1sandbox_x_selinux(8) SELinux Policy sandbox_x sandbox_x_selinux(8)
2
3
4
6 sandbox_x_selinux - Security Enhanced Linux Policy for the sandbox_x
7 processes
8
10 Security-Enhanced Linux secures the sandbox_x processes via flexible
11 mandatory access control.
12
13 The sandbox_x processes execute with the sandbox_x_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep sandbox_x_t
20
21
22
24 The sandbox_x_t SELinux type can be entered via the file_type file
25 type.
26
27 The default entrypoint paths for the sandbox_x_t domain are the follow‐
28 ing:
29
30 all files on the system
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 sandbox_x policy is very flexible allowing users to setup their sand‐
40 box_x processes in as secure a method as possible.
41
42 The following process types are defined for sandbox_x:
43
44 sandbox_xserver_t, sandbox_x_t, sandbox_x_client_t
45
46 Note: semanage permissive -a sandbox_x_t can be used to make the
47 process type sandbox_x_t permissive. SELinux does not deny access to
48 permissive process types, but the AVC (SELinux denials) messages are
49 still generated.
50
51
53 The SELinux process type sandbox_x_t is an MCS (Multi Category Secu‐
54 rity) constrained type. Sometimes this separation is referred to as
55 sVirt. These types are usually used for securing multi-tenant environ‐
56 ments, such as virtualization, containers or separation of users. The
57 tools used to launch MCS types, pick out a different MCS label for each
58 process group.
59
60 For example one process might be launched with sandbox_x_t:s0:c1,c2,
61 and another process launched with sandbox_x_t:s0:c3,c4. The SELinux
62 kernel only allows these processes can only write to content with a
63 matching MCS label, or a MCS Label of s0. A process running with the
64 MCS level of s0:c1,c2 is not allowed to write to content with the MCS
65 label of s0:c3,c4
66
67
69 SELinux policy is customizable based on least access required. sand‐
70 box_x policy is extremely flexible and has several booleans that allow
71 you to manipulate the policy and run sandbox_x with the tightest access
72 possible.
73
74
75
76 If you want to allow users to resolve user passwd entries directly from
77 ldap rather then using a sssd server, you must turn on the authlo‐
78 gin_nsswitch_use_ldap boolean. Disabled by default.
79
80 setsebool -P authlogin_nsswitch_use_ldap 1
81
82
83
84 If you want to deny user domains applications to map a memory region as
85 both executable and writable, this is dangerous and the executable
86 should be reported in bugzilla, you must turn on the deny_execmem bool‐
87 ean. Enabled by default.
88
89 setsebool -P deny_execmem 1
90
91
92
93 If you want to deny any process from ptracing or debugging any other
94 processes, you must turn on the deny_ptrace boolean. Enabled by
95 default.
96
97 setsebool -P deny_ptrace 1
98
99
100
101 If you want to allow any process to mmap any file on system with
102 attribute file_type, you must turn on the domain_can_mmap_files bool‐
103 ean. Enabled by default.
104
105 setsebool -P domain_can_mmap_files 1
106
107
108
109 If you want to allow all domains write to kmsg_device, while kernel is
110 executed with systemd.log_target=kmsg parameter, you must turn on the
111 domain_can_write_kmsg boolean. Disabled by default.
112
113 setsebool -P domain_can_write_kmsg 1
114
115
116
117 If you want to allow all domains to use other domains file descriptors,
118 you must turn on the domain_fd_use boolean. Enabled by default.
119
120 setsebool -P domain_fd_use 1
121
122
123
124 If you want to allow all domains to have the kernel load modules, you
125 must turn on the domain_kernel_load_modules boolean. Disabled by
126 default.
127
128 setsebool -P domain_kernel_load_modules 1
129
130
131
132 If you want to allow all domains to execute in fips_mode, you must turn
133 on the fips_mode boolean. Enabled by default.
134
135 setsebool -P fips_mode 1
136
137
138
139 If you want to enable reading of urandom for all domains, you must turn
140 on the global_ssp boolean. Disabled by default.
141
142 setsebool -P global_ssp 1
143
144
145
146 If you want to allow confined applications to run with kerberos, you
147 must turn on the kerberos_enabled boolean. Enabled by default.
148
149 setsebool -P kerberos_enabled 1
150
151
152
153 If you want to allow system to run with NIS, you must turn on the
154 nis_enabled boolean. Disabled by default.
155
156 setsebool -P nis_enabled 1
157
158
159
160 If you want to allow confined applications to use nscd shared memory,
161 you must turn on the nscd_use_shm boolean. Disabled by default.
162
163 setsebool -P nscd_use_shm 1
164
165
166
167 If you want to support fusefs home directories, you must turn on the
168 use_fusefs_home_dirs boolean. Disabled by default.
169
170 setsebool -P use_fusefs_home_dirs 1
171
172
173
174 If you want to support NFS home directories, you must turn on the
175 use_nfs_home_dirs boolean. Disabled by default.
176
177 setsebool -P use_nfs_home_dirs 1
178
179
180
181 If you want to support SAMBA home directories, you must turn on the
182 use_samba_home_dirs boolean. Disabled by default.
183
184 setsebool -P use_samba_home_dirs 1
185
186
187
189 The SELinux process type sandbox_x_t can manage files labeled with the
190 following file types. The paths listed are the default paths for these
191 file types. Note the processes UID still need to have DAC permissions.
192
193 cifs_t
194
195
196 fusefs_t
197
198 /var/run/user/[^/]*/gvfs
199
200 mozilla_plugin_rw_t
201
202 /usr/lib/mozilla/plugins-wrapped(/.*)?
203
204 mozilla_plugin_tmpfs_t
205
206
207 nfs_t
208
209
210 sandbox_file_t
211
212
213 sandbox_x_client_tmpfs_t
214
215
216 security_t
217
218 /selinux
219
220 user_tmp_t
221
222 /dev/shm/mono.*
223 /var/run/user(/.*)?
224 /tmp/.X11-unix(/.*)?
225 /tmp/.ICE-unix(/.*)?
226 /dev/shm/pulse-shm.*
227 /tmp/.X0-lock
228 /tmp/hsperfdata_root
229 /var/tmp/hsperfdata_root
230 /home/[^/]+/tmp
231 /home/[^/]+/.tmp
232 /tmp/gconfd-[^/]+
233
234
236 semanage fcontext can also be used to manipulate default file context
237 mappings.
238
239 semanage permissive can also be used to manipulate whether or not a
240 process type is permissive.
241
242 semanage module can also be used to enable/disable/install/remove pol‐
243 icy modules.
244
245 semanage boolean can also be used to manipulate the booleans
246
247
248 system-config-selinux is a GUI tool available to customize SELinux pol‐
249 icy settings.
250
251
253 This manual page was auto-generated using sepolicy manpage .
254
255
257 selinux(8), sandbox_x(8), semanage(8), restorecon(8), chcon(1), sepol‐
258 icy(8) , setsebool(8), sandbox_x_client_selinux(8), sand‐
259 box_x_client_selinux(8)
260
261
262
263sandbox_x 19-04-25 sandbox_x_selinux(8)