1mplayer_selinux(8) SELinux Policy mplayer mplayer_selinux(8)
2
3
4
6 mplayer_selinux - Security Enhanced Linux Policy for the mplayer pro‐
7 cesses
8
10 Security-Enhanced Linux secures the mplayer processes via flexible
11 mandatory access control.
12
13 The mplayer processes execute with the mplayer_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep mplayer_t
20
21
22
24 The mplayer_t SELinux type can be entered via the mplayer_exec_t file
25 type.
26
27 The default entrypoint paths for the mplayer_t domain are the follow‐
28 ing:
29
30 /usr/bin/vlc, /usr/bin/xine, /usr/bin/mplayer
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 mplayer policy is very flexible allowing users to setup their mplayer
40 processes in as secure a method as possible.
41
42 The following process types are defined for mplayer:
43
44 mplayer_t
45
46 Note: semanage permissive -a mplayer_t can be used to make the process
47 type mplayer_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. mplayer
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run mplayer with the tightest access possi‐
56 ble.
57
58
59
60 If you want to determine whether mplayer can make its stack executable,
61 you must turn on the mplayer_execstack boolean. Disabled by default.
62
63 setsebool -P mplayer_execstack 1
64
65
66
67 If you want to allow users to resolve user passwd entries directly from
68 ldap rather then using a sssd server, you must turn on the authlo‐
69 gin_nsswitch_use_ldap boolean. Disabled by default.
70
71 setsebool -P authlogin_nsswitch_use_ldap 1
72
73
74
75 If you want to deny user domains applications to map a memory region as
76 both executable and writable, this is dangerous and the executable
77 should be reported in bugzilla, you must turn on the deny_execmem bool‐
78 ean. Enabled by default.
79
80 setsebool -P deny_execmem 1
81
82
83
84 If you want to deny any process from ptracing or debugging any other
85 processes, you must turn on the deny_ptrace boolean. Enabled by
86 default.
87
88 setsebool -P deny_ptrace 1
89
90
91
92 If you want to allow any process to mmap any file on system with
93 attribute file_type, you must turn on the domain_can_mmap_files bool‐
94 ean. Enabled by default.
95
96 setsebool -P domain_can_mmap_files 1
97
98
99
100 If you want to allow all domains write to kmsg_device, while kernel is
101 executed with systemd.log_target=kmsg parameter, you must turn on the
102 domain_can_write_kmsg boolean. Disabled by default.
103
104 setsebool -P domain_can_write_kmsg 1
105
106
107
108 If you want to allow all domains to use other domains file descriptors,
109 you must turn on the domain_fd_use boolean. Enabled by default.
110
111 setsebool -P domain_fd_use 1
112
113
114
115 If you want to allow all domains to have the kernel load modules, you
116 must turn on the domain_kernel_load_modules boolean. Disabled by
117 default.
118
119 setsebool -P domain_kernel_load_modules 1
120
121
122
123 If you want to allow all domains to execute in fips_mode, you must turn
124 on the fips_mode boolean. Enabled by default.
125
126 setsebool -P fips_mode 1
127
128
129
130 If you want to enable reading of urandom for all domains, you must turn
131 on the global_ssp boolean. Disabled by default.
132
133 setsebool -P global_ssp 1
134
135
136
137 If you want to allow confined applications to run with kerberos, you
138 must turn on the kerberos_enabled boolean. Enabled by default.
139
140 setsebool -P kerberos_enabled 1
141
142
143
144 If you want to allow system to run with NIS, you must turn on the
145 nis_enabled boolean. Disabled by default.
146
147 setsebool -P nis_enabled 1
148
149
150
151 If you want to allow confined applications to use nscd shared memory,
152 you must turn on the nscd_use_shm boolean. Disabled by default.
153
154 setsebool -P nscd_use_shm 1
155
156
157
158 If you want to allow regular users direct dri device access, you must
159 turn on the selinuxuser_direct_dri_enabled boolean. Enabled by default.
160
161 setsebool -P selinuxuser_direct_dri_enabled 1
162
163
164
165 If you want to allow all unconfined executables to use libraries
166 requiring text relocation that are not labeled textrel_shlib_t, you
167 must turn on the selinuxuser_execmod boolean. Enabled by default.
168
169 setsebool -P selinuxuser_execmod 1
170
171
172
173 If you want to support NFS home directories, you must turn on the
174 use_nfs_home_dirs boolean. Disabled by default.
175
176 setsebool -P use_nfs_home_dirs 1
177
178
179
180 If you want to support SAMBA home directories, you must turn on the
181 use_samba_home_dirs boolean. Disabled by default.
