1sandbox_xserver_selinux(8S)ELinux Policy sandbox_xservesrandbox_xserver_selinux(8)
2
3
4

NAME

6       sandbox_xserver_selinux  - Security Enhanced Linux Policy for the sand‐
7       box_xserver processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the sandbox_xserver processes via flex‐
11       ible mandatory access control.
12
13       The   sandbox_xserver  processes  execute  with  the  sandbox_xserver_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep sandbox_xserver_t
20
21
22

ENTRYPOINTS

24       The   sandbox_xserver_t   SELinux   type   can   be   entered  via  the
25       xserver_exec_t file type.
26
27       The default entrypoint paths for the sandbox_xserver_t domain  are  the
28       following:
29
30       /usr/bin/nvidia.*,    /usr/bin/Xair,    /usr/bin/Xorg,   /usr/bin/Xvnc,
31       /usr/bin/Xephyr,           /usr/bin/x11vnc,           /usr/X11R6/bin/X,
32       /usr/X11R6/bin/Xorg,    /usr/X11R6/bin/Xipaq,    /usr/libexec/Xorg.bin,
33       /usr/X11R6/bin/XFree86,  /usr/libexec/Xorg.wrap,  /usr/X11R6/bin/Xwrap‐
34       per, /usr/libexec/gsd-backlight-helper
35

PROCESS TYPES

37       SELinux defines process types (domains) for each process running on the
38       system
39
40       You can see the context of a process using the -Z option to ps
41
42       Policy governs the access confined processes have  to  files.   SELinux
43       sandbox_xserver  policy  is very flexible allowing users to setup their
44       sandbox_xserver processes in as secure a method as possible.
45
46       The following process types are defined for sandbox_xserver:
47
48       sandbox_xserver_t
49
50       Note: semanage permissive -a sandbox_xserver_t can be used to make  the
51       process type sandbox_xserver_t permissive. SELinux does not deny access
52       to permissive process types, but the AVC (SELinux denials) messages are
53       still generated.
54
55

BOOLEANS

57       SELinux  policy  is customizable based on least access required.  sand‐
58       box_xserver policy is extremely flexible and has several booleans  that
59       allow  you  to  manipulate  the policy and run sandbox_xserver with the
60       tightest access possible.
61
62
63
64       If you want to allow users to resolve user passwd entries directly from
65       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
66       gin_nsswitch_use_ldap boolean. Disabled by default.
67
68       setsebool -P authlogin_nsswitch_use_ldap 1
69
70
71
72       If you want to deny user domains applications to map a memory region as
73       both  executable  and  writable,  this  is dangerous and the executable
74       should be reported in bugzilla, you must turn on the deny_execmem bool‐
75       ean. Enabled by default.
76
77       setsebool -P deny_execmem 1
78
79
80
81       If you want to allow all domains to execute in fips_mode, you must turn
82       on the fips_mode boolean. Enabled by default.
83
84       setsebool -P fips_mode 1
85
86
87
88       If you want to allow confined applications to run  with  kerberos,  you
89       must turn on the kerberos_enabled boolean. Disabled by default.
90
91       setsebool -P kerberos_enabled 1
92
93
94
95       If  you  want  to  allow  system  to run with NIS, you must turn on the
96       nis_enabled boolean. Disabled by default.
97
98       setsebool -P nis_enabled 1
99
100
101
102       If you want to allow confined applications to use nscd  shared  memory,
103       you must turn on the nscd_use_shm boolean. Disabled by default.
104
105       setsebool -P nscd_use_shm 1
106
107
108
109       If  you  want to allow regular users direct dri device access, you must
110       turn  on  the  selinuxuser_direct_dri_enabled  boolean.   Disabled   by
111       default.
112
113       setsebool -P selinuxuser_direct_dri_enabled 1
114
115
116
117       If  you  want  to support fusefs home directories, you must turn on the
118       use_fusefs_home_dirs boolean. Disabled by default.
119
120       setsebool -P use_fusefs_home_dirs 1
121
122
123
124       If you want to support NFS home  directories,  you  must  turn  on  the
125       use_nfs_home_dirs boolean. Enabled by default.
126
127       setsebool -P use_nfs_home_dirs 1
128
129
130
131       If  you  want  to  support SAMBA home directories, you must turn on the
132       use_samba_home_dirs boolean. Disabled by default.
133
134       setsebool -P use_samba_home_dirs 1
135
136
137
138       If you want to allows clients to write to the X  server  shared  memory
139       segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
140       abled by default.
141
142       setsebool -P xserver_clients_write_xshm 1
143
144
145

MANAGED FILES

147       The SELinux process type sandbox_xserver_t  can  manage  files  labeled
148       with  the following file types.  The paths listed are the default paths
149       for these file types.  Note the processes UID still need  to  have  DAC
150       permissions.
151
152       sandbox_file_t
153
154
155       sandbox_xserver_tmpfs_t
156
157
158       security_t
159
160            /selinux
161
162       user_fonts_cache_t
163
164            /root/.fontconfig(/.*)?
165            /root/.fonts/auto(/.*)?
166            /root/.fonts.cache-.*
167            /root/.cache/fontconfig(/.*)?
168            /home/[^/]+/.fontconfig(/.*)?
169            /home/[^/]+/.fonts/auto(/.*)?
170            /home/[^/]+/.fonts.cache-.*
171            /home/[^/]+/.cache/fontconfig(/.*)?
172
173       user_tmp_t
174
175            /dev/shm/mono.*
176            /var/run/user(/.*)?
177            /tmp/.ICE-unix(/.*)?
178            /tmp/.X11-unix(/.*)?
179            /dev/shm/pulse-shm.*
180            /tmp/.X0-lock
181            /tmp/hsperfdata_root
182            /var/tmp/hsperfdata_root
183            /home/[^/]+/tmp
184            /home/[^/]+/.tmp
185            /tmp/gconfd-[^/]+
186
187       xserver_tmpfs_t
188
189
190

COMMANDS

192       semanage  fcontext  can also be used to manipulate default file context
193       mappings.
194
195       semanage permissive can also be used to manipulate  whether  or  not  a
196       process type is permissive.
197
198       semanage  module can also be used to enable/disable/install/remove pol‐
199       icy modules.
200
201       semanage boolean can also be used to manipulate the booleans
202
203
204       system-config-selinux is a GUI tool available to customize SELinux pol‐
205       icy settings.
206
207

AUTHOR

209       This manual page was auto-generated using sepolicy manpage .
210
211

SEE ALSO

213       selinux(8),  sandbox_xserver(8),  semanage(8), restorecon(8), chcon(1),
214       sepolicy(8), setsebool(8)
215
216
217
218sandbox_xserver                    19-12-02         sandbox_xserver_selinux(8)
Impressum