vmware_selinux(8)

1vmware_selinux(8)            SELinux Policy vmware           vmware_selinux(8)
2
3
4

NAME

6       vmware_selinux  -  Security  Enhanced  Linux Policy for the vmware pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  vmware  processes  via  flexible
11       mandatory access control.
12
13       The  vmware  processes  execute with the vmware_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep vmware_t
20
21
22

ENTRYPOINTS

24       The  vmware_t  SELinux  type  can be entered via the vmware_exec_t file
25       type.
26
27       The default entrypoint paths for the vmware_t domain are the following:
28
29       /opt/vmware/(workstation|player)/bin/vmware,      /opt/vmware/(worksta‐
30       tion|player)/bin/vmware-ping,                     /opt/vmware/(worksta‐
31       tion|player)/bin/vmware-wizard, /usr/bin/vmware,  /usr/bin/vmware-ping,
32       /usr/bin/vmware-wizard,                       /usr/sbin/vmware-serverd,
33       /usr/lib/vmware/bin/vmplayer,            /usr/lib/vmware/bin/vmware-ui,
34       /usr/lib/vmware/bin/vmware-mks
35

PROCESS TYPES

37       SELinux defines process types (domains) for each process running on the
38       system
39
40       You can see the context of a process using the -Z option to ps
41
42       Policy governs the access confined processes have  to  files.   SELinux
43       vmware  policy  is  very  flexible allowing users to setup their vmware
44       processes in as secure a method as possible.
45
46       The following process types are defined for vmware:
47
48       vmware_t, vmware_host_t
49
50       Note: semanage permissive -a vmware_t can be used to make  the  process
51       type  vmware_t  permissive.  SELinux does not deny access to permissive
52       process types, but the AVC (SELinux denials) messages are still  gener‐
53       ated.
54
55

BOOLEANS

57       SELinux  policy is customizable based on least access required.  vmware
58       policy is extremely flexible and has several booleans that allow you to
59       manipulate the policy and run vmware with the tightest access possible.
60
61
62
63       If  you  want  to deny any process from ptracing or debugging any other
64       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
65       default.
66
67       setsebool -P deny_ptrace 1
68
69
70
71       If  you  want  to  allow  any  process  to mmap any file on system with
72       attribute file_type, you must turn on the  domain_can_mmap_files  bool‐
73       ean. Enabled by default.
74
75       setsebool -P domain_can_mmap_files 1
76
77
78
79       If  you want to allow all domains write to kmsg_device, while kernel is
80       executed with systemd.log_target=kmsg parameter, you must turn  on  the
81       domain_can_write_kmsg boolean. Disabled by default.
82
83       setsebool -P domain_can_write_kmsg 1
84
85
86
87       If you want to allow all domains to use other domains file descriptors,
88       you must turn on the domain_fd_use boolean. Enabled by default.
89
90       setsebool -P domain_fd_use 1
91
92
93
94       If you want to allow all domains to have the kernel load  modules,  you
95       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
96       default.
97
98       setsebool -P domain_kernel_load_modules 1
99
100
101
102       If you want to allow all domains to execute in fips_mode, you must turn
103       on the fips_mode boolean. Enabled by default.
104
105       setsebool -P fips_mode 1
106
107
108
109       If you want to enable reading of urandom for all domains, you must turn
110       on the global_ssp boolean. Disabled by default.
111
112       setsebool -P global_ssp 1
113
114
115
116       If you want to allow confined applications to use nscd  shared  memory,
117       you must turn on the nscd_use_shm boolean. Disabled by default.
118
119       setsebool -P nscd_use_shm 1
120
121
122
123       If  you  want to allow regular users direct dri device access, you must
124       turn on the selinuxuser_direct_dri_enabled boolean. Enabled by default.
125
126       setsebool -P selinuxuser_direct_dri_enabled 1
127
128
129
130       If you want to support NFS home  directories,  you  must  turn  on  the
131       use_nfs_home_dirs boolean. Disabled by default.
132
133       setsebool -P use_nfs_home_dirs 1
134
135
136
137       If  you  want  to  support SAMBA home directories, you must turn on the
138       use_samba_home_dirs boolean. Disabled by default.
139
140       setsebool -P use_samba_home_dirs 1
141
142
143
144       If you want to allows clients to write to the X  server  shared  memory
145       segments, you must turn on the xserver_clients_write_xshm boolean. Dis‐
146       abled by default.
147
148       setsebool -P xserver_clients_write_xshm 1
149
150
151
152       If you want to support X userspace object manager, you must turn on the
153       xserver_object_manager boolean. Enabled by default.
154
155       setsebool -P xserver_object_manager 1
156
157
158

