dbadm_selinux(8)

1dbadm_selinux(8)      dbadm SELinux Policy documentation      dbadm_selinux(8)
2
3
4

NAME

6       dbadm_r - Database administrator role. - Security Enhanced Linux Policy
7
8

DESCRIPTION

10       SELinux  supports  Roles  Based Access Control (RBAC), some Linux roles
11       are login roles, while other roles need to be transition into.
12
13       Note: Examples in this man page will use the staff_u SELinux user.
14
15       Non login roles are usually used for administrative tasks. For example,
16       tasks  that  require root privileges.  Roles control which types a user
17       can run processes with. Roles often  have  default  types  assigned  to
18       them.
19
20       The default type for the dbadm_r role is dbadm_t.
21
22       The newrole program to transition directly to this role.
23
24       newrole -r dbadm_r -t dbadm_t
25
26       sudo is the preferred method to do transition from one role to another.
27       You setup sudo to transition to dbadm_r by adding a similar line to the
28       /etc/sudoers file.
29
30       USERNAME ALL=(ALL) ROLE=dbadm_r TYPE=dbadm_t COMMAND
31
32       sudo will run COMMAND as staff_u:dbadm_r:dbadm_t:LEVEL
33
34       When  using  a a non login role, you need to setup SELinux so that your
35       SELinux user can reach dbadm_r role.
36
37       Execute the following to see all of the assigned SELinux roles:
38
39       semanage user -l
40
41       You need to add dbadm_r to the  staff_u  user.   You  could  setup  the
42       staff_u user to be able to use the dbadm_r role with a command like:
43
44       $ semanage user -m -R 'staff_r system_r dbadm_r' staff_u
45
46
47

BOOLEANS

49       SELinux  policy  is customizable based on least access required.  dbadm
50       policy is extremely flexible and has several booleans that allow you to
51       manipulate the policy and run dbadm with the tightest access possible.
52
53
54
55       If  you  want to determine whether dbadm can manage generic user files,
56       you must turn  on  the  dbadm_manage_user_files  boolean.  Disabled  by
57       default.
58
59       setsebool -P dbadm_manage_user_files 1
60
61
62
63       If you want to determine whether dbadm can read generic user files, you
64       must turn on the dbadm_read_user_files boolean. Disabled by default.
65
66       setsebool -P dbadm_read_user_files 1
67
68
69
70       If you want to allow users to resolve user passwd entries directly from
71       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
72       gin_nsswitch_use_ldap boolean. Disabled by default.
73
74       setsebool -P authlogin_nsswitch_use_ldap 1
75
76
77
78       If you want to deny user domains applications to map a memory region as
79       both  executable  and  writable,  this  is dangerous and the executable
80       should be reported in bugzilla, you must turn on the deny_execmem bool‐
81       ean. Enabled by default.
82
83       setsebool -P deny_execmem 1
84
85
86
87       If  you  want  to deny any process from ptracing or debugging any other
88       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
89       default.
90
91       setsebool -P deny_ptrace 1
92
93
94
95       If  you  want  to  allow  any  process  to mmap any file on system with
96       attribute file_type, you must turn on the  domain_can_mmap_files  bool‐
97       ean. Enabled by default.
98
99       setsebool -P domain_can_mmap_files 1
100
101
102
103       If  you want to allow all domains write to kmsg_device, while kernel is
104       executed with systemd.log_target=kmsg parameter, you must turn  on  the
105       domain_can_write_kmsg boolean. Disabled by default.
106
107       setsebool -P domain_can_write_kmsg 1
108
109
110
111       If you want to allow all domains to use other domains file descriptors,
112       you must turn on the domain_fd_use boolean. Enabled by default.
113
114       setsebool -P domain_fd_use 1
115
116
117
118       If you want to allow all domains to have the kernel load  modules,  you
119       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
120       default.
121
122       setsebool -P domain_kernel_load_modules 1
123
124
125
126       If you want to allow all domains to execute in fips_mode, you must turn
127       on the fips_mode boolean. Enabled by default.
128
129       setsebool -P fips_mode 1
130
131
132
133       If you want to enable reading of urandom for all domains, you must turn
134       on the global_ssp boolean. Disabled by default.
135
136       setsebool -P global_ssp 1
137
138
139
140       If you want to allow confined applications to run  with  kerberos,  you
141       must turn on the kerberos_enabled boolean. Enabled by default.
142
143       setsebool -P kerberos_enabled 1
144
145
146
147       If you want to allow logging in and using the system from /dev/console,
148       you must turn on the login_console_enabled boolean. Enabled by default.
149
150       setsebool -P login_console_enabled 1
151
152
153
154       If you want to allow system to run with  NIS,  you  must  turn  on  the
155       nis_enabled boolean. Disabled by default.
156
157       setsebool -P nis_enabled 1
158
159
160
161       If  you  want to allow confined applications to use nscd shared memory,
162       you must turn on the nscd_use_shm boolean. Disabled by default.
163
164       setsebool -P nscd_use_shm 1
165
166
167
168       If you want to allow database admins to execute DML statement, you must
169       turn  on  the  postgresql_selinux_unconfined_dbadm  boolean. Enabled by
170       default.
171
172       setsebool -P postgresql_selinux_unconfined_dbadm 1
173
174
175
176       If you want to disallow programs, such as newrole,  from  transitioning
177       to  administrative user domains, you must turn on the secure_mode bool‐
178       ean. Enabled by default.
179
180       setsebool -P secure_mode 1
181
182
183
184       If you want to allow unconfined executables to make  their  stack  exe‐
185       cutable.   This  should  never, ever be necessary. Probably indicates a
186       badly coded executable, but could indicate an attack.  This  executable
187       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
188       stack boolean. Enabled by default.
189
190       setsebool -P selinuxuser_execstack 1
191
192
193
194       If you want to allow ssh logins as sysadm_r:sysadm_t, you must turn  on
195       the ssh_sysadm_login boolean. Disabled by default.
196
197       setsebool -P ssh_sysadm_login 1
198
199
200
201       If  you  want  to  support  NFS  home directories, you must turn on the
202       use_nfs_home_dirs boolean. Disabled by default.
203
204       setsebool -P use_nfs_home_dirs 1
205
206
207
208       If you want to support SAMBA home directories, you  must  turn  on  the
209       use_samba_home_dirs boolean. Disabled by default.
210
211       setsebool -P use_samba_home_dirs 1
212
213
214
215       If  you  want to allow the graphical login program to login directly as
216       sysadm_r:sysadm_t, you must turn on the xdm_sysadm_login boolean.  Dis‐
217       abled by default.
218
219       setsebool -P xdm_sysadm_login 1
220
221
222

