐
55 ated.
56
59 SELinux policy is customizable based on least access required. mozilla
60 policy is extremely flexible and has several booleans that allow you to
61 manipulate the policy and run mozilla with the tightest access possi‐
62 ble.
63 If you want to allow confined web browsers to read home directory con‐
67 tent, you must turn on the mozilla_read_content boolean. Disabled by
68 default.
69 setsebool -P mozilla_read_content 1
71 If you want to allow users to resolve user passwd entries directly from
75 ldap rather then using a sssd server, you must turn on the authlo‐
76 gin_nsswitch_use_ldap boolean. Disabled by default.
77 setsebool -P authlogin_nsswitch_use_ldap 1
79 If you want to deny user domains applications to map a memory region as
83 both executable and writable, this is dangerous and the executable
84 should be reported in bugzilla, you must turn on the deny_execmem bool‐
85 ean. Enabled by default.
86 setsebool -P deny_execmem 1
88 If you want to allow all domains to execute in fips_mode, you must turn
92 on the fips_mode boolean. Enabled by default.
93 setsebool -P fips_mode 1
95 If you want to allow confined applications to run with kerberos, you
99 must turn on the kerberos_enabled boolean. Disabled by default.
100 setsebool -P kerberos_enabled 1
102 If you want to allow system to run with NIS, you must turn on the
106 nis_enabled boolean. Disabled by default.
107 setsebool -P nis_enabled 1
109 If you want to allow confined applications to use nscd shared memory,
113 you must turn on the nscd_use_shm boolean. Disabled by default.
114 setsebool -P nscd_use_shm 1
116 If you want to allow regular users direct dri device access, you must
120 turn on the selinuxuser_direct_dri_enabled boolean. Disabled by
121 default.
122 setsebool -P selinuxuser_direct_dri_enabled 1
124 If you want to allow unconfined executables to make their stack exe‐
128 cutable. This should never, ever be necessary. Probably indicates a
129 badly coded executable, but could indicate an attack. This executable
130 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
131 stack boolean. Disabled by default.
132 setsebool -P selinuxuser_execstack 1
134 If you want to allows clients to write to the X server shared memory
138 segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
139 abled by default.
140 setsebool -P xserver_clients_write_xshm 1
142
146 The SELinux process type mozilla_t can manage files labeled with the
147 following file types. The paths listed are the default paths for these
148 file types. Note the processes UID still need to have DAC permissions.
149 cifs_t
151 ecryptfs_t
154 /home/[^/]+/.Private(/.*)?
156 /home/[^/]+/.ecryptfs(/.*)?
157 fusefs_t
159 /var/run/user/[^/]*/gvfs
161 gconf_home_t
163 /root/.local.*
165 /root/.gconf(d)?(/.*)?
166 /home/[^/]+/.local.*
167 /home/[^/]+/.gconf(d)?(/.*)?
168 gnome_home_type
170 mozilla_home_t
173 /home/[^/]+/.lyx(/.*)?
175 /home/[^/]+/.java(/.*)?
176 /home/[^/]+/.adobe(/.*)?
177 /home/[^/]+/.gnash(/.*)?
178 /home/[^/]+/.webex(/.*)?
179 /home/[^/]+/.IBMERS(/.*)?
180 /home/[^/]+/.galeon(/.*)?
181 /home/[^/]+/.spicec(/.*)?
182 /home/[^/]+/POkemon.*(/.*)?
183 /home/[^/]+/.icedtea(/.*)?
184 /home/[^/]+/.mozilla(/.*)?
185 /home/[^/]+/.phoenix(/.*)?
186 /home/[^/]+/.netscape(/.*)?
187 /home/[^/]+/.ICAClient(/.*)?
188 /home/[^/]+/.quakelive(/.*)?
189 /home/[^/]+/.macromedia(/.*)?
190 /home/[^/]+/.thunderbird(/.*)?
191 /home/[^/]+/.gcjwebplugin(/.*)?
