java_selinux(8)

1java_selinux(8)               SELinux Policy java              java_selinux(8)
2
3
4

NAME

6       java_selinux - Security Enhanced Linux Policy for the java processes
7

DESCRIPTION

9       Security-Enhanced  Linux secures the java processes via flexible manda‐
10       tory access control.
11
12       The java processes execute with the java_t SELinux type. You can  check
13       if  you  have  these processes running by executing the ps command with
14       the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep java_t
19
20
21

ENTRYPOINTS

23       The java_t SELinux type can be entered via the java_exec_t file type.
24
25       The default entrypoint paths for the java_t domain are the following:
26
27       /usr/(.*/)?bin/java.*,                        /opt/(.*/)?bin/java[^/]*,
28       /usr/lib(.*/)?bin/java[^/]*,  /usr/lib(64)?/eclipse/eclipse,  /opt/mat‐
29       lab.*/bin.*/MATLAB.*,                     /usr/matlab.*/bin.*/MATLAB.*,
30       /usr/Aptana[^/]*/AptanaStudio,      /opt/ibm/java.*/(bin|javaws)(/.*)?,
31       /usr/lib/opera(/.*)?/opera,                 /usr/lib/opera(/.*)?/works,
32       /usr/bin/octave-[^/]*,                  /usr/java/eclipse[^/]*/eclipse,
33       /usr/lib/jvm/java(.*/)bin(/.*)?,    /opt/local/matlab.*/bin.*/MATLAB.*,
34       /usr/local/matlab.*/bin.*/MATLAB.*,  /usr/lib64/jvm/java(.*/)bin(/.*)?,
35       /opt/ibm/lotus/Symphony/framework/rcp/eclipse/plugins(/.*)?,
36       /usr/bin/gij,    /usr/bin/frysk,    /usr/bin/grmic,   /usr/bin/fastjar,
37       /usr/bin/gkeytool,      /usr/bin/gcj-dbtool,       /usr/bin/gjarsigner,
38       /usr/bin/jv-convert, /usr/bin/grmiregistry, /usr/bin/gappletviewer
39

PROCESS TYPES

41       SELinux defines process types (domains) for each process running on the
42       system
43
44       You can see the context of a process using the -Z option to ps
45
46       Policy governs the access confined processes have  to  files.   SELinux
47       java  policy  is  very flexible allowing users to setup their java pro‐
48       cesses in as secure a method as possible.
49
50       The following process types are defined for java:
51
52       java_t
53
54       Note: semanage permissive -a java_t can be used  to  make  the  process
55       type  java_t  permissive.  SELinux  does  not deny access to permissive
56       process types, but the AVC (SELinux denials) messages are still  gener‐
57       ated.
58
59

BOOLEANS

61       SELinux  policy  is  customizable based on least access required.  java
62       policy is extremely flexible and has several booleans that allow you to
63       manipulate the policy and run java with the tightest access possible.
64
65
66
67       If you want to allow all domains to use other domains file descriptors,
68       you must turn on the allow_domain_fd_use boolean. Enabled by default.
69
70       setsebool -P allow_domain_fd_use 1
71
72
73
74       If you want to allow java  executable  stack,  you  must  turn  on  the
75       allow_java_execstack boolean. Disabled by default.
76
77       setsebool -P allow_java_execstack 1
78
79
80
81       If  you want to allow sysadm to debug or ptrace all processes, you must
82       turn on the allow_ptrace boolean. Disabled by default.
83
84       setsebool -P allow_ptrace 1
85
86
87
88       If you want to allows clients to write to the X  server  shared  memory
89       segments,  you  must  turn on the allow_write_xshm boolean. Disabled by
90       default.
91
92       setsebool -P allow_write_xshm 1
93
94
95
96       If you want to allow system to run with  NIS,  you  must  turn  on  the
97       allow_ypbind boolean. Disabled by default.
98
99       setsebool -P allow_ypbind 1
100
101
102
103       If  you  want to allow all domains to have the kernel load modules, you
104       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
105       default.
106
107       setsebool -P domain_kernel_load_modules 1
108
109
110
111       If you want to allow all domains to execute in fips_mode, you must turn
112       on the fips_mode boolean. Enabled by default.
113
114       setsebool -P fips_mode 1
115
116
117
118       If you want to enable reading of urandom for all domains, you must turn
119       on the global_ssp boolean. Disabled by default.
120
121       setsebool -P global_ssp 1
122
123
124
125       If  you  want  to  support  NFS  home directories, you must turn on the
126       use_nfs_home_dirs boolean. Disabled by default.
127
128       setsebool -P use_nfs_home_dirs 1
129
130
131
132       If you want to support SAMBA home directories, you  must  turn  on  the
133       use_samba_home_dirs boolean. Disabled by default.
134
135       setsebool -P use_samba_home_dirs 1
136
137
138
139       If you want to support X userspace object manager, you must turn on the
140       xserver_object_manager boolean. Disabled by default.
141
142       setsebool -P xserver_object_manager 1
143
144
145

