xdm_selinux(8)

1xdm_selinux(8)                SELinux Policy xdm                xdm_selinux(8)
2
3
4

NAME

6       xdm_selinux - Security Enhanced Linux Policy for the xdm processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the xdm processes via flexible manda‐
10       tory access control.
11
12       The xdm processes execute with the xdm_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep xdm_t
19
20
21

ENTRYPOINTS

23       The xdm_t SELinux type can be entered via the xdm_exec_t file type.
24
25       The default entrypoint paths for the xdm_t domain are the following:
26
27       /usr/s?bin/gdm(3)?,     /usr/s?bin/lightdm*,      /usr/s?bin/[mxgkw]dm,
28       /usr/s?bin/gdm-binary,                       /usr/s?bin/lxdm(-binary)?,
29       /usr/X11R6/bin/[xgkw]dm,   /usr/bin/razor-lightdm-.*,    /usr/bin/sddm,
30       /usr/bin/slim,   /usr/bin/gpe-dm,   /opt/kde3/bin/kdm,   /usr/sbin/mdm-
31       binary, /usr/bin/sddm-greeter, /etc/rc.d/init.d/x11-common
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       xdm policy is very flexible allowing users to setup their xdm processes
41       in as secure a method as possible.
42
43       The following process types are defined for xdm:
44
45       xdm_t, xdm_unconfined_t
46
47       Note: semanage permissive -a xdm_t can be used to make the process type
48       xdm_t permissive. SELinux does not deny access  to  permissive  process
49       types, but the AVC (SELinux denials) messages are still generated.
50
51

