prelink_selinux(8)

1prelink_selinux(8)          SELinux Policy prelink          prelink_selinux(8)
2
3
4

NAME

6       prelink_selinux  -  Security Enhanced Linux Policy for the prelink pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  prelink  processes  via  flexible
11       mandatory access control.
12
13       The  prelink processes execute with the prelink_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep prelink_t
20
21
22

ENTRYPOINTS

24       The  prelink_t  SELinux type can be entered via the prelink_exec_t file
25       type.
26
27       The default entrypoint paths for the prelink_t domain are  the  follow‐
28       ing:
29
30       /usr/sbin/prelink(.bin)?
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       prelink  policy  is very flexible allowing users to setup their prelink
40       processes in as secure a method as possible.
41
42       The following process types are defined for prelink:
43
44       prelink_t, prelink_cron_system_t
45
46       Note: semanage permissive -a prelink_t can be used to make the  process
47       type  prelink_t  permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux policy is customizable based on least access required.  prelink
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate  the  policy and run prelink with the tightest access possi‐
56       ble.
57
58
59
60       If you want to control the ability to mmap a low area  of  the  address
61       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
62       the mmap_low_allowed boolean. Disabled by default.
63
64       setsebool -P mmap_low_allowed 1
65
66
67
68       If you want to disable kernel module loading,  you  must  turn  on  the
69       secure_mode_insmod boolean. Enabled by default.
70
71       setsebool -P secure_mode_insmod 1
72
73
74

MANAGED FILES

76       The  SELinux  process  type prelink_t can manage files labeled with the
77       following file types.  The paths listed are the default paths for these
78       file types.  Note the processes UID still need to have DAC permissions.
79
80       file_type
81
82            all files on the system
83
84

FILE CONTEXTS

86       SELinux requires files to have an extended attribute to define the file
87       type.
88
89       You can see the context of a file using the -Z option to ls
90
91       Policy governs the access  confined  processes  have  to  these  files.
92       SELinux  prelink  policy is very flexible allowing users to setup their
93       prelink processes in as secure a method as possible.
94
95       EQUIVALENCE DIRECTORIES
96
97
98       prelink policy stores data with multiple different file  context  types
99       under  the  /var/log/prelink directory.  If you would like to store the
100       data in a different directory you can use the semanage command to  cre‐
101       ate an equivalence mapping.  If you wanted to store this data under the
102       /srv directory you would execute the following command:
103
104       semanage fcontext -a -e /var/log/prelink /srv/prelink
105       restorecon -R -v /srv/prelink
106
107       STANDARD FILE CONTEXT
108
109       SELinux defines the file context types for the prelink, if  you  wanted
110       to store files with these types in a diffent paths, you need to execute
111       the semanage command  to  sepecify  alternate  labeling  and  then  use
112       restorecon to put the labels on disk.
113
114       semanage   fcontext   -a   -t   prelink_var_lib_t  '/srv/myprelink_con‐
115       tent(/.*)?'
116       restorecon -R -v /srv/myprelink_content
117
118       Note: SELinux often uses regular expressions  to  specify  labels  that
119       match multiple files.
120
121       The following file types are defined for prelink:
122
123
124
125       prelink_cache_t
126
127       -  Set  files  with  the prelink_cache_t type, if you want to store the
128       files under the /var/cache directory.
129
130
131
132       prelink_cron_system_exec_t
133
134       - Set files with the prelink_cron_system_exec_t type, if  you  want  to
135       transition an executable to the prelink_cron_system_t domain.
136
137
138
139       prelink_exec_t
140
141       -  Set files with the prelink_exec_t type, if you want to transition an
142       executable to the prelink_t domain.
143
144
145
146       prelink_log_t
147
148       - Set files with the prelink_log_t type, if you want to treat the  data
149       as prelink log data, usually stored under the /var/log directory.
150
151
152       Paths:
153            /var/log/prelink(/.*)?, /var/log/prelink.log.*
154
155
156       prelink_tmp_t
157
158       -  Set  files with the prelink_tmp_t type, if you want to store prelink
159       temporary files in the /tmp directories.
160
161
162
163       prelink_tmpfs_t
164
165       - Set files with the prelink_tmpfs_t type, if you want to store prelink
166       files on a tmpfs file system.
167
168
169
170       prelink_var_lib_t
171
172       -  Set  files with the prelink_var_lib_t type, if you want to store the
173       prelink files under the /var/lib directory.
174
175
176       Paths:
177            /var/lib/prelink(/.*)?, /var/lib/misc/prelink.*
178
179
180       Note: File context can be temporarily modified with the chcon  command.
181       If  you want to permanently change the file context you need to use the
182       semanage fcontext command.  This will modify the SELinux labeling data‐
183       base.  You will need to use restorecon to apply the labels.
184
185

COMMANDS

187       semanage  fcontext  can also be used to manipulate default file context
188       mappings.
189
190       semanage permissive can also be used to manipulate  whether  or  not  a
191       process type is permissive.
192
193       semanage  module can also be used to enable/disable/install/remove pol‐
194       icy modules.
195
196       semanage boolean can also be used to manipulate the booleans
197
198
199       system-config-selinux is a GUI tool available to customize SELinux pol‐
200       icy settings.
201
202

AUTHOR

204       This manual page was auto-generated using sepolicy manpage .
205
206