1user_wine_selinux(8) SELinux Policy user_wine user_wine_selinux(8)
2
6 user_wine_selinux - Security Enhanced Linux Policy for the user_wine
7 processes
8
10 Security-Enhanced Linux secures the user_wine processes via flexible
11 mandatory access control.
12 The user_wine processes execute with the user_wine_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep user_wine_t
20
24 The user_wine_t SELinux type can be entered via the user_home_t,
25 wine_exec_t file types.
26 The default entrypoint paths for the user_wine_t domain are the follow‐
28 ing:
29 /home/[^/]+/.+, /usr/bin/wine.*, /opt/teamviewer(/.*)?/bin/wine.*,
31 /opt/google/picasa(/.*)?/bin/wdi, /opt/google/picasa(/.*)?/bin/wine.*,
32 /opt/google/picasa(/.*)?/bin/msiexec,
33 /opt/google/picasa(/.*)?/bin/notepad,
34 /opt/google/picasa(/.*)?/bin/progman,
35 /opt/google/picasa(/.*)?/bin/regedit,
36 /opt/google/picasa(/.*)?/bin/regsvr32,
37 /opt/google/picasa(/.*)?/Picasa3/.*exe,
38 /opt/google/picasa(/.*)?/bin/uninstaller, /opt/cxoffice/bin/wine.*,
39 /opt/picasa/wine/bin/wine.*, /usr/bin/msiexec, /usr/bin/notepad,
40 /usr/bin/regedit, /usr/bin/regsvr32, /usr/bin/uninstaller,
41 /home/[^/]+/cxoffice/bin/wine.+
42
44 SELinux defines process types (domains) for each process running on the
45 system
46 You can see the context of a process using the -Z option to ps
48 Policy governs the access confined processes have to files. SELinux
50 user_wine policy is very flexible allowing users to setup their
51 user_wine processes in as secure a method as possible.
52 The following process types are defined for user_wine:
54 user_wine_t
56 Note: semanage permissive -a user_wine_t can be used to make the
58 process type user_wine_t permissive. SELinux does not deny access to
59 permissive process types, but the AVC (SELinux denials) messages are
60 still generated.
61
64 SELinux policy is customizable based on least access required.
65 user_wine policy is extremely flexible and has several booleans that
66 allow you to manipulate the policy and run user_wine with the tightest
67 access possible.
68 If you want to allow users to resolve user passwd entries directly from
72 ldap rather then using a sssd server, you must turn on the authlo‐
73 gin_nsswitch_use_ldap boolean. Disabled by default.
74 setsebool -P authlogin_nsswitch_use_ldap 1
76 If you want to allow all domains to execute in fips_mode, you must turn
80 on the fips_mode boolean. Enabled by default.
81 setsebool -P fips_mode 1
83 If you want to allow confined applications to run with kerberos, you
87 must turn on the kerberos_enabled boolean. Enabled by default.
88 setsebool -P kerberos_enabled 1
90 If you want to control the ability to mmap a low area of the address
94 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
95 the mmap_low_allowed boolean. Disabled by default.
96 setsebool -P mmap_low_allowed 1
98 If you want to allow system to run with NIS, you must turn on the
102 nis_enabled boolean. Disabled by default.
103 setsebool -P nis_enabled 1
105 If you want to allow confined applications to use nscd shared memory,
109 you must turn on the nscd_use_shm boolean. Enabled by default.
110 setsebool -P nscd_use_shm 1
112 If you want to allow users to connect to PostgreSQL, you must turn on
116 the selinuxuser_postgresql_connect_enabled boolean. Disabled by
117 default.
118 setsebool -P selinuxuser_postgresql_connect_enabled 1
120 If you want to support NFS home directories, you must turn on the
124 use_nfs_home_dirs boolean. Disabled by default.
125 setsebool -P use_nfs_home_dirs 1
127 If you want to support SAMBA home directories, you must turn on the
131 use_samba_home_dirs boolean. Disabled by default.