192 /home/[^/]+/.grl-podcasts(/.*)?
193 /home/[^/]+/.cache/mozilla(/.*)?
194 /home/[^/]+/.icedteaplugin(/.*)?
195 /home/[^/]+/zimbrauserdata(/.*)?
196 /home/[^/]+/.juniper_networks(/.*)?
197 /home/[^/]+/.cache/icedtea-web(/.*)?
198 /home/[^/]+/abc
199 /home/[^/]+/mozilla.pdf
200 /home/[^/]+/.gnashpluginrc
201 mozilla_tmp_t
203 mozilla_tmpfs_t
206 nfs_t
209 pulseaudio_home_t
212 /root/.pulse(/.*)?
214 /root/.config/pulse(/.*)?
215 /root/.esd_auth
216 /root/.pulse-cookie
217 /home/[^/]+/.pulse(/.*)?
218 /home/[^/]+/.config/pulse(/.*)?
219 /home/[^/]+/.esd_auth
220 /home/[^/]+/.pulse-cookie
221 user_fonts_cache_t
223 /root/.fontconfig(/.*)?
225 /root/.fonts/auto(/.*)?
226 /root/.fonts.cache-.*
227 /root/.cache/fontconfig(/.*)?
228 /home/[^/]+/.fontconfig(/.*)?
229 /home/[^/]+/.fonts/auto(/.*)?
230 /home/[^/]+/.fonts.cache-.*
231 /home/[^/]+/.cache/fontconfig(/.*)?
232 xserver_tmpfs_t
234
238 SELinux requires files to have an extended attribute to define the file
239 type.
240 You can see the context of a file using the -Z option to ls
242 Policy governs the access confined processes have to these files.
244 SELinux mozilla policy is very flexible allowing users to setup their
245 mozilla processes in as secure a method as possible.
246 STANDARD FILE CONTEXT
248 SELinux defines the file context types for the mozilla, if you wanted
250 to store files with these types in a diffent paths, you need to execute
251 the semanage command to sepecify alternate labeling and then use
252 restorecon to put the labels on disk.
253 semanage fcontext -a -t mozilla_tmpfs_t '/srv/mymozilla_content(/.*)?'
255 restorecon -R -v /srv/mymozilla_content
256 Note: SELinux often uses regular expressions to specify labels that
258 match multiple files.
259 The following file types are defined for mozilla:
261 mozilla_conf_t
265 - Set files with the mozilla_conf_t type, if you want to treat the
267 files as mozilla configuration data, usually stored under the /etc
268 directory.
269 mozilla_exec_t
273 - Set files with the mozilla_exec_t type, if you want to transition an
275 executable to the mozilla_t domain.
276 Paths:
279 /usr/lib/[^/]*firefox[^/]*/firefox, /usr/lib/[^/]*fire‐
280 fox[^/]*/firefox-bin, /usr/lib/mozilla[^/]*/reg.+, /usr/lib/fire‐
281 fox[^/]*/mozilla-.*, /usr/lib/mozilla[^/]*/mozilla-.*,
282 /usr/bin/mozilla-[0-9].*, /usr/lib/netscape/.+/communicator/commu‐
283 nicator-smotif.real, /usr/bin/mozilla-bin-[0-9].*,
284 /usr/bin/mozilla, /usr/bin/epiphany, /usr/bin/netscape,
285 /usr/bin/epiphany-bin, /usr/lib/galeon/galeon, /usr/bin/mozilla-
286 snapshot, /usr/lib/netscape/base-4/wrapper
287 mozilla_home_t
290 - Set files with the mozilla_home_t type, if you want to store mozilla
292 files in the users home directory.
