1spc_selinux(8) SELinux Policy spc spc_selinux(8)
2
6 spc_selinux - Security Enhanced Linux Policy for the spc processes
7
9 Security-Enhanced Linux secures the spc processes via flexible manda‐
10 tory access control.
11 The spc processes execute with the spc_t SELinux type. You can check if
13 you have these processes running by executing the ps command with the
14 -Z qualifier.
15 For example:
17 ps -eZ | grep spc_t
19
23 The spc_t SELinux type can be entered via the container_var_lib_t,
24 unlabeled_t, container_share_t file types.
25 The default entrypoint paths for the spc_t domain are the following:
27 /var/lib/docker(/.*)?, /var/lib/kublet(/.*)?, /var/lib/contain‐
29 ers(/.*)?, /var/lib/docker/.*/config.env, /var/lib/docker/init(/.*)?,
30 /var/lib/docker/overlay(/.*)?, /var/lib/docker/containers/.*/hosts,
31 /var/lib/docker/containers/.*/hostname
32
34 SELinux defines process types (domains) for each process running on the
35 system
36 You can see the context of a process using the -Z option to ps
38 Policy governs the access confined processes have to files. SELinux
40 spc policy is very flexible allowing users to setup their spc processes
41 in as secure a method as possible.
42 The following process types are defined for spc:
44 spc_t
46 Note: semanage permissive -a spc_t can be used to make the process type
48 spc_t permissive. SELinux does not deny access to permissive process
49 types, but the AVC (SELinux denials) messages are still generated.
50
53 SELinux policy is customizable based on least access required. spc
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run spc with the tightest access possible.
56 If you want to deny user domains applications to map a memory region as
60 both executable and writable, this is dangerous and the executable
61 should be reported in bugzilla, you must turn on the deny_execmem bool‐
62 ean. Enabled by default.
63 setsebool -P deny_execmem 1
65 If you want to deny any process from ptracing or debugging any other
69 processes, you must turn on the deny_ptrace boolean. Enabled by
70 default.
71 setsebool -P deny_ptrace 1
73 If you want to allow any process to mmap any file on system with
77 attribute file_type, you must turn on the domain_can_mmap_files bool‐
78 ean. Enabled by default.
79 setsebool -P domain_can_mmap_files 1
81 If you want to allow all domains write to kmsg_device, while kernel is
85 executed with systemd.log_target=kmsg parameter, you must turn on the
86 domain_can_write_kmsg boolean. Disabled by default.
87 setsebool -P domain_can_write_kmsg 1
89 If you want to allow all domains to use other domains file descriptors,
93 you must turn on the domain_fd_use boolean. Enabled by default.
94 setsebool -P domain_fd_use 1
96 If you want to allow all domains to have the kernel load modules, you
100 must turn on the domain_kernel_load_modules boolean. Disabled by
101 default.
102 setsebool -P domain_kernel_load_modules 1
104 If you want to allow all domains to execute in fips_mode, you must turn
108 on the fips_mode boolean. Enabled by default.
109 setsebool -P fips_mode 1
111 If you want to enable reading of urandom for all domains, you must turn
115 on the global_ssp boolean. Disabled by default.
116 setsebool -P global_ssp 1
118 If you want to control the ability to mmap a low area of the address
122 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
123 the mmap_low_allowed boolean. Disabled by default.
124 setsebool -P mmap_low_allowed 1
126 If you want to disable kernel module loading, you must turn on the
130 secure_mode_insmod boolean. Enabled by default.
131 setsebool -P secure_mode_insmod 1
133 If you want to boolean to determine whether the system permits loading
137 policy, setting enforcing mode, and changing boolean values. Set this
138 to true and you have to reboot to set it back, you must turn on the
139 secure_mode_policyload boolean. Enabled by default.
140 setsebool -P secure_mode_policyload 1
142 If you want to allow unconfined executables to make their heap memory
146 executable. Doing this is a really bad idea. Probably indicates a
147 badly coded executable, but could indicate an attack. This executable
148 should be reported in bugzilla, you must turn on the selin‐
149 uxuser_execheap boolean. Disabled by default.
150 setsebool -P selinuxuser_execheap 1
152 If you want to allow all unconfined executables to use libraries
156 requiring text relocation that are not labeled textrel_shlib_t, you
157 must turn on the selinuxuser_execmod boolean. Enabled by default.
158 setsebool -P selinuxuser_execmod 1
160 If you want to allow unconfined executables to make their stack exe‐
164 cutable. This should never, ever be necessary. Probably indicates a
165 badly coded executable, but could indicate an attack. This executable
166 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
167 stack boolean. Enabled by default.
168 setsebool -P selinuxuser_execstack 1
170 If you want to support X userspace object manager, you must turn on the
174 xserver_object_manager boolean. Enabled by default.
175 setsebool -P xserver_object_manager 1
177
181 The SELinux process type spc_t can manage files labeled with the fol‐
182 lowing file types. The paths listed are the default paths for these
183 file types. Note the processes UID still need to have DAC permissions.
184 file_type
186 all files on the system
188
191 semanage fcontext can also be used to manipulate default file context
192 mappings.
193 semanage permissive can also be used to manipulate whether or not a
195 process type is permissive.
196 semanage module can also be used to enable/disable/install/remove pol‐
198 icy modules.
199 semanage boolean can also be used to manipulate the booleans
201 system-config-selinux is a GUI tool available to customize SELinux pol‐
204 icy settings.
205
208 This manual page was auto-generated using sepolicy manpage .
209
212 selinux(8), spc(8), semanage(8), restorecon(8), chcon(1), sepolicy(8) ,
213 setsebool(8)
214spc 19-04-25 spc_selinux(8)