MANAGED FILES

160       The  SELinux  process  type  vmware_t can manage files labeled with the
161       following file types.  The paths listed are the default paths for these
162       file types.  Note the processes UID still need to have DAC permissions.
163
164       cifs_t
165
166
167       nfs_t
168
169
170       usbfs_t
171
172
173       user_fonts_cache_t
174
175            /root/.fontconfig(/.*)?
176            /root/.fonts/auto(/.*)?
177            /root/.fonts.cache-.*
178            /home/[^/]+/.fontconfig(/.*)?
179            /home/[^/]+/.fonts/auto(/.*)?
180            /home/[^/]+/.fonts.cache-.*
181
182       vmware_conf_t
183
184            /home/[^/]+/.vmware[^/]*/.*.cfg
185
186       vmware_file_t
187
188            /home/[^/]+/vmware(/.*)?
189            /home/[^/]+/.vmware(/.*)?
190
191       vmware_pid_t
192
193
194       vmware_tmp_t
195
196
197       vmware_tmpfs_t
198
199
200       xserver_tmpfs_t
201
202
203

FILE CONTEXTS

205       SELinux requires files to have an extended attribute to define the file
206       type.
207
208       You can see the context of a file using the -Z option to ls
209
210       Policy governs the access  confined  processes  have  to  these  files.
211       SELinux  vmware  policy  is very flexible allowing users to setup their
212       vmware processes in as secure a method as possible.
213
214       STANDARD FILE CONTEXT
215
216       SELinux defines the file context types for the vmware, if you wanted to
217       store  files  with  these types in a diffent paths, you need to execute
218       the semanage command  to  sepecify  alternate  labeling  and  then  use
219       restorecon to put the labels on disk.
220
221       semanage fcontext -a -t vmware_tmpfs_t '/srv/myvmware_content(/.*)?'
222       restorecon -R -v /srv/myvmware_content
223
224       Note:  SELinux  often  uses  regular expressions to specify labels that
225       match multiple files.
226
227       The following file types are defined for vmware:
228
229
230
231       vmware_conf_t
232
233       - Set files with the vmware_conf_t type, if you want to treat the files
234       as vmware configuration data, usually stored under the /etc directory.
235
236
237
238       vmware_exec_t
239
240       -  Set  files with the vmware_exec_t type, if you want to transition an
241       executable to the vmware_t domain.
242
243
244       Paths:
245            /opt/vmware/(workstation|player)/bin/vmware, /opt/vmware/(worksta‐
246            tion|player)/bin/vmware-ping,                /opt/vmware/(worksta‐
247            tion|player)/bin/vmware-wizard, /usr/bin/vmware,  /usr/bin/vmware-
248            ping,       /usr/bin/vmware-wizard,      /usr/sbin/vmware-serverd,
249            /usr/lib/vmware/bin/vmplayer,       /usr/lib/vmware/bin/vmware-ui,
250            /usr/lib/vmware/bin/vmware-mks
251
252
253       vmware_file_t
254
255       - Set files with the vmware_file_t type, if you want to treat the files
256       as vmware content.
257
258
259       Paths:
260            /home/[^/]+/vmware(/.*)?, /home/[^/]+/.vmware(/.*)?
261
262
263       vmware_host_exec_t
264
265       - Set files with the vmware_host_exec_t type, if you want to transition
266       an executable to the vmware_host_t domain.
267
268
269       Paths:
270            /opt/vmware/(workstation|player)/bin/vmnet-natd,
271            /opt/vmware/(workstation|player)/bin/vmnet-dhcpd,
272            /opt/vmware/(workstation|player)/bin/vmware-nmbd,
