1gpg_web_selinux(8) SELinux Policy gpg_web gpg_web_selinux(8)
2
6 gpg_web_selinux - Security Enhanced Linux Policy for the gpg_web pro‐
7 cesses
8
10 Security-Enhanced Linux secures the gpg_web processes via flexible
11 mandatory access control.
12 The gpg_web processes execute with the gpg_web_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep gpg_web_t
20
24 The gpg_web_t SELinux type can be entered via the gpg_exec_t file type.
25 The default entrypoint paths for the gpg_web_t domain are the follow‐
27 ing:
28 /usr/bin/gpg(2)?, /usr/lib/gnupg/.*, /usr/bin/gpgsm
30
32 SELinux defines process types (domains) for each process running on the
33 system
34 You can see the context of a process using the -Z option to ps
36 Policy governs the access confined processes have to files. SELinux
38 gpg_web policy is very flexible allowing users to setup their gpg_web
39 processes in as secure a method as possible.
40 The following process types are defined for gpg_web:
42 gpg_web_t
44 Note: semanage permissive -a gpg_web_t can be used to make the process
46 type gpg_web_t permissive. SELinux does not deny access to permissive
47 process types, but the AVC (SELinux denials) messages are still gener‐
48 ated.
49
52 SELinux policy is customizable based on least access required. gpg_web
53 policy is extremely flexible and has several booleans that allow you to
54 manipulate the policy and run gpg_web with the tightest access possi‐
55 ble.
56 If you want to allow all domains to execute in fips_mode, you must turn
60 on the fips_mode boolean. Enabled by default.
61 setsebool -P fips_mode 1
63 If you want to allow httpd cgi support, you must turn on the httpd_en‐
67 able_cgi boolean. Enabled by default.
68 setsebool -P httpd_enable_cgi 1
70 If you want to allow httpd to run gpg, you must turn on the
74 httpd_use_gpg boolean. Disabled by default.
75 setsebool -P httpd_use_gpg 1
77
81 The SELinux process type gpg_web_t can manage files labeled with the
82 following file types. The paths listed are the default paths for these
83 file types. Note the processes UID still need to have DAC permissions.
84 httpd_sys_rw_content_t
86 /etc/rt(/.*)?
88 /etc/glpi(/.*)?
89 /etc/horde(/.*)?
90 /etc/drupal.*
91 /etc/z-push(/.*)?
92 /var/lib/svn(/.*)?
93 /var/www/svn(/.*)?
94 /etc/owncloud(/.*)?
95 /var/www/html(/.*)?/uploads(/.*)?
96 /var/www/html(/.*)?/wp-content(/.*)?
97 /var/www/html(/.*)?/wp_backups(/.*)?
98 /var/www/html(/.*)?/sites/default/files(/.*)?
99 /var/www/html(/.*)?/sites/default/settings.php
100 /etc/mock/koji(/.*)?
101 /etc/nextcloud(/.*)?
102 /var/lib/drupal.*
103 /etc/zabbix/web(/.*)?
104 /var/lib/moodle(/.*)?
105 /var/log/z-push(/.*)?
106 /var/spool/gosa(/.*)?
107 /etc/WebCalendar(/.*)?
108 /usr/share/joomla(/.*)?
109 /var/lib/dokuwiki(/.*)?
110 /var/lib/httpd/md(/.*)?
111 /var/lib/owncloud(/.*)?
112 /var/spool/viewvc(/.*)?
113 /var/lib/nextcloud(/.*)?
114 /var/lib/pootle/po(/.*)?
115 /var/lib/phpMyAdmin(/.*)?
116 /var/www/moodledata(/.*)?
117 /srv/gallery2/smarty(/.*)?
118 /var/www/moodle/data(/.*)?
119 /var/lib/graphite-web(/.*)?
120 /var/log/shibboleth-www(/.*)?
121 /var/www/gallery/albums(/.*)?
122 /var/www/html/owncloud/data(/.*)?
123 /var/www/html/nextcloud/data(/.*)?
124 /usr/share/wordpress-mu/wp-content(/.*)?
125 /usr/share/wordpress/wp-content/upgrade(/.*)?
126 /usr/share/wordpress/wp-content/uploads(/.*)?
127 /var/www/html/configuration.php
128 public_content_rw_t
130 /var/spool/abrt-upload(/.*)?
132
135 If you want to share files with multiple domains (Apache, FTP, rsync,
136 Samba), you can set a file context of public_content_t and public_con‐
137 tent_rw_t. These context allow any of the above domains to read the
138 content. If you want a particular domain to write to the public_con‐
139 tent_rw_t domain, you must set the appropriate boolean.
140 Allow gpg_web servers to read the /var/gpg_web directory by adding the
142 public_content_t file type to the directory and by restoring the file
143 type.
144 semanage fcontext -a -t public_content_t "/var/gpg_web(/.*)?"
146 restorecon -F -R -v /var/gpg_web
147 Allow gpg_web servers to read and write /var/gpg_web/incoming by adding
149 the public_content_rw_t type to the directory and by restoring the file
150 type. You also need to turn on the gpg_web_anon_write boolean.
151 semanage fcontext -a -t public_content_rw_t "/var/gpg_web/incom‐
153 ing(/.*)?"
154 restorecon -F -R -v /var/gpg_web/incoming
155 setsebool -P gpg_web_anon_write 1
156 If you want to allow gpg web domain to modify public files used for
159 public file transfer services., you must turn on the gpg_web_anon_write
160 boolean.
161 setsebool -P gpg_web_anon_write 1
163
166 semanage fcontext can also be used to manipulate default file context
167 mappings.
168 semanage permissive can also be used to manipulate whether or not a
170 process type is permissive.
171 semanage module can also be used to enable/disable/install/remove pol‐
173 icy modules.
174 semanage boolean can also be used to manipulate the booleans
176 system-config-selinux is a GUI tool available to customize SELinux pol‐
179 icy settings.
180
183 This manual page was auto-generated using sepolicy manpage .
184
187 selinux(8), gpg_web(8), semanage(8), restorecon(8), chcon(1), sepol‐
188 icy(8), setsebool(8)
189gpg_web 23-12-15 gpg_web_selinux(8)