staff_selinux(8)

1staff_selinux(8)      staff SELinux Policy documentation      staff_selinux(8)
2
3
4

NAME

6       staff_u  -  Administrator's unprivileged user - Security Enhanced Linux
7       Policy
8
9

DESCRIPTION

11       staff_u is an SELinux User defined in the SELinux policy. SELinux users
12       have  default  roles,  staff_r.   The  default role has a default type,
13       staff_t, associated with it.
14
15       The SELinux user will usually login to a system  with  a  context  that
16       looks like:
17
18       staff_u:staff_r:staff_t:s0 - s0:c0.c1023
19
20       Linux  users  are  automatically  assigned  an  SELinux users at login.
21       Login programs use the SELinux User to assign initial  context  to  the
22       user's shell.
23
24       SELinux policy uses the context to control the user's access.
25
26       By  default  all  users  are  assigned  to  the  SELinux  user  via the
27       __default__ flag
28
29       On Targeted policy systems the __default__  user  is  assigned  to  the
30       unconfined_u SELinux user.
31
32       You can list all Linux User to SELinux user mapping using:
33
34       semanage login -l
35
36       If  you  wanted  to  change the default user mapping to use the staff_u
37       user, you would execute:
38
39       semanage login -m -s staff_u __default__
40
41
42       If you want to map the one Linux user (joe) to the SELinux user  staff,
43       you would execute:
44
45       $ semanage login -a -s staff_u joe
46
47
48

USER DESCRIPTION

50       The  SELinux  user staff_u is defined in policy as a unprivileged user.
51       SELinux prevents unprivileged users  from  doing  administration  tasks
52       without transitioning to a different role.
53
54