MANAGED FILES

224       The SELinux process type dbadm_t can manage files labeled with the fol‐
225       lowing file types.  The paths listed are the default  paths  for  these
226       file types.  Note the processes UID still need to have DAC permissions.
227
228       mysqld_db_t
229
230            /var/lib/mysql(-files|-keyring)?(/.*)?
231
232       mysqld_etc_t
233
234            /etc/mysql(/.*)?
235            /etc/my.cnf.d(/.*)?
236            /etc/my.cnf
237
238       mysqld_home_t
239
240            /root/.my.cnf
241            /home/[^/]+/.my.cnf
242
243       mysqld_log_t
244
245            /var/log/mysql.*
246            /var/log/mariadb(/.*)?
247
248       mysqld_tmp_t
249
250
251       mysqld_unit_file_t
252
253            /usr/lib/systemd/system/mysqld.*
254            /usr/lib/systemd/system/mariadb.*
255
256       mysqld_var_run_t
257
258            /var/run/mysqld(/.*)?
259            /var/run/mariadb(/.*)?
260            /var/lib/mysql/mysql.sock
261
262       postgresql_db_t
263
264            /var/lib/pgsql(/.*)?
265            /var/lib/sepgsql(/.*)?
266            /var/lib/postgres(ql)?(/.*)?
267            /usr/share/jonas/pgsql(/.*)?
268            /usr/lib/pgsql/test/regress(/.*)?
269
270       postgresql_etc_t
271
272            /etc/postgresql(/.*)?
273            /etc/sysconfig/pgsql(/.*)?
274
275       postgresql_log_t
276
277            /var/lib/pgsql/.*.log
278            /var/log/rhdb/rhdb(/.*)?
279            /var/log/postgresql(/.*)?
280            /var/log/postgres.log.*
281            /var/lib/pgsql/logfile(/.*)?
282            /var/log/sepostgresql.log.*
283            /var/lib/pgsql/data/pg_log(/.*)?
284            /var/lib/sepgsql/pgstartup.log
285
286       postgresql_tmp_t
287
288
289       postgresql_var_run_t
290
291            /var/run/postgresql(/.*)?
292
293       systemd_passwd_var_run_t
294
295            /var/run/systemd/ask-password(/.*)?
296            /var/run/systemd/ask-password-block(/.*)?
297
298       user_home_t
299
300            /home/[^/]+/.+
301
302       user_tmp_t
303
304            /dev/shm/mono.*
305            /var/run/user(/.*)?
306            /tmp/.X11-unix(/.*)?
307            /tmp/.ICE-unix(/.*)?
308            /dev/shm/pulse-shm.*
309            /tmp/.X0-lock
310            /tmp/hsperfdata_root
311            /var/tmp/hsperfdata_root
312            /home/[^/]+/tmp
313            /home/[^/]+/.tmp
314            /tmp/gconfd-[^/]+
315
316

COMMANDS

318       semanage  fcontext  can also be used to manipulate default file context
319       mappings.
320
321       semanage permissive can also be used to manipulate  whether  or  not  a
322       process type is permissive.
323
324       semanage  module can also be used to enable/disable/install/remove pol‐
325       icy modules.
326
327       semanage boolean can also be used to manipulate the booleans
328
329
330       system-config-selinux is a GUI tool available to customize SELinux pol‐
331       icy settings.
332
333

AUTHOR

335       This manual page was auto-generated using sepolicy manpage .
336
337

NAME

DESCRIPTION

BOOLEANS

MANAGED FILES

COMMANDS

AUTHOR

SEE ALSO