132 setsebool -P use_samba_home_dirs 1
134
138 The SELinux process type user_wine_t can manage files labeled with the
139 following file types. The paths listed are the default paths for these
140 file types. Note the processes UID still need to have DAC permissions.
141 alsa_home_t
143 /home/[^/]+/.asoundrc
145 anon_inodefs_t
147 cgroup_t
150 /sys/fs/cgroup
152 chrome_sandbox_tmpfs_t
154 cifs_t
157 dosfs_t
160 games_data_t
163 /var/games(/.*)?
165 /var/lib/games(/.*)?
166 gpg_agent_tmp_t
168 /home/[^/]+/.gnupg/log-socket
170 iceauth_home_t
172 /root/.DCOP.*
174 /root/.ICEauthority.*
175 /home/[^/]+/.DCOP.*
176 /home/[^/]+/.ICEauthority.*
177 mail_spool_t
179 /var/mail(/.*)?
181 /var/spool/imap(/.*)?
182 /var/spool/mail(/.*)?
183 /var/spool/smtpd(/.*)?
184 mqueue_spool_t
186 /var/spool/(client)?mqueue(/.*)?
188 /var/spool/mqueue.in(/.*)?
189 nfs_t
191 noxattrfs
194 all files on file systems which do not support extended attributes
196 pulseaudio_tmpfs_t
198 pulseaudio_tmpfsfile
201 usbfs_t
204 user_fonts_cache_t
207 /root/.fontconfig(/.*)?
209 /root/.fonts/auto(/.*)?
210 /root/.fonts.cache-.*
211 /home/[^/]+/.fontconfig(/.*)?
212 /home/[^/]+/.fonts/auto(/.*)?
213 /home/[^/]+/.fonts.cache-.*
214 user_fonts_config_t
216 /root/.fonts.d(/.*)?
218 /root/.fonts.conf
219 /home/[^/]+/.fonts.d(/.*)?
220 /home/[^/]+/.fonts.conf
221 user_fonts_t
223 /root/.fonts(/.*)?
225 /tmp/.font-unix(/.*)?
226 /home/[^/]+/.fonts(/.*)?
227 /home/[^/]+/.local/share/fonts(/.*)?
228 user_home_type
230 all user home files
232 user_tmp_t
234 /dev/shm/mono.*
236 /var/run/user(/.*)?
237 /tmp/.ICE-unix(/.*)?
238 /tmp/.X11-unix(/.*)?
239 /dev/shm/pulse-shm.*
240 /tmp/.X0-lock
241 /tmp/hsperfdata_root
242 /var/tmp/hsperfdata_root
243 /home/[^/]+/tmp
244 /home/[^/]+/.tmp
245 /tmp/gconfd-[^/]+
246 user_tmp_type
248 all user tmp files
250 wine_home_t
252 /home/[^/]+/.wine(/.*)?
254 xauth_home_t
256 /root/.Xauth.*
258 /root/.xauth.*
259 /root/.Xauthority.*
260 /root/.serverauth.*
261 /var/lib/pqsql/.xauth.*
262 /var/lib/pqsql/.Xauthority.*
263 /var/lib/nxserver/home/.xauth.*
264 /var/lib/nxserver/home/.Xauthority.*
265 /home/[^/]+/.Xauth.*
266 /home/[^/]+/.xauth.*
267 /home/[^/]+/.Xauthority.*
268 /home/[^/]+/.serverauth.*
269 xserver_tmpfs_t
271
275 semanage fcontext can also be used to manipulate default file context
276 mappings.
277 semanage permissive can also be used to manipulate whether or not a
279 process type is permissive.
280 semanage module can also be used to enable/disable/install/remove pol‐
282 icy modules.
283 semanage boolean can also be used to manipulate the booleans
285 system-config-selinux is a GUI tool available to customize SELinux pol‐
288 icy settings.
289
292 This manual page was auto-generated using sepolicy manpage .
293
296 selinux(8), user_wine(8), semanage(8), restorecon(8), chcon(1), sepol‐
297 icy(8), setsebool(8)
298user_wine 19-10-08 user_wine_selinux(8)