SUDO

56       The SELinux user staff can execute sudo.
57
58       You  can  set up sudo to allow staff to transition to an administrative
59       domain:
60
61       Add one or more of the following record to sudoers using visudo.
62
63
64       USERNAME ALL=(ALL) ROLE=webadm_r TYPE=webadm_t COMMAND
65       sudo will run COMMAND as staff_u:webadm_r:webadm_t:LEVEL
66
67       You might also need to add one or more  of  these  new  roles  to  your
68       SELinux user record.
69
70       List the SELinux roles your SELinux user can reach by executing:
71
72       $ semanage user -l |grep selinux_name
73
74       Modify the roles list and add staff_r to this list.
75
76       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
77       logadm_r dbadm_r auditadm_r' staff_u
78
79       For more details you can see semanage man page.
80
81
82       USERNAME ALL=(ALL) ROLE=unconfined_r TYPE=unconfined_t COMMAND
83       sudo will run COMMAND as staff_u:unconfined_r:unconfined_t:LEVEL
84
85       You might also need to add one or more  of  these  new  roles  to  your
86       SELinux user record.
87
88       List the SELinux roles your SELinux user can reach by executing:
89
90       $ semanage user -l |grep selinux_name
91
92       Modify the roles list and add staff_r to this list.
93
94       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
95       logadm_r dbadm_r auditadm_r' staff_u
96
97       For more details you can see semanage man page.
98
99
100       USERNAME ALL=(ALL) ROLE=sysadm_r TYPE=sysadm_t COMMAND
101       sudo will run COMMAND as staff_u:sysadm_r:sysadm_t:LEVEL
102
103       You might also need to add one or more  of  these  new  roles  to  your
104       SELinux user record.
105
106       List the SELinux roles your SELinux user can reach by executing:
107
108       $ semanage user -l |grep selinux_name
109
110       Modify the roles list and add staff_r to this list.
111
112       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
113       logadm_r dbadm_r auditadm_r' staff_u
114
115       For more details you can see semanage man page.
116
117
118       USERNAME ALL=(ALL) ROLE=secadm_r TYPE=secadm_t COMMAND
119       sudo will run COMMAND as staff_u:secadm_r:secadm_t:LEVEL
120
121       You might also need to add one or more  of  these  new  roles  to  your
122       SELinux user record.
123
124       List the SELinux roles your SELinux user can reach by executing:
125
126       $ semanage user -l |grep selinux_name
127
128       Modify the roles list and add staff_r to this list.
129
130       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
131       logadm_r dbadm_r auditadm_r' staff_u
132
133       For more details you can see semanage man page.
134
135
136       USERNAME ALL=(ALL) ROLE=logadm_r TYPE=logadm_t COMMAND
137       sudo will run COMMAND as staff_u:logadm_r:logadm_t:LEVEL
138
139       You might also need to add one or more  of  these  new  roles  to  your
140       SELinux user record.
141
142       List the SELinux roles your SELinux user can reach by executing:
143
144       $ semanage user -l |grep selinux_name
145
146       Modify the roles list and add staff_r to this list.
147
148       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
149       logadm_r dbadm_r auditadm_r' staff_u
150
151       For more details you can see semanage man page.
152
153
154       USERNAME ALL=(ALL) ROLE=dbadm_r TYPE=dbadm_t COMMAND
155       sudo will run COMMAND as staff_u:dbadm_r:dbadm_t:LEVEL
156
157       You might also need to add one or more  of  these  new  roles  to  your
158       SELinux user record.
159
160       List the SELinux roles your SELinux user can reach by executing:
161
162       $ semanage user -l |grep selinux_name
163
164       Modify the roles list and add staff_r to this list.
165
166       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
167       logadm_r dbadm_r auditadm_r' staff_u
168
169       For more details you can see semanage man page.
170
171
172       USERNAME ALL=(ALL) ROLE=auditadm_r TYPE=auditadm_t COMMAND
173       sudo will run COMMAND as staff_u:auditadm_r:auditadm_t:LEVEL
174
175       You might also need to add one or more  of  these  new  roles  to  your
176       SELinux user record.
177
178       List the SELinux roles your SELinux user can reach by executing:
179
180       $ semanage user -l |grep selinux_name
181
182       Modify the roles list and add staff_r to this list.
183
184       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
185       logadm_r dbadm_r auditadm_r' staff_u
186
187       For more details you can see semanage man page.
188
189
190       The SELinux type staff_t is not allowed to execute sudo.
191
192

X WINDOWS LOGIN

194       The SELinux user staff_u is able to X Windows login.
195
196

NETWORK

198       The SELinux user staff_u is able to listen on the following tcp ports.
199
200              6000-6020
201
202              3689
203
204              all ports > 1024
205
206              32768-61000
207
208              all ports with out defined types
209
210
211       The SELinux user staff_u is able to connect to the following tcp ports.
212
213              all ports
214
215              8955
216
217              53,853
218
219              5432,9898
220
221              389,636,3268,3269,7389
222
223              111
224
225              all ports < 1024
226
227              32768-61000
228
229              all ports with out defined types
230
231              88,750,4444
232
233              9080
234
235
236       The SELinux user staff_u is able to listen on the following udp ports.
237
238              32768-61000
239
240              all ports with out defined types
241
242              all ports > 1024
243
244
245       The SELinux user staff_u is able to connect to the following tcp ports.
246
247              all ports
248
249              8955
250
251              53,853
252
253              5432,9898
254
255              389,636,3268,3269,7389
256
257              111
258
259              all ports < 1024
260
261              32768-61000
262
263              all ports with out defined types
264
265              88,750,4444
266
267              9080
268
269

