1udev_selinux(8) SELinux Policy udev udev_selinux(8)
2
6 udev_selinux - Security Enhanced Linux Policy for the udev processes
7
9 Security-Enhanced Linux secures the udev processes via flexible manda‐
10 tory access control.
11 The udev processes execute with the udev_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15 For example:
17 ps -eZ | grep udev_t
19
23 The udev_t SELinux type can be entered via the udev_helper_exec_t,
24 udev_exec_t file types.
25 The default entrypoint paths for the udev_t domain are the following:
27 /etc/dev.d/.+, /etc/udev/scripts/.+, /etc/hotplug.d/default/udev.*,
29 /sbin/udev, /sbin/udevd, /bin/udevadm, /sbin/udevadm, /sbin/udevsend,
30 /usr/sbin/udev, /lib/udev/udevd, /sbin/udevstart, /usr/sbin/udevd,
31 /sbin/start_udev, /usr/bin/udevadm, /usr/bin/udevinfo, /usr/sbin/ude‐
32 vadm, /lib/udev/udev-acl, /usr/sbin/udevsend, /usr/lib/udev/udevd,
33 /usr/sbin/udevstart, /sbin/wait_for_sysfs, /usr/sbin/start_udev,
34 /usr/lib/udev/udev-acl, /usr/sbin/wait_for_sysfs, /usr/lib/systemd/sys‐
35 temd-udevd
36
38 SELinux defines process types (domains) for each process running on the
39 system
40 You can see the context of a process using the -Z option to ps
42 Policy governs the access confined processes have to files. SELinux
44 udev policy is very flexible allowing users to setup their udev pro‐
45 cesses in as secure a method as possible.
46 The following process types are defined for udev:
48 udev_t
50 Note: semanage permissive -a udev_t can be used to make the process
52 type udev_t permissive. SELinux does not deny access to permissive
53 process types, but the AVC (SELinux denials) messages are still gener‐
54 ated.
55
58 SELinux policy is customizable based on least access required. udev
59 policy is extremely flexible and has several booleans that allow you to
60 manipulate the policy and run udev with the tightest access possible.
61 If you want to allow users to resolve user passwd entries directly from
65 ldap rather then using a sssd server, you must turn on the authlo‐
66 gin_nsswitch_use_ldap boolean. Disabled by default.
67 setsebool -P authlogin_nsswitch_use_ldap 1
69 If you want to deny user domains applications to map a memory region as
73 both executable and writable, this is dangerous and the executable
74 should be reported in bugzilla, you must turn on the deny_execmem bool‐
75 ean. Enabled by default.
76 setsebool -P deny_execmem 1
78 If you want to allow all domains to execute in fips_mode, you must turn
82 on the fips_mode boolean. Enabled by default.
83 setsebool -P fips_mode 1
85 If you want to allow confined applications to run with kerberos, you
89 must turn on the kerberos_enabled boolean. Enabled by default.
90 setsebool -P kerberos_enabled 1
92 If you want to control the ability to mmap a low area of the address
96 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
97 the mmap_low_allowed boolean. Disabled by default.
98 setsebool -P mmap_low_allowed 1
100 If you want to allow system to run with NIS, you must turn on the
104 nis_enabled boolean. Disabled by default.
105 setsebool -P nis_enabled 1
107 If you want to allow confined applications to use nscd shared memory,
111 you must turn on the nscd_use_shm boolean. Enabled by default.
112 setsebool -P nscd_use_shm 1
114 If you want to disable kernel module loading, you must turn on the
118 secure_mode_insmod boolean. Enabled by default.
119 setsebool -P secure_mode_insmod 1
121 If you want to allow unconfined executables to make their heap memory
125 executable. Doing this is a really bad idea. Probably indicates a
126 badly coded executable, but could indicate an attack. This executable
127 should be reported in bugzilla, you must turn on the selin‐
128 uxuser_execheap boolean. Disabled by default.