273            /opt/vmware/(workstation|player)/bin/vmware-smbd,
274            /opt/vmware/(workstation|player)/bin/vmnet-bridge,
275            /opt/vmware/(workstation|player)/bin/vmnet-netifup,
276            /opt/vmware/(workstation|player)/bin/vmnet-sniffer,
277            /opt/vmware/(workstation|player)/bin/vmware-smbpasswd,
278            /opt/vmware/(workstation|player)/bin/vmware-smbpasswd.bin,
279            /usr/sbin/vmware-guest.*,   /usr/lib/vmware-tools/sbin32/vmware.*,
280            /usr/lib/vmware-tools/sbin64/vmware.*,        /usr/bin/vmnet-natd,
281            /usr/bin/vmware-vmx,  /usr/bin/vmnet-dhcpd,  /usr/bin/vmware-nmbd,
282            /usr/bin/vmware-smbd,  /usr/bin/vmnet-bridge, /usr/bin/vmnet-neti‐
283            fup,       /usr/bin/vmnet-sniffer,        /usr/bin/vmware-network,
284            /usr/bin/vmware-smbpasswd,          /usr/bin/vmware-smbpasswd.bin,
285            /usr/lib/vmware/bin/vmware-vmx
286
287
288       vmware_host_pid_t
289
290       - Set files with the vmware_host_pid_t type, if you want to  store  the
291       vmware host files under the /run directory.
292
293
294       Paths:
295            /var/run/vmnat.*, /var/run/vmnet.*, /var/run/vmware.*
296
297
298       vmware_host_tmp_t
299
300       -  Set  files  with  the  vmware_host_tmp_t  type, if you want to store
301       vmware host temporary files in the /tmp directories.
302
303
304
305       vmware_log_t
306
307       - Set files with the vmware_log_t type, if you want to treat  the  data
308       as vmware log data, usually stored under the /var/log directory.
309
310
311       Paths:
312            /var/log/vmware.*, /var/log/vnetlib.*
313
314
315       vmware_pid_t
316
317       - Set files with the vmware_pid_t type, if you want to store the vmware
318       files under the /run directory.
319
320
321
322       vmware_sys_conf_t
323
324       - Set files with the vmware_sys_conf_t type, if you want to  treat  the
325       files  as  vmware sys configuration data, usually stored under the /etc
326       directory.
327
328
329       Paths:
330            /etc/vmware.*(/.*)?, /usr/lib/vmware/config
331
332
333       vmware_tmp_t
334
335       - Set files with the vmware_tmp_t type, if you  want  to  store  vmware
336       temporary files in the /tmp directories.
337
338
339
340       vmware_tmpfs_t
341
342       -  Set  files with the vmware_tmpfs_t type, if you want to store vmware
343       files on a tmpfs file system.
344
345
346
347       Note: File context can be temporarily modified with the chcon  command.
348       If  you want to permanently change the file context you need to use the
349       semanage fcontext command.  This will modify the SELinux labeling data‐
350       base.  You will need to use restorecon to apply the labels.
351
352

COMMANDS

354       semanage  fcontext  can also be used to manipulate default file context
355       mappings.
356
357       semanage permissive can also be used to manipulate  whether  or  not  a
358       process type is permissive.
359
360       semanage  module can also be used to enable/disable/install/remove pol‐
361       icy modules.
362
363       semanage boolean can also be used to manipulate the booleans
364
365
366       system-config-selinux is a GUI tool available to customize SELinux pol‐
367       icy settings.
368
369

AUTHOR

371       This manual page was auto-generated using sepolicy manpage .
372
373