BOOLEANS

271       SELinux policy is customizable based on least access  required.   staff
272       policy is extremely flexible and has several booleans that allow you to
273       manipulate the policy and run staff with the tightest access possible.
274
275
276
277       If you want to allow staff user  to  create  and  transition  to  svirt
278       domains,  you  must  turn  on  the staff_use_svirt boolean. Disabled by
279       default.
280
281       setsebool -P staff_use_svirt 1
282
283
284
285       If you want to allow users to resolve user passwd entries directly from
286       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
287       gin_nsswitch_use_ldap boolean. Disabled by default.
288
289       setsebool -P authlogin_nsswitch_use_ldap 1
290
291
292
293       If you want to determine whether crond can execute  jobs  in  the  user
294       domain  as  opposed to the the generic cronjob domain, you must turn on
295       the cron_userdomain_transition boolean. Enabled by default.
296
297       setsebool -P cron_userdomain_transition 1
298
299
300
301       If you want to deny user domains applications to map a memory region as
302       both  executable  and  writable,  this  is dangerous and the executable
303       should be reported in bugzilla, you must turn on the deny_execmem bool‐
304       ean. Enabled by default.
305
306       setsebool -P deny_execmem 1
307
308
309
310       If  you  want  to deny any process from ptracing or debugging any other
311       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
312       default.
313
314       setsebool -P deny_ptrace 1
315
316
317
318       If you want to allow all domains to execute in fips_mode, you must turn
319       on the fips_mode boolean. Enabled by default.
320
321       setsebool -P fips_mode 1
322
323
324
325       If you want to determine whether calling user domains can  execute  Git
326       daemon  in  the  git_session_t  domain,  you  must turn on the git_ses‐
327       sion_users boolean. Disabled by default.
328
329       setsebool -P git_session_users 1
330
331
332
333       If you  want  to  allow  httpd  cgi  support,  you  must  turn  on  the
334       httpd_enable_cgi boolean. Enabled by default.
335
336       setsebool -P httpd_enable_cgi 1
337
338
339
340       If  you  want  to allow confined applications to run with kerberos, you
341       must turn on the kerberos_enabled boolean. Enabled by default.
342
343       setsebool -P kerberos_enabled 1
344
345
346
347       If you want to allow system to run with  NIS,  you  must  turn  on  the
348       nis_enabled boolean. Disabled by default.
349
350       setsebool -P nis_enabled 1
351
352
353
354       If  you  want to allow confined applications to use nscd shared memory,
355       you must turn on the nscd_use_shm boolean. Enabled by default.
356
357       setsebool -P nscd_use_shm 1
358
359
360
361       If you want to determine  whether  calling  user  domains  can  execute
362       Polipo  daemon  in  the  polipo_session_t  domain, you must turn on the
363       polipo_session_users boolean. Disabled by default.
364
365       setsebool -P polipo_session_users 1
366
367
368
369       If you want to allow pppd to be run for a regular user, you  must  turn
370       on the pppd_for_user boolean. Disabled by default.
371
372       setsebool -P pppd_for_user 1
373
374
375
376       If  you  want  to  allow  all  unconfined  executables to use libraries
377       requiring text relocation that are  not  labeled  textrel_shlib_t,  you
378       must turn on the selinuxuser_execmod boolean. Enabled by default.
379
380       setsebool -P selinuxuser_execmod 1
381
382
383
384       If  you  want  to allow unconfined executables to make their stack exe‐
385       cutable.  This should never, ever be necessary.  Probably  indicates  a
386       badly  coded  executable, but could indicate an attack. This executable
387       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
388       stack boolean. Enabled by default.
389
390       setsebool -P selinuxuser_execstack 1
391
392
393
394       If  you  want  to allow users to connect to the local mysql server, you
395       must turn on the selinuxuser_mysql_connect_enabled boolean. Disabled by
396       default.
397
398       setsebool -P selinuxuser_mysql_connect_enabled 1
399
400
401
402       If  you  want to allow users to connect to PostgreSQL, you must turn on
403       the   selinuxuser_postgresql_connect_enabled   boolean.   Disabled   by
404       default.
405
406       setsebool -P selinuxuser_postgresql_connect_enabled 1
407
408
409
410       If  you want to allow user to r/w files on filesystems that do not have
411       extended attributes (FAT, CDROM, FLOPPY), you must turn on  the  selin‐
412       uxuser_rw_noexattrfile boolean. Enabled by default.
413
414       setsebool -P selinuxuser_rw_noexattrfile 1
415
416
417
418       If you want to allow user  to use ssh chroot environment, you must turn
419       on the selinuxuser_use_ssh_chroot boolean. Disabled by default.
420
421       setsebool -P selinuxuser_use_ssh_chroot 1
422
423
424
425       If you want to support NFS home  directories,  you  must  turn  on  the
426       use_nfs_home_dirs boolean. Disabled by default.
427
428       setsebool -P use_nfs_home_dirs 1
429
430
431
432       If  you  want  to  support SAMBA home directories, you must turn on the
433       use_samba_home_dirs boolean. Disabled by default.
434
435       setsebool -P use_samba_home_dirs 1
436
437
438

