1telepathy_stream_engiSnEeL_isneulxinPuoxl(i8c)y telepathy_tsetlreepaamt_heyn_gsitnreeam_engine_selinux(8)
2
3
4
6 telepathy_stream_engine_selinux - Security Enhanced Linux Policy for
7 the telepathy_stream_engine processes
8
10 Security-Enhanced Linux secures the telepathy_stream_engine processes
11 via flexible mandatory access control.
12
13 The telepathy_stream_engine processes execute with the telepa‐
14 thy_stream_engine_t SELinux type. You can check if you have these pro‐
15 cesses running by executing the ps command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep telepathy_stream_engine_t
20
21
22
24 The telepathy_stream_engine_t SELinux type can be entered via the
25 telepathy_stream_engine_exec_t file type.
26
27 The default entrypoint paths for the telepathy_stream_engine_t domain
28 are the following:
29
30 /usr/libexec/telepathy-stream-engine
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 telepathy_stream_engine policy is very flexible allowing users to setup
40 their telepathy_stream_engine processes in as secure a method as possi‐
41 ble.
42
43 The following process types are defined for telepathy_stream_engine:
44
45 telepathy_stream_engine_t
46
47 Note: semanage permissive -a telepathy_stream_engine_t can be used to
48 make the process type telepathy_stream_engine_t permissive. SELinux
49 does not deny access to permissive process types, but the AVC (SELinux
50 denials) messages are still generated.
51
52
54 SELinux policy is customizable based on least access required. telepa‐
55 thy_stream_engine policy is extremely flexible and has several booleans
56 that allow you to manipulate the policy and run telepathy_stream_engine
57 with the tightest access possible.
58
59
60
61 If you want to allow users to resolve user passwd entries directly from
62 ldap rather then using a sssd server, you must turn on the authlo‐
63 gin_nsswitch_use_ldap boolean. Disabled by default.
64
65 setsebool -P authlogin_nsswitch_use_ldap 1
66
67
68
69 If you want to deny any process from ptracing or debugging any other
70 processes, you must turn on the deny_ptrace boolean. Enabled by
71 default.
72
73 setsebool -P deny_ptrace 1
74
75
76
77 If you want to allow any process to mmap any file on system with
78 attribute file_type, you must turn on the domain_can_mmap_files bool‐
79 ean. Enabled by default.
80
81 setsebool -P domain_can_mmap_files 1
82
83
84
85 If you want to allow all domains write to kmsg_device, while kernel is
86 executed with systemd.log_target=kmsg parameter, you must turn on the
87 domain_can_write_kmsg boolean. Disabled by default.
88
89 setsebool -P domain_can_write_kmsg 1
90
91
92
93 If you want to allow all domains to use other domains file descriptors,
94 you must turn on the domain_fd_use boolean. Enabled by default.
95
96 setsebool -P domain_fd_use 1
97
98
99
100 If you want to allow all domains to have the kernel load modules, you
101 must turn on the domain_kernel_load_modules boolean. Disabled by
102 default.
103
104 setsebool -P domain_kernel_load_modules 1
105
106
107
108 If you want to allow all domains to execute in fips_mode, you must turn
109 on the fips_mode boolean. Enabled by default.
110
111 setsebool -P fips_mode 1
112
113
114
115 If you want to enable reading of urandom for all domains, you must turn
116 on the global_ssp boolean. Disabled by default.
117
118 setsebool -P global_ssp 1
119
120
121
122 If you want to allow confined applications to run with kerberos, you
123 must turn on the kerberos_enabled boolean. Enabled by default.
124
125 setsebool -P kerberos_enabled 1
126
127
128
129 If you want to allow system to run with NIS, you must turn on the
130 nis_enabled boolean. Disabled by default.
131
132 setsebool -P nis_enabled 1
133
134
135
136 If you want to allow confined applications to use nscd shared memory,
137 you must turn on the nscd_use_shm boolean. Disabled by default.
138
139 setsebool -P nscd_use_shm 1
140
141
142
144 The SELinux process type telepathy_stream_engine_t can manage files
145 labeled with the following file types. The paths listed are the
146 default paths for these file types. Note the processes UID still need
147 to have DAC permissions.
148
149 cache_home_t
150
151 /root/.cache(/.*)?
152 /home/[^/]+/.nv(/.*)?
153 /home/[^/]+/.cache(/.*)?
154
155
157 SELinux requires files to have an extended attribute to define the file
158 type.
159
160 You can see the context of a file using the -Z option to ls
161
162 Policy governs the access confined processes have to these files.
163 SELinux telepathy_stream_engine policy is very flexible allowing users
164 to setup their telepathy_stream_engine processes in as secure a method
165 as possible.
166
167 STANDARD FILE CONTEXT
168
169 SELinux defines the file context types for the telepathy_stream_engine,
170 if you wanted to store files with these types in a diffent paths, you
171 need to execute the semanage command to sepecify alternate labeling and
172 then use restorecon to put the labels on disk.
173
174 semanage fcontext -a -t telepathy_stream_engine_tmp_t '/srv/mytelepa‐
175 thy_stream_engine_content(/.*)?'
176 restorecon -R -v /srv/mytelepathy_stream_engine_content
177
178 Note: SELinux often uses regular expressions to specify labels that
179 match multiple files.
180
181 The following file types are defined for telepathy_stream_engine:
182
183
184
185 telepathy_stream_engine_exec_t
186
187 - Set files with the telepathy_stream_engine_exec_t type, if you want
188 to transition an executable to the telepathy_stream_engine_t domain.
189
190
191
192 telepathy_stream_engine_tmp_t
193
194 - Set files with the telepathy_stream_engine_tmp_t type, if you want to
195 store telepathy stream engine temporary files in the /tmp directories.
196
197
198
199 Note: File context can be temporarily modified with the chcon command.
200 If you want to permanently change the file context you need to use the
201 semanage fcontext command. This will modify the SELinux labeling data‐
202 base. You will need to use restorecon to apply the labels.
203
204
206 semanage fcontext can also be used to manipulate default file context
207 mappings.
208
209 semanage permissive can also be used to manipulate whether or not a
210 process type is permissive.
211
212 semanage module can also be used to enable/disable/install/remove pol‐
213 icy modules.
214
215 semanage boolean can also be used to manipulate the booleans
216
217
218 system-config-selinux is a GUI tool available to customize SELinux pol‐
219 icy settings.
220
221
223 This manual page was auto-generated using sepolicy manpage .
224
225
227 selinux(8), telepathy_stream_engine(8), semanage(8), restorecon(8),
228 chcon(1), sepolicy(8) , setsebool(8)
229
230
231
232telepathy_stream_engine 19-04-25 telepathy_stream_engine_selinux(8)