BOOLEANS

53       SELinux  policy  is  customizable  based on least access required.  xdm
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate the policy and run xdm with the tightest access possible.
56
57
58
59       If  you want to allows xdm_t to bind on vnc_port_t(5910), you must turn
60       on the xdm_bind_vnc_tcp_port boolean. Disabled by default.
61
62       setsebool -P xdm_bind_vnc_tcp_port 1
63
64
65
66       If you want to allow the graphical login program to execute bootloader,
67       you must turn on the xdm_exec_bootloader boolean. Disabled by default.
68
69       setsebool -P xdm_exec_bootloader 1
70
71
72
73       If  you  want to allow the graphical login program to login directly as
74       sysadm_r:sysadm_t, you must turn on the xdm_sysadm_login boolean.  Dis‐
75       abled by default.
76
77       setsebool -P xdm_sysadm_login 1
78
79
80
81       If  you  want  to  allow the graphical login program to create files in
82       HOME dirs as xdm_home_t, you must turn on the  xdm_write_home  boolean.
83       Disabled by default.
84
85       setsebool -P xdm_write_home 1
86
87
88
89       If you want to allow users to resolve user passwd entries directly from
90       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
91       gin_nsswitch_use_ldap boolean. Disabled by default.
92
93       setsebool -P authlogin_nsswitch_use_ldap 1
94
95
96
97       If  you  want  to  allow users to login using a radius server, you must
98       turn on the authlogin_radius boolean. Disabled by default.
99
100       setsebool -P authlogin_radius 1
101
102
103
104       If you want to allow users to login using a yubikey OTP server or chal‐
105       lenge  response  mode,  you must turn on the authlogin_yubikey boolean.
106       Disabled by default.
107
108       setsebool -P authlogin_yubikey 1
109
110
111
112       If you want to allow all daemons the ability to  read/write  terminals,
113       you must turn on the daemons_use_tty boolean. Disabled by default.
114
115       setsebool -P daemons_use_tty 1
116
117
118
119       If you want to deny user domains applications to map a memory region as
120       both executable and writable, this  is  dangerous  and  the  executable
121       should be reported in bugzilla, you must turn on the deny_execmem bool‐
122       ean. Enabled by default.
123
124       setsebool -P deny_execmem 1
125
126
127
128       If you want to deny any process from ptracing or  debugging  any  other
129       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
130       default.
131
132       setsebool -P deny_ptrace 1
133
134
135
136       If you want to allow any process  to  mmap  any  file  on  system  with
137       attribute  file_type,  you must turn on the domain_can_mmap_files bool‐
138       ean. Enabled by default.
139
140       setsebool -P domain_can_mmap_files 1
141
142
143
144       If you want to allow all domains write to kmsg_device, while kernel  is
145       executed  with  systemd.log_target=kmsg parameter, you must turn on the
146       domain_can_write_kmsg boolean. Disabled by default.
147
148       setsebool -P domain_can_write_kmsg 1
149
150
151
152       If you want to allow all domains to use other domains file descriptors,
153       you must turn on the domain_fd_use boolean. Enabled by default.
154
155       setsebool -P domain_fd_use 1
156
157
158
159       If  you  want to allow all domains to have the kernel load modules, you
160       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
161       default.
162
163       setsebool -P domain_kernel_load_modules 1
164
165
166
167       If you want to allow all domains to execute in fips_mode, you must turn
168       on the fips_mode boolean. Enabled by default.
169
170       setsebool -P fips_mode 1
171
172
173
174       If you want to enable reading of urandom for all domains, you must turn
175       on the global_ssp boolean. Disabled by default.
176
177       setsebool -P global_ssp 1
178
179
180
181       If  you  want  to allow confined applications to run with kerberos, you
182       must turn on the kerberos_enabled boolean. Enabled by default.
183
184       setsebool -P kerberos_enabled 1
185
186
187
188       If you want to allow system to run with  NIS,  you  must  turn  on  the
189       nis_enabled boolean. Disabled by default.
190
191       setsebool -P nis_enabled 1
192
193
194
195       If  you  want to allow confined applications to use nscd shared memory,
196       you must turn on the nscd_use_shm boolean. Disabled by default.
197
198       setsebool -P nscd_use_shm 1
199
200
201
202       If you want to enable polyinstantiated directory support, you must turn
203       on the polyinstantiation_enabled boolean. Disabled by default.
204
205       setsebool -P polyinstantiation_enabled 1
206
207
208
209       If  you  want  to allow unconfined executables to make their stack exe‐
210       cutable.  This should never, ever be necessary.  Probably  indicates  a
211       badly  coded  executable, but could indicate an attack. This executable
212       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
213       stack boolean. Enabled by default.
214
215       setsebool -P selinuxuser_execstack 1
216
217
218
219       If  you want to support ecryptfs home directories, you must turn on the
220       use_ecryptfs_home_dirs boolean. Disabled by default.
221
222       setsebool -P use_ecryptfs_home_dirs 1
223
224
225
226       If you want to support fusefs home directories, you must  turn  on  the
227       use_fusefs_home_dirs boolean. Disabled by default.
228
229       setsebool -P use_fusefs_home_dirs 1
230
231
232
233       If  you  want  to  support  NFS  home directories, you must turn on the
234       use_nfs_home_dirs boolean. Disabled by default.
235
236       setsebool -P use_nfs_home_dirs 1
237
238
239
240       If you want to support SAMBA home directories, you  must  turn  on  the
241       use_samba_home_dirs boolean. Disabled by default.
242
243       setsebool -P use_samba_home_dirs 1
244
245
246
247       If you want to support X userspace object manager, you must turn on the
248       xserver_object_manager boolean. Enabled by default.
249
250       setsebool -P xserver_object_manager 1
251
252
253

PORT TYPES

255       SELinux defines port types to represent TCP and UDP ports.
256
257       You can see the types associated with a port  by  using  the  following
258       command:
259
260       semanage port -l
261
262
263       Policy  governs  the  access  confined  processes  have to these ports.
264       SELinux xdm policy is very flexible allowing users to setup  their  xdm
265       processes in as secure a method as possible.
266
267       The following port types are defined for xdm:
268
269
270       xdmcp_port_t
271
272
273
274       Default Defined Ports:
275                 tcp 177
276                 udp 177
277