HOME_EXEC

440       The SELinux user staff_u is able execute home content files.
441
442

TRANSITIONS

444       Three things can happen when staff_t attempts to execute a program.
445
446       1. SELinux Policy can deny staff_t from executing the program.
447
448
449
450       2. SELinux Policy can allow staff_t to execute the program in the  cur‐
451       rent user type.
452
453              Execute  the  following  to  see the types that the SELinux user
454              staff_t can execute without transitioning:
455
456              sesearch -A -s staff_t -c file -p execute_no_trans
457
458
459
460       3. SELinux can allow staff_t to execute the program and transition to a
461       new type.
462
463              Execute  the  following  to  see the types that the SELinux user
464              staff_t can execute and transition:
465
466              $ sesearch -A -s staff_t -c process -p transition
467
468
469

MANAGED FILES

471       The SELinux process type staff_t can manage files labeled with the fol‐
472       lowing  file  types.   The paths listed are the default paths for these
473       file types.  Note the processes UID still need to have DAC permissions.
474
475       alsa_home_t
476
477            /home/[^/]+/.asoundrc
478
479       anon_inodefs_t
480
481
482       auth_cache_t
483
484            /var/cache/coolkey(/.*)?
485
486       bluetooth_helper_tmp_t
487
488
489       bluetooth_helper_tmpfs_t
490
491
492       cgroup_t
493
494            /sys/fs/cgroup
495
496       chrome_sandbox_tmpfs_t
497
498
499       cifs_t
500
501
502       dirsrv_config_t
503
504            /etc/dirsrv(/.*)?
505
506       dirsrv_var_lib_t
507
508            /var/lib/dirsrv(/.*)?
509
510       dirsrv_var_log_t
511
512            /var/log/dirsrv(/.*)?
513
514       dirsrv_var_run_t
515
516            /var/run/slapd.*
517            /var/run/dirsrv(/.*)?
518
519       dosfs_t
520
521
522       games_data_t
523
524            /var/games(/.*)?
525            /var/lib/games(/.*)?
526
527       gconf_tmp_t
528
529            /tmp/gconfd-[^/]+/.*
530
531       git_user_content_t
532
533            /home/[^/]+/public_git(/.*)?
534
535       gkeyringd_tmp_t
536
537            /var/run/user/[^/]*/keyring.*
538
539       gnome_home_type
540
541
542       gpg_agent_tmp_t
543
544            /home/[^/]+/.gnupg/log-socket
545
546       httpd_user_content_t
547
548            /home/[^/]+/((www)|(web)|(public_html))(/.+)?
549
550       httpd_user_htaccess_t
551
552            /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
553
554       httpd_user_ra_content_t
555
556            /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
557
558       httpd_user_rw_content_t
559
560
561       httpd_user_script_exec_t
562
563            /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
564
565       irc_home_t
566
567            /home/[^/]+/.irssi(/.*)?
568            /home/[^/]+/irclog(/.*)?
569            /home/[^/]+/.ircmotd
570
571       irc_tmp_t
572
573
574       irssi_home_t
575
576
577       mail_spool_t
578
579            /var/mail(/.*)?
580            /var/spool/imap(/.*)?
581            /var/spool/mail(/.*)?
582            /var/spool/smtpd(/.*)?
583
584       mpd_user_data_t
585
586
587       mqueue_spool_t