293 Paths:
296 /home/[^/]+/.lyx(/.*)?, /home/[^/]+/.java(/.*)?,
297 /home/[^/]+/.adobe(/.*)?, /home/[^/]+/.gnash(/.*)?,
298 /home/[^/]+/.webex(/.*)?, /home/[^/]+/.IBMERS(/.*)?,
299 /home/[^/]+/.galeon(/.*)?, /home/[^/]+/.spicec(/.*)?,
300 /home/[^/]+/POkemon.*(/.*)?, /home/[^/]+/.icedtea(/.*)?,
301 /home/[^/]+/.mozilla(/.*)?, /home/[^/]+/.phoenix(/.*)?,
302 /home/[^/]+/.netscape(/.*)?, /home/[^/]+/.ICAClient(/.*)?,
303 /home/[^/]+/.quakelive(/.*)?, /home/[^/]+/.macromedia(/.*)?,
304 /home/[^/]+/.thunderbird(/.*)?, /home/[^/]+/.gcjwebplugin(/.*)?,
305 /home/[^/]+/.grl-podcasts(/.*)?, /home/[^/]+/.cache/mozilla(/.*)?,
306 /home/[^/]+/.icedteaplugin(/.*)?, /home/[^/]+/zimbrauser‐
307 data(/.*)?, /home/[^/]+/.juniper_networks(/.*)?,
308 /home/[^/]+/.cache/icedtea-web(/.*)?, /home/[^/]+/abc,
309 /home/[^/]+/mozilla.pdf, /home/[^/]+/.gnashpluginrc
310 mozilla_plugin_config_exec_t
313 - Set files with the mozilla_plugin_config_exec_t type, if you want to
315 transition an executable to the mozilla_plugin_config_t domain.
316 mozilla_plugin_exec_t
320 - Set files with the mozilla_plugin_exec_t type, if you want to transi‐
322 tion an executable to the mozilla_plugin_t domain.
323 Paths:
326 /usr/lib/xulrunner[^/]*/plugin-container, /usr/lib/nspluginwrap‐
327 per/npviewer.bin, /usr/bin/nspluginscan, /usr/bin/nspluginviewer,
328 /usr/libexec/WebKitPluginProcess, /usr/lib/firefox/plugin-con‐
329 tainer
330 mozilla_plugin_rw_t
333 - Set files with the mozilla_plugin_rw_t type, if you want to treat the
335 files as mozilla plugin read/write content.
336 mozilla_plugin_tmp_t
340 - Set files with the mozilla_plugin_tmp_t type, if you want to store
342 mozilla plugin temporary files in the /tmp directories.
343 mozilla_plugin_tmpfs_t
347 - Set files with the mozilla_plugin_tmpfs_t type, if you want to store
349 mozilla plugin files on a tmpfs file system.
350 mozilla_tmp_t
354 - Set files with the mozilla_tmp_t type, if you want to store mozilla
356 temporary files in the /tmp directories.
357 mozilla_tmpfs_t
361 - Set files with the mozilla_tmpfs_t type, if you want to store mozilla
363 files on a tmpfs file system.
364 Note: File context can be temporarily modified with the chcon command.
368 If you want to permanently change the file context you need to use the
369 semanage fcontext command. This will modify the SELinux labeling data‐
370 base. You will need to use restorecon to apply the labels.
371
374 semanage fcontext can also be used to manipulate default file context
375 mappings.
376 semanage permissive can also be used to manipulate whether or not a
378 process type is permissive.
379 semanage module can also be used to enable/disable/install/remove pol‐
381 icy modules.
382 semanage boolean can also be used to manipulate the booleans
384 system-config-selinux is a GUI tool available to customize SELinux pol‐
387 icy settings.
388
391 This manual page was auto-generated using sepolicy manpage .
392
395 selinux(8), mozilla(8), semanage(8), restorecon(8), chcon(1), sepol‐
396 icy(8), setsebool(8), mozilla_plugin_selinux(8), mozilla_plug‐
397 in_selinux(8), mozilla_plugin_config_selinux(8), mozilla_plugin_con‐
398 fig_selinux(8)
399mozilla 19-12-02 mozilla_selinux(8)