MANAGED FILES

279       The  SELinux  process type xdm_t can manage files labeled with the fol‐
280       lowing file types.  The paths listed are the default  paths  for  these
281       file types.  Note the processes UID still need to have DAC permissions.
282
283       anon_inodefs_t
284
285
286       auth_cache_t
287
288            /var/cache/coolkey(/.*)?
289
290       auth_home_t
291
292            /root/.yubico(/.*)?
293            /root/.google_authenticator
294            /root/.google_authenticator~
295            /home/[^/]+/.yubico(/.*)?
296            /home/[^/]+/.google_authenticator
297            /home/[^/]+/.google_authenticator~
298
299       cgroup_t
300
301            /sys/fs/cgroup
302
303       cifs_t
304
305
306       ecryptfs_t
307
308            /home/[^/]+/.Private(/.*)?
309            /home/[^/]+/.ecryptfs(/.*)?
310
311       etc_runtime_t
312
313            /[^/]+
314            /etc/mtab.*
315            /etc/blkid(/.*)?
316            /etc/nologin.*
317            /etc/.fstab.hal..+
318            /halt
319            /fastboot
320            /poweroff
321            /etc/cmtab
322            /forcefsck
323            /.autofsck
324            /.suspended
325            /fsckoptions
326            /var/.updated
327            /etc/.updated
328            /.autorelabel
329            /etc/securetty
330            /etc/nohotplug
331            /etc/killpower
332            /etc/ioctl.save
333            /etc/fstab.REVOKE
334            /etc/network/ifstate
335            /etc/sysconfig/hwconf
336            /etc/ptal/ptal-printd-like
337            /etc/sysconfig/iptables.save
338            /etc/xorg.conf.d/00-system-setup-keyboard.conf
339            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
340
341       faillog_t
342
343            /var/log/btmp.*
344            /var/log/faillog.*
345            /var/log/tallylog.*
346            /var/run/faillock(/.*)?
347
348       fonts_cache_t
349
350            /var/cache/fontconfig(/.*)?
351
352       fusefs_t
353
354            /var/run/user/[^/]*/gvfs
355
356       gconf_home_t
357
358            /root/.local.*
359            /root/.gconf(d)?(/.*)?
360            /home/[^/]+/.local.*
361            /home/[^/]+/.gconf(d)?(/.*)?
362
363       gnome_home_type
364
365
366       initrc_var_run_t
367
368            /var/run/utmp
369            /var/run/random-seed
370            /var/run/runlevel.dir
371            /var/run/setmixer_flag
372
373       krb5_host_rcache_t
374
375            /var/cache/krb5rcache(/.*)?
376            /var/tmp/nfs_0
377            /var/tmp/DNS_25
378            /var/tmp/host_0
379            /var/tmp/imap_0
380            /var/tmp/HTTP_23
381            /var/tmp/HTTP_48
382            /var/tmp/ldap_55
383            /var/tmp/ldap_487
384            /var/tmp/ldapmap1_0
385
386       lastlog_t
387
388            /var/log/lastlog.*
389
390       locale_t
391
392            /etc/locale.conf
393            /etc/vconsole.conf
394            /usr/lib/locale(/.*)?
395            /usr/share/locale(/.*)?
396            /usr/share/zoneinfo(/.*)?
397            /usr/share/X11/locale(/.*)?
398            /etc/timezone
399            /etc/localtime
400            /etc/sysconfig/clock
401            /etc/avahi/etc/localtime
402            /var/empty/sshd/etc/localtime
403            /var/named/chroot/etc/localtime
404            /var/spool/postfix/etc/localtime
405
406       nfs_t
407
408
409       pam_var_console_t
410
411            /var/run/console(/.*)?
412
413       pam_var_run_t
414
415            /var/(db|adm)/sudo(/.*)?
416            /var/run/sudo(/.*)?
417            /var/lib/sudo(/.*)?
418            /var/run/sepermit(/.*)?
419            /var/run/pam_mount(/.*)?
420
421       security_t
422
423            /selinux
424
425       sysfs_t
426
427            /sys(/.*)?