182
183 setsebool -P use_samba_home_dirs 1
184
185
186
187 If you want to allows clients to write to the X server shared memory
188 segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
189 abled by default.
190
191 setsebool -P xserver_clients_write_xshm 1
192
193
194
195 If you want to support X userspace object manager, you must turn on the
196 xserver_object_manager boolean. Enabled by default.
197
198 setsebool -P xserver_object_manager 1
199
200
201
203 The SELinux process type mplayer_t can manage files labeled with the
204 following file types. The paths listed are the default paths for these
205 file types. Note the processes UID still need to have DAC permissions.
206
207 cifs_t
208
209
210 mplayer_home_t
211
212 /home/[^/]+/.mplayer(/.*)?
213
214 mplayer_tmpfs_t
215
216
217 nfs_t
218
219
220 pulseaudio_home_t
221
222 /root/.pulse(/.*)?
223 /root/.config/pulse(/.*)?
224 /root/.esd_auth
225 /root/.pulse-cookie
226 /home/[^/]+/.pulse(/.*)?
227 /home/[^/]+/.config/pulse(/.*)?
228 /home/[^/]+/.esd_auth
229 /home/[^/]+/.pulse-cookie
230
231 user_fonts_cache_t
232
233 /root/.fontconfig(/.*)?
234 /root/.fonts/auto(/.*)?
235 /root/.fonts.cache-.*
236 /home/[^/]+/.fontconfig(/.*)?
237 /home/[^/]+/.fonts/auto(/.*)?
238 /home/[^/]+/.fonts.cache-.*
239
240 user_home_t
241
242 /home/[^/]+/.+
243
244 user_tmp_t
245
246 /dev/shm/mono.*
247 /var/run/user(/.*)?
248 /tmp/.X11-unix(/.*)?
249 /tmp/.ICE-unix(/.*)?
250 /dev/shm/pulse-shm.*
251 /tmp/.X0-lock
252 /tmp/hsperfdata_root
253 /var/tmp/hsperfdata_root
254 /home/[^/]+/tmp
255 /home/[^/]+/.tmp
256 /tmp/gconfd-[^/]+
257
258 xserver_tmpfs_t
259
260
261
263 SELinux requires files to have an extended attribute to define the file
264 type.
265
266 You can see the context of a file using the -Z option to ls
267
268 Policy governs the access confined processes have to these files.
269 SELinux mplayer policy is very flexible allowing users to setup their
270 mplayer processes in as secure a method as possible.
271
272 STANDARD FILE CONTEXT
273
274 SELinux defines the file context types for the mplayer, if you wanted
275 to store files with these types in a diffent paths, you need to execute
276 the semanage command to sepecify alternate labeling and then use
277 restorecon to put the labels on disk.
278
279 semanage fcontext -a -t mplayer_tmpfs_t '/srv/mymplayer_content(/.*)?'
280 restorecon -R -v /srv/mymplayer_content
281
282 Note: SELinux often uses regular expressions to specify labels that
283 match multiple files.
284
285 The following file types are defined for mplayer:
286
287
288
289 mplayer_etc_t
290
291 - Set files with the mplayer_etc_t type, if you want to store mplayer
292 files in the /etc directories.
293
294
295
296 mplayer_exec_t
297
298 - Set files with the mplayer_exec_t type, if you want to transition an
299 executable to the mplayer_t domain.
300
301
302 Paths:
303 /usr/bin/vlc, /usr/bin/xine, /usr/bin/mplayer
304
305
306 mplayer_home_t
307
308 - Set files with the mplayer_home_t type, if you want to store mplayer
309 files in the users home directory.
310
311
312
313 mplayer_tmpfs_t
314
315 - Set files with the mplayer_tmpfs_t type, if you want to store mplayer
316 files on a tmpfs file system.
317
318
319
320 Note: File context can be temporarily modified with the chcon command.
321 If you want to permanently change the file context you need to use the
322 semanage fcontext command. This will modify the SELinux labeling data‐
323 base. You will need to use restorecon to apply the labels.
324
325
327 semanage fcontext can also be used to manipulate default file context
328 mappings.
329
330 semanage permissive can also be used to manipulate whether or not a
331 process type is permissive.
332
333 semanage module can also be used to enable/disable/install/remove pol‐
334 icy modules.
335
336 semanage boolean can also be used to manipulate the booleans
337
338
339 system-config-selinux is a GUI tool available to customize SELinux pol‐
340 icy settings.
341
342
344 This manual page was auto-generated using sepolicy manpage .
345
346
348 selinux(8), mplayer(8), semanage(8), restorecon(8), chcon(1), sepol‐
349 icy(8) , setsebool(8)
350
351
352
353mplayer 19-04-25 mplayer_selinux(8)