129 setsebool -P selinuxuser_execheap 1
131 If you want to allow unconfined executables to make their stack exe‐
135 cutable. This should never, ever be necessary. Probably indicates a
136 badly coded executable, but could indicate an attack. This executable
137 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
138 stack boolean. Enabled by default.
139 setsebool -P selinuxuser_execstack 1
141
145 The SELinux process type udev_t can manage files labeled with the fol‐
146 lowing file types. The paths listed are the default paths for these
147 file types. Note the processes UID still need to have DAC permissions.
148 file_type
150 all files on the system
152
155 SELinux requires files to have an extended attribute to define the file
156 type.
157 You can see the context of a file using the -Z option to ls
159 Policy governs the access confined processes have to these files.
161 SELinux udev policy is very flexible allowing users to setup their udev
162 processes in as secure a method as possible.
163 STANDARD FILE CONTEXT
165 SELinux defines the file context types for the udev, if you wanted to
167 store files with these types in a diffent paths, you need to execute
168 the semanage command to sepecify alternate labeling and then use
169 restorecon to put the labels on disk.
170 semanage fcontext -a -t udev_tmp_t '/srv/myudev_content(/.*)?'
172 restorecon -R -v /srv/myudev_content
173 Note: SELinux often uses regular expressions to specify labels that
175 match multiple files.
176 The following file types are defined for udev:
178 udev_etc_t
182 - Set files with the udev_etc_t type, if you want to store udev files
184 in the /etc directories.
185 udev_exec_t
189 - Set files with the udev_exec_t type, if you want to transition an
191 executable to the udev_t domain.
192 Paths:
195 /sbin/udev, /sbin/udevd, /bin/udevadm, /sbin/udevadm, /sbin/ude‐
196 vsend, /usr/sbin/udev, /lib/udev/udevd, /sbin/udevstart,
197 /usr/sbin/udevd, /sbin/start_udev, /usr/bin/udevadm,
198 /usr/bin/udevinfo, /usr/sbin/udevadm, /lib/udev/udev-acl,
199 /usr/sbin/udevsend, /usr/lib/udev/udevd, /usr/sbin/udevstart,
200 /sbin/wait_for_sysfs, /usr/sbin/start_udev, /usr/lib/udev/udev-
201 acl, /usr/sbin/wait_for_sysfs, /usr/lib/systemd/systemd-udevd
202 udev_helper_exec_t
205 - Set files with the udev_helper_exec_t type, if you want to transition
207 an executable to the udev_helper_t domain.
208 Paths:
211 /etc/dev.d/.+, /etc/udev/scripts/.+, /etc/hotplug.d/default/udev.*
212 udev_rules_t
215 - Set files with the udev_rules_t type, if you want to treat the files
217 as udev rules data.
218 udev_tmp_t
222 - Set files with the udev_tmp_t type, if you want to store udev tempo‐
224 rary files in the /tmp directories.
225 udev_var_run_t
229 - Set files with the udev_var_run_t type, if you want to store the udev
231 files under the /run or /var/run directory.
232 Paths:
235 /dev/.udev(/.*)?, /var/run/udev(/.*)?, /var/run/libgpod(/.*)?,
236 /var/run/PackageKit/udev(/.*)?, /dev/.udevdb, /dev/udev.tbl
237 Note: File context can be temporarily modified with the chcon command.
240 If you want to permanently change the file context you need to use the
241 semanage fcontext command. This will modify the SELinux labeling data‐
242 base. You will need to use restorecon to apply the labels.
243
246 semanage fcontext can also be used to manipulate default file context
247 mappings.
248 semanage permissive can also be used to manipulate whether or not a
250 process type is permissive.
251 semanage module can also be used to enable/disable/install/remove pol‐
253 icy modules.
254 semanage boolean can also be used to manipulate the booleans
256 system-config-selinux is a GUI tool available to customize SELinux pol‐
259 icy settings.
260
263 This manual page was auto-generated using sepolicy manpage .
264
267 selinux(8), udev(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
268 setsebool(8)
269udev 19-10-08 udev_selinux(8)