MANAGED FILES

147       The SELinux process type java_t can manage files labeled with the  fol‐
148       lowing  file  types.   The paths listed are the default paths for these
149       file types.  Note the processes UID still need to have DAC permissions.
150
151       initrc_tmp_t
152
153
154       java_tmp_t
155
156
157       java_tmpfs_t
158
159
160       mnt_t
161
162            /mnt(/[^/]*)
163            /mnt(/[^/]*)?
164            /rhev(/[^/]*)?
165            /media(/[^/]*)
166            /media(/[^/]*)?
167            /etc/rhgb(/.*)?
168            /media/.hal-.*
169            /net
170            /afs
171            /rhev
172            /misc
173
174       tmp_t
175
176            /tmp
177            /usr/tmp
178            /var/tmp
179            /tmp-inst
180            /var/tmp-inst
181            /var/tmp/vi.recover
182
183       user_fonts_cache_t
184
185            /home/[^/]*/.fonts/auto(/.*)?
186            /home/[^/]*/.fontconfig(/.*)?
187            /home/[^/]*/.fonts.cache-.*
188            /home/staff/.fonts/auto(/.*)?
189            /home/staff/.fontconfig(/.*)?
190            /home/staff/.fonts.cache-.*
191
192       user_home_t
193
194            /home/[^/]*/.+
195            /home/staff/.+
196
197       xserver_tmpfs_t
198
199
200

FILE CONTEXTS

202       SELinux requires files to have an extended attribute to define the file
203       type.
204
205       You can see the context of a file using the -Z option to ls
206
207       Policy  governs  the  access  confined  processes  have to these files.
208       SELinux java policy is very flexible allowing users to setup their java
209       processes in as secure a method as possible.
210
211       STANDARD FILE CONTEXT
212
213       SELinux  defines  the file context types for the java, if you wanted to
214       store files with these types in a diffent paths, you  need  to  execute
215       the  semanage  command  to  sepecify  alternate  labeling  and then use
216       restorecon to put the labels on disk.
217
218       semanage fcontext -a -t java_tmpfs_t '/srv/myjava_content(/.*)?'
219       restorecon -R -v /srv/myjava_content
220
221       Note: SELinux often uses regular expressions  to  specify  labels  that
222       match multiple files.
223
224       The following file types are defined for java:
225
226
227
228       java_exec_t
229
230       -  Set  files  with  the java_exec_t type, if you want to transition an
231       executable to the java_t domain.
232
233
234       Paths:
235            /usr/(.*/)?bin/java.*,                   /opt/(.*/)?bin/java[^/]*,
236            /usr/lib(.*/)?bin/java[^/]*,        /usr/lib(64)?/eclipse/eclipse,
237            /opt/matlab.*/bin.*/MATLAB.*,        /usr/matlab.*/bin.*/MATLAB.*,
238            /usr/Aptana[^/]*/AptanaStudio, /opt/ibm/java.*/(bin|javaws)(/.*)?,
239            /usr/lib/opera(/.*)?/opera,            /usr/lib/opera(/.*)?/works,
240            /usr/bin/octave-[^/]*,             /usr/java/eclipse[^/]*/eclipse,
241            /usr/lib/jvm/java(.*/)bin(/.*)?,    /opt/local/matlab.*/bin.*/MAT‐
242            LAB.*,                         /usr/local/matlab.*/bin.*/MATLAB.*,
243            /usr/lib64/jvm/java(.*/)bin(/.*)?,  /opt/ibm/lotus/Symphony/frame‐
244            work/rcp/eclipse/plugins(/.*)?,    /usr/bin/gij,   /usr/bin/frysk,
245            /usr/bin/grmic, /usr/bin/fastjar, /usr/bin/gkeytool, /usr/bin/gcj-
246            dbtool,          /usr/bin/gjarsigner,         /usr/bin/jv-convert,
247            /usr/bin/grmiregistry, /usr/bin/gappletviewer
248
249
250       java_tmp_t
251
252       - Set files with the java_tmp_t type, if you want to store java  tempo‐
253       rary files in the /tmp directories.
254
255
256
257       java_tmpfs_t
258
259       - Set files with the java_tmpfs_t type, if you want to store java files
260       on a tmpfs file system.
261
262
263
264       Note: File context can be temporarily modified with the chcon  command.
265       If  you want to permanently change the file context you need to use the
266       semanage fcontext command.  This will modify the SELinux labeling data‐
267       base.  You will need to use restorecon to apply the labels.
268
269

COMMANDS

271       semanage  fcontext  can also be used to manipulate default file context
272       mappings.
273
274       semanage permissive can also be used to manipulate  whether  or  not  a
275       process type is permissive.
276
277       semanage  module can also be used to enable/disable/install/remove pol‐
278       icy modules.
279
280       semanage boolean can also be used to manipulate the booleans
281
282
283       system-config-selinux is a GUI tool available to customize SELinux pol‐
284       icy settings.
285
286

AUTHOR

288       This manual page was auto-generated using sepolicy manpage .
289
290