428
429       systemd_passwd_var_run_t
430
431            /var/run/systemd/ask-password(/.*)?
432            /var/run/systemd/ask-password-block(/.*)?
433
434       user_fonts_t
435
436            /root/.fonts(/.*)?
437            /tmp/.font-unix(/.*)?
438            /home/[^/]+/.fonts(/.*)?
439            /home/[^/]+/.local/share/fonts(/.*)?
440
441       user_tmp_t
442
443            /dev/shm/mono.*
444            /var/run/user(/.*)?
445            /tmp/.X11-unix(/.*)?
446            /tmp/.ICE-unix(/.*)?
447            /dev/shm/pulse-shm.*
448            /tmp/.X0-lock
449            /tmp/hsperfdata_root
450            /var/tmp/hsperfdata_root
451            /home/[^/]+/tmp
452            /home/[^/]+/.tmp
453            /tmp/gconfd-[^/]+
454
455       user_tmp_type
456
457            all user tmp files
458
459       var_auth_t
460
461            /var/ace(/.*)?
462            /var/rsa(/.*)?
463            /var/lib/abl(/.*)?
464            /var/lib/rsa(/.*)?
465            /var/lib/pam_ssh(/.*)?
466            /var/run/pam_ssh(/.*)?
467            /var/lib/pam_shield(/.*)?
468            /var/opt/quest/vas/vasd(/.*)?
469            /var/lib/google-authenticator(/.*)?
470
471       wtmp_t
472
473            /var/log/wtmp.*
474
475       xauth_home_t
476
477            /root/.xauth.*
478            /root/.Xauth.*
479            /root/.serverauth.*
480            /root/.Xauthority.*
481            /var/lib/pqsql/.xauth.*
482            /var/lib/pqsql/.Xauthority.*
483            /var/lib/nxserver/home/.xauth.*
484            /var/lib/nxserver/home/.Xauthority.*
485            /home/[^/]+/.xauth.*
486            /home/[^/]+/.Xauth.*
487            /home/[^/]+/.serverauth.*
488            /home/[^/]+/.Xauthority.*
489
490       xdm_home_t
491
492            /root/.dmrc.*
493            /root/.xsession-errors.*
494            /home/[^/]+/.dmrc.*
495            /home/[^/]+/.cache/gdm(/.*)?
496            /home/[^/]+/.xsession-errors.*
497
498       xdm_lock_t
499
500
501       xdm_log_t
502
503            /var/log/[mkwx]dm.log.*
504            /var/log/mdm(/.*)?
505            /var/log/lxdm.log.*
506            /var/log/slim.log.*
507
508       xdm_rw_etc_t
509
510            /etc/X11/wdm(/.*)?
511            /etc/opt/VirtualGL(/.*)?
512
513       xdm_spool_t
514
515            /var/spool/[mg]dm(/.*)?
516
517       xdm_tmpfs_t
518
519
520       xdm_var_lib_t
521
522            /var/lib/[mxkwg]dm(/.*)?
523            /var/cache/[mg]dm(/.*)?
524            /var/lib/gdm(3)?(/.*)?
525            /var/lib/sddm(/.*)?
526            /var/lib/lxdm(/.*)?
527            /var/lib/lightdm(/.*)?
528            /var/cache/lightdm(/.*)?
529            /var/lib/lightdm-data(/.*)?
530
531       xdm_var_run_t
532
533            /etc/kde[34]?/kdm/backgroundrc
534            /var/run/[kgm]dm(/.*)?
535            /var/run/gdm(3)?.pid
536            /var/run/gdm(3)?(/.*)?
537            /usr/lib/qt-.*/etc/settings(/.*)?
538            /var/run/slim.*
539            /var/run/lxdm(/.*)?
540            /var/run/sddm(/.*)?
541            /var/run/xauth(/.*)?
542            /var/run/xdmctl(/.*)?
543            /var/run/lightdm(/.*)?
544            /var/run/systemd/multi-session-x(/.*)?
545            /var/run/xdm.pid
546            /var/run/lxdm.pid
547            /var/run/lxdm.auth
548            /var/run/gdm_socket
549
550       xkb_var_lib_t
551
552            /var/lib/xkb(/.*)?
553            /usr/X11R6/lib/X11/xkb/.*
554            /usr/X11R6/lib/X11/xkb
555
556       xserver_log_t
557
558            /var/[xgkw]dm(/.*)?
559            /usr/var/[xgkw]dm(/.*)?
560            /var/log/gdm(3)?(/.*)?
561            /var/log/Xorg.*
562            /var/log/XFree86.*
563            /var/log/lightdm(/.*)?
564            /var/log/nvidia-installer.log.*
565
566       xserver_tmpfs_t
567
568
569

