1policykit_grant_selinux(8S)ELinux Policy policykit_granptolicykit_grant_selinux(8)
2
6 policykit_grant_selinux - Security Enhanced Linux Policy for the poli‐
7 cykit_grant processes
8
10 Security-Enhanced Linux secures the policykit_grant processes via flex‐
11 ible mandatory access control.
12 The policykit_grant processes execute with the policykit_grant_t
14 SELinux type. You can check if you have these processes running by exe‐
15 cuting the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep policykit_grant_t
20
24 The policykit_grant_t SELinux type can be entered via the poli‐
25 cykit_grant_exec_t file type.
26 The default entrypoint paths for the policykit_grant_t domain are the
28 following:
29 /usr/libexec/polkit-grant-helper.*, /usr/lib/policykit/polkit-grant-
31 helper.*
32
34 SELinux defines process types (domains) for each process running on the
35 system
36 You can see the context of a process using the -Z option to ps
38 Policy governs the access confined processes have to files. SELinux
40 policykit_grant policy is very flexible allowing users to setup their
41 policykit_grant processes in as secure a method as possible.
42 The following process types are defined for policykit_grant:
44 policykit_grant_t
46 Note: semanage permissive -a policykit_grant_t can be used to make the
48 process type policykit_grant_t permissive. SELinux does not deny access
49 to permissive process types, but the AVC (SELinux denials) messages are
50 still generated.
51
54 SELinux policy is customizable based on least access required. poli‐
55 cykit_grant policy is extremely flexible and has several booleans that
56 allow you to manipulate the policy and run policykit_grant with the
57 tightest access possible.
58 If you want to allow all daemons the ability to read/write terminals,
62 you must turn on the allow_daemons_use_tty boolean. Disabled by
63 default.
64 setsebool -P allow_daemons_use_tty 1
66 If you want to allow all domains to use other domains file descriptors,
70 you must turn on the allow_domain_fd_use boolean. Enabled by default.
71 setsebool -P allow_domain_fd_use 1
73 If you want to allow confined applications to run with kerberos, you
77 must turn on the allow_kerberos boolean. Enabled by default.
78 setsebool -P allow_kerberos 1
80 If you want to allow sysadm to debug or ptrace all processes, you must
84 turn on the allow_ptrace boolean. Disabled by default.
85 setsebool -P allow_ptrace 1
87 If you want to allow system to run with NIS, you must turn on the
91 allow_ypbind boolean. Disabled by default.
92 setsebool -P allow_ypbind 1
94 If you want to allow all domains to have the kernel load modules, you
98 must turn on the domain_kernel_load_modules boolean. Disabled by
99 default.
100 setsebool -P domain_kernel_load_modules 1
102 If you want to allow all domains to execute in fips_mode, you must turn
106 on the fips_mode boolean. Enabled by default.
107 setsebool -P fips_mode 1
109 If you want to enable reading of urandom for all domains, you must turn
113 on the global_ssp boolean. Disabled by default.
114 setsebool -P global_ssp 1
116 If you want to allow confined applications to use nscd shared memory,
120 you must turn on the nscd_use_shm boolean. Enabled by default.
121 setsebool -P nscd_use_shm 1
123
127 The SELinux process type policykit_grant_t can manage files labeled
128 with the following file types. The paths listed are the default paths
129 for these file types. Note the processes UID still need to have DAC
130 permissions.
131 faillog_t
133 /var/log/btmp.*
135 /var/log/faillog.*
136 /var/log/tallylog.*
137 /var/run/faillock(/.*)?
138 initrc_tmp_t
140 mnt_t
143 /mnt(/[^/]*)
145 /mnt(/[^/]*)?
146 /rhev(/[^/]*)?
147 /media(/[^/]*)
148 /media(/[^/]*)?
149 /etc/rhgb(/.*)?
150 /media/.hal-.*
151 /net
152 /afs
153 /rhev
154 /misc
155 pcscd_var_run_t
157 /var/run/pcscd.events(/.*)?
159 /var/run/pcscd.pid
160 /var/run/pcscd.pub
161 /var/run/pcscd.comm
162 policykit_reload_t
164 /var/lib/misc/PolicyKit.reload
166 policykit_var_lib_t
168 /var/lib/polkit-1(/.*)?
170 /var/lib/PolicyKit(/.*)?
171 /var/lib/PolicyKit-public(/.*)?
172 policykit_var_run_t
174 /var/run/PolicyKit(/.*)?
176 system_cronjob_var_lib_t
178 tmp_t
181 /tmp
183 /usr/tmp
184 /var/tmp
185 /tmp-inst
186 /var/tmp-inst
187 /var/tmp/vi.recover
188
191 SELinux requires files to have an extended attribute to define the file
192 type.
193 You can see the context of a file using the -Z option to ls
195 Policy governs the access confined processes have to these files.
197 SELinux policykit_grant policy is very flexible allowing users to setup
198 their policykit_grant processes in as secure a method as possible.
199 The following file types are defined for policykit_grant:
201 policykit_grant_exec_t
205 - Set files with the policykit_grant_exec_t type, if you want to tran‐
207 sition an executable to the policykit_grant_t domain.
208 Paths:
211 /usr/libexec/polkit-grant-helper.*, /usr/lib/policykit/polkit-
212 grant-helper.*
213 Note: File context can be temporarily modified with the chcon command.
216 If you want to permanently change the file context you need to use the
217 semanage fcontext command. This will modify the SELinux labeling data‐
218 base. You will need to use restorecon to apply the labels.
219
222 semanage fcontext can also be used to manipulate default file context
223 mappings.
224 semanage permissive can also be used to manipulate whether or not a
226 process type is permissive.
227 semanage module can also be used to enable/disable/install/remove pol‐
229 icy modules.
230 semanage boolean can also be used to manipulate the booleans
232 system-config-selinux is a GUI tool available to customize SELinux pol‐
235 icy settings.
236
239 This manual page was auto-generated using sepolicy manpage .
240
243 selinux(8), policykit_grant(8), semanage(8), restorecon(8), chcon(1) ,
244 setsebool(8)
245policykit_grant 15-06-03 policykit_grant_selinux(8)