munin_mail_plugin_selinux(8)

1munin_mail_plugin_selinuSxE(L8i)nux Policy munin_mail_plmuugniinn_mail_plugin_selinux(8)
2
3
4

NAME

6       munin_mail_plugin_selinux  -  Security  Enhanced  Linux  Policy for the
7       munin_mail_plugin processes
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  munin_mail_plugin  processes  via
11       flexible mandatory access control.
12
13       The  munin_mail_plugin  processes  execute with the munin_mail_plugin_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep munin_mail_plugin_t
20
21
22

ENTRYPOINTS

24       The   munin_mail_plugin_t   SELinux   type   can  be  entered  via  the
25       munin_mail_plugin_exec_t file type.
26
27       The default entrypoint paths for the munin_mail_plugin_t domain are the
28       following:
29
30       /usr/share/munin/plugins/qmail.*, /usr/share/munin/plugins/exim_mail.*,
31       /usr/share/munin/plugins/sendmail_.*,            /usr/share/munin/plug‐
32       ins/courier_mta_.*,            /usr/share/munin/plugins/postfix_mail.*,
33       /usr/share/munin/plugins/mailman, /usr/share/munin/plugins/mailscanner
34

PROCESS TYPES

36       SELinux defines process types (domains) for each process running on the
37       system
38
39       You can see the context of a process using the -Z option to ps
40
41       Policy  governs  the  access confined processes have to files.  SELinux
42       munin_mail_plugin policy is very flexible allowing users to setup their
43       munin_mail_plugin processes in as secure a method as possible.
44
45       The following process types are defined for munin_mail_plugin:
46
47       munin_mail_plugin_t
48
49       Note:  semanage  permissive  -a munin_mail_plugin_t can be used to make
50       the process type munin_mail_plugin_t permissive. SELinux does not  deny
51       access  to permissive process types, but the AVC (SELinux denials) mes‐
52       sages are still generated.
53
54

BOOLEANS

56       SELinux  policy  is  customizable  based  on  least  access   required.
57       munin_mail_plugin policy is extremely flexible and has several booleans
58       that allow you to manipulate the policy and run munin_mail_plugin  with
59       the tightest access possible.
60
61
62
63       If you want to allow all domains to use other domains file descriptors,
64       you must turn on the allow_domain_fd_use boolean. Enabled by default.
65
66       setsebool -P allow_domain_fd_use 1
67
68
69
70       If you want to allow sysadm to debug or ptrace all processes, you  must
71       turn on the allow_ptrace boolean. Disabled by default.
72
73       setsebool -P allow_ptrace 1
74
75
76
77       If  you  want to allow all domains to have the kernel load modules, you
78       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
79       default.
80
81       setsebool -P domain_kernel_load_modules 1
82
83
84
85       If you want to allow all domains to execute in fips_mode, you must turn
86       on the fips_mode boolean. Enabled by default.
87
88       setsebool -P fips_mode 1
89
90
91
92       If you want to enable reading of urandom for all domains, you must turn
93       on the global_ssp boolean. Disabled by default.
94
95       setsebool -P global_ssp 1
96
97
98

MANAGED FILES

100       The  SELinux  process type munin_mail_plugin_t can manage files labeled
101       with the following file types.  The paths listed are the default  paths
102       for  these  file  types.  Note the processes UID still need to have DAC
103       permissions.
104
105       initrc_tmp_t
106
107
108       mnt_t
109
110            /mnt(/[^/]*)
111            /mnt(/[^/]*)?
112            /rhev(/[^/]*)?
113            /media(/[^/]*)
114            /media(/[^/]*)?
115            /etc/rhgb(/.*)?
116            /media/.hal-.*
117            /net
118            /afs
119            /rhev
120            /misc
121
122       munin_mail_plugin_tmp_t
123
124
125       munin_plugin_state_t
126
127            /var/lib/munin/plugin-state(/.*)?
128
129       munin_var_lib_t
130
131            /var/lib/munin(/.*)?
132
133       tmp_t
134
135            /tmp
136            /usr/tmp
137            /var/tmp
138            /tmp-inst
139            /var/tmp-inst
140            /var/tmp/vi.recover
141
142

FILE CONTEXTS

144       SELinux requires files to have an extended attribute to define the file
145       type.
146
147       You can see the context of a file using the -Z option to ls
148
149       Policy  governs  the  access  confined  processes  have to these files.
150       SELinux munin_mail_plugin policy is very  flexible  allowing  users  to
151       setup their munin_mail_plugin processes in as secure a method as possi‐
152       ble.
153
154       STANDARD FILE CONTEXT
155
156       SELinux defines the file context types for  the  munin_mail_plugin,  if
157       you wanted to store files with these types in a diffent paths, you need
158       to execute the semanage command to sepecify alternate labeling and then
159       use restorecon to put the labels on disk.
160
161       semanage       fcontext       -a       -t       munin_mail_plugin_tmp_t
162       '/srv/mymunin_mail_plugin_content(/.*)?'
163       restorecon -R -v /srv/mymunin_mail_plugin_content
164
165       Note: SELinux often uses regular expressions  to  specify  labels  that
166       match multiple files.
167
168       The following file types are defined for munin_mail_plugin:
169
170
171
172       munin_mail_plugin_exec_t
173
174       -  Set  files  with  the  munin_mail_plugin_exec_t type, if you want to
175       transition an executable to the munin_mail_plugin_t domain.
176
177
178       Paths:
179            /usr/share/munin/plugins/qmail.*,           /usr/share/munin/plug‐
180            ins/exim_mail.*,             /usr/share/munin/plugins/sendmail_.*,
181            /usr/share/munin/plugins/courier_mta_.*,    /usr/share/munin/plug‐
182            ins/postfix_mail.*,              /usr/share/munin/plugins/mailman,
183            /usr/share/munin/plugins/mailscanner
184
185
186       munin_mail_plugin_tmp_t
187
188       - Set files with the munin_mail_plugin_tmp_t type, if you want to store
189       munin mail plugin temporary files in the /tmp directories.
190
191
192
193       Note:  File context can be temporarily modified with the chcon command.
194       If you want to permanently change the file context you need to use  the
195       semanage fcontext command.  This will modify the SELinux labeling data‐
196       base.  You will need to use restorecon to apply the labels.
197
198

COMMANDS

200       semanage fcontext can also be used to manipulate default  file  context
201       mappings.
202
203       semanage  permissive  can  also  be used to manipulate whether or not a
204       process type is permissive.
205
206       semanage module can also be used to enable/disable/install/remove  pol‐
207       icy modules.
208
209       semanage boolean can also be used to manipulate the booleans
210
211
212       system-config-selinux is a GUI tool available to customize SELinux pol‐
213       icy settings.
214
215

AUTHOR

217       This manual page was auto-generated using sepolicy manpage .
218
219