FILE CONTEXTS

571       SELinux requires files to have an extended attribute to define the file
572       type.
573
574       You can see the context of a file using the -Z option to ls
575
576       Policy governs the access  confined  processes  have  to  these  files.
577       SELinux  xdm  policy is very flexible allowing users to setup their xdm
578       processes in as secure a method as possible.
579
580       EQUIVALENCE DIRECTORIES
581
582
583       xdm policy stores data with multiple different file context types under
584       the /var/run/gdm(3)? directory.  If you would like to store the data in
585       a different directory you can use the semanage  command  to  create  an
586       equivalence  mapping.   If you wanted to store this data under the /srv
587       dirctory you would execute the following command:
588
589       semanage fcontext -a -e /var/run/gdm(3)? /srv/gdm(3)?
590       restorecon -R -v /srv/gdm(3)?
591
592       xdm policy stores data with multiple different file context types under
593       the /var/lib/lightdm directory.  If you would like to store the data in
594       a different directory you can use the semanage  command  to  create  an
595       equivalence  mapping.   If you wanted to store this data under the /srv
596       dirctory you would execute the following command:
597
598       semanage fcontext -a -e /var/lib/lightdm /srv/lightdm
599       restorecon -R -v /srv/lightdm
600
601       xdm policy stores data with multiple different file context types under
602       the  /var/run/lxdm directory.  If you would like to store the data in a
603       different directory you can use  the  semanage  command  to  create  an
604       equivalence  mapping.   If you wanted to store this data under the /srv
605       dirctory you would execute the following command:
606
607       semanage fcontext -a -e /var/run/lxdm /srv/lxdm
608       restorecon -R -v /srv/lxdm
609
610       STANDARD FILE CONTEXT
611
612       SELinux defines the file context types for the xdm, if  you  wanted  to
613       store  files  with  these types in a diffent paths, you need to execute
614       the semanage command  to  sepecify  alternate  labeling  and  then  use
615       restorecon to put the labels on disk.
616
617       semanage fcontext -a -t xdm_var_run_t '/srv/myxdm_content(/.*)?'
618       restorecon -R -v /srv/myxdm_content
619
620       Note:  SELinux  often  uses  regular expressions to specify labels that
621       match multiple files.
622
623       The following file types are defined for xdm:
624
625
626
627       xdm_etc_t
628
629       - Set files with the xdm_etc_t type, if you want to store xdm files  in
630       the /etc directories.
631
632
633
634       xdm_exec_t
635
636       - Set files with the xdm_exec_t type, if you want to transition an exe‐
637       cutable to the xdm_t domain.
638
639
640       Paths:
641            /usr/s?bin/gdm(3)?,   /usr/s?bin/lightdm*,   /usr/s?bin/[mxgkw]dm,
642            /usr/s?bin/gdm-binary,                  /usr/s?bin/lxdm(-binary)?,
643            /usr/X11R6/bin/[xgkw]dm, /usr/bin/razor-lightdm-.*, /usr/bin/sddm,
644            /usr/bin/slim,  /usr/bin/gpe-dm, /opt/kde3/bin/kdm, /usr/sbin/mdm-
645            binary, /usr/bin/sddm-greeter, /etc/rc.d/init.d/x11-common
646
647
648       xdm_home_t
649
650       - Set files with the xdm_home_t type, if you want to store xdm files in
651       the users home directory.
652
653
654       Paths:
655            /root/.dmrc.*,    /root/.xsession-errors.*,   /home/[^/]+/.dmrc.*,
656            /home/[^/]+/.cache/gdm(/.*)?, /home/[^/]+/.xsession-errors.*
657
658
659       xdm_lock_t