588
589            /var/spool/(client)?mqueue(/.*)?
590            /var/spool/mqueue.in(/.*)?
591
592       nfs_t
593
594
595       noxattrfs
596
597            all files on file systems which do not support extended attributes
598
599       pulseaudio_tmpfs_t
600
601
602       pulseaudio_tmpfsfile
603
604
605       sandbox_file_t
606
607
608       sandbox_tmpfs_type
609
610            all sandbox content in tmpfs file systems
611
612       screen_home_t
613
614            /root/.screen(/.*)?
615            /home/[^/]+/.screen(/.*)?
616            /home/[^/]+/.screenrc
617            /home/[^/]+/.tmux.conf
618
619       security_t
620
621            /selinux
622
623       ssh_home_t
624
625            /var/lib/[^/]+/.ssh(/.*)?
626            /root/.ssh(/.*)?
627            /var/lib/one/.ssh(/.*)?
628            /var/lib/pgsql/.ssh(/.*)?
629            /var/lib/openshift/[^/]+/.ssh(/.*)?
630            /var/lib/amanda/.ssh(/.*)?
631            /var/lib/stickshift/[^/]+/.ssh(/.*)?
632            /var/lib/gitolite/.ssh(/.*)?
633            /var/lib/nocpulse/.ssh(/.*)?
634            /var/lib/gitolite3/.ssh(/.*)?
635            /var/lib/openshift/gear/[^/]+/.ssh(/.*)?
636            /root/.shosts
637            /home/[^/]+/.ssh(/.*)?
638            /home/[^/]+/.ansible/cp/.*
639            /home/[^/]+/.shosts
640
641       systemd_passwd_var_run_t
642
643            /var/run/systemd/ask-password(/.*)?
644            /var/run/systemd/ask-password-block(/.*)?
645
646       systemd_unit_file_type
647
648
649       usbfs_t
650
651
652       user_fonts_cache_t
653
654            /root/.fontconfig(/.*)?
655            /root/.fonts/auto(/.*)?
656            /root/.fonts.cache-.*
657            /home/[^/]+/.fontconfig(/.*)?
658            /home/[^/]+/.fonts/auto(/.*)?
659            /home/[^/]+/.fonts.cache-.*
660
661       user_home_type
662
663            all user home files
664
665       user_tmp_t
666
667            /dev/shm/mono.*
668            /var/run/user(/.*)?
669            /tmp/.ICE-unix(/.*)?
670            /tmp/.X11-unix(/.*)?
671            /dev/shm/pulse-shm.*
672            /tmp/.X0-lock
673            /tmp/hsperfdata_root
674            /var/tmp/hsperfdata_root
675            /home/[^/]+/tmp
676            /home/[^/]+/.tmp
677            /tmp/gconfd-[^/]+
678
679       user_tmp_type
680
681            all user tmp files
682
683       virt_image_type
684
685            all virtual image files
686
687       wireshark_home_t
688
689            /home/[^/]+/.wireshark(/.*)?
690
691       wireshark_tmp_t
692
693
694       wireshark_tmpfs_t
695
696
697       xserver_tmpfs_t
698
699
700

COMMANDS

702       semanage fcontext can also be used to manipulate default  file  context
703       mappings.
704
705       semanage  permissive  can  also  be used to manipulate whether or not a
706       process type is permissive.
707
708       semanage module can also be used to enable/disable/install/remove  pol‐
709       icy modules.
710
711       semanage boolean can also be used to manipulate the booleans
712
713
714       system-config-selinux is a GUI tool available to customize SELinux pol‐
715       icy settings.
716
717

AUTHOR

719       This manual page was auto-generated using sepolicy manpage .
720
721