660
661       - Set files with the xdm_lock_t type, if you want to treat the files as
662       xdm lock data, stored under the /var/lock directory
663
664
665
666       xdm_log_t
667
668       -  Set  files with the xdm_log_t type, if you want to treat the data as
669       xdm log data, usually stored under the /var/log directory.
670
671
672       Paths:
673            /var/log/[mkwx]dm.log.*, /var/log/mdm(/.*)?,  /var/log/lxdm.log.*,
674            /var/log/slim.log.*
675
676
677       xdm_rw_etc_t
678
679       -  Set  files  with  the xdm_rw_etc_t type, if you want to store xdm rw
680       files in the /etc directories.
681
682
683       Paths:
684            /etc/X11/wdm(/.*)?, /etc/opt/VirtualGL(/.*)?
685
686
687       xdm_spool_t
688
689       - Set files with the xdm_spool_t type, if you want  to  store  the  xdm
690       files under the /var/spool directory.
691
692
693
694       xdm_tmpfs_t
695
696       -  Set  files with the xdm_tmpfs_t type, if you want to store xdm files
697       on a tmpfs file system.
698
699
700
701       xdm_unconfined_exec_t
702
703       - Set files with the xdm_unconfined_exec_t type, if you want to transi‐
704       tion an executable to the xdm_unconfined_t domain.
705
706
707       Paths:
708            /etc/[mg]dm/Init(/.*)?,               /etc/[mg]dm/PostLogin(/.*)?,
709            /etc/[mg]dm/PreSession(/.*)?, /etc/[mg]dm/PostSession(/.*)?
710
711
712       xdm_var_lib_t
713
714       - Set files with the xdm_var_lib_t type, if you want to store  the  xdm
715       files under the /var/lib directory.
716
717
718       Paths:
719            /var/lib/[mxkwg]dm(/.*)?,                 /var/cache/[mg]dm(/.*)?,
720            /var/lib/gdm(3)?(/.*)?, /var/lib/sddm(/.*)?,  /var/lib/lxdm(/.*)?,
721            /var/lib/lightdm(/.*)?,                  /var/cache/lightdm(/.*)?,
722            /var/lib/lightdm-data(/.*)?
723
724
725       xdm_var_run_t
726
727       - Set files with the xdm_var_run_t type, if you want to store  the  xdm
728       files under the /run or /var/run directory.
729
730
731       Paths:
732            /etc/kde[34]?/kdm/backgroundrc,            /var/run/[kgm]dm(/.*)?,
733            /var/run/gdm(3)?.pid,                      /var/run/gdm(3)?(/.*)?,
734            /usr/lib/qt-.*/etc/settings(/.*)?,                /var/run/slim.*,
735            /var/run/lxdm(/.*)?,  /var/run/sddm(/.*)?,   /var/run/xauth(/.*)?,
736            /var/run/xdmctl(/.*)?,    /var/run/lightdm(/.*)?,    /var/run/sys‐
737            temd/multi-session-x(/.*)?,  /var/run/xdm.pid,  /var/run/lxdm.pid,
738            /var/run/lxdm.auth, /var/run/gdm_socket
739
740
741       Note:  File context can be temporarily modified with the chcon command.
742       If you want to permanently change the file context you need to use  the
743       semanage fcontext command.  This will modify the SELinux labeling data‐
744       base.  You will need to use restorecon to apply the labels.
745
746

COMMANDS

748       semanage fcontext can also be used to manipulate default  file  context
749       mappings.
750
751       semanage  permissive  can  also  be used to manipulate whether or not a
752       process type is permissive.
753
754       semanage module can also be used to enable/disable/install/remove  pol‐
755       icy modules.
756
757       semanage port can also be used to manipulate the port definitions
758
759       semanage boolean can also be used to manipulate the booleans
760
761
762       system-config-selinux is a GUI tool available to customize SELinux pol‐
763       icy settings.
764
765

AUTHOR

767       This manual page was auto-generated using sepolicy manpage .
768
769