abrt_selinux(8)

1abrt_selinux(8)               SELinux Policy abrt              abrt_selinux(8)
2
3
4

NAME

6       abrt_selinux - Security Enhanced Linux Policy for the abrt processes
7

DESCRIPTION

9       Security-Enhanced  Linux secures the abrt processes via flexible manda‐
10       tory access control.
11
12       The abrt processes execute with the abrt_t SELinux type. You can  check
13       if  you  have  these processes running by executing the ps command with
14       the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep abrt_t
19
20
21

ENTRYPOINTS

23       The abrt_t SELinux type can be entered via the abrt_exec_t file type.
24
25       The default entrypoint paths for the abrt_t domain are the following:
26
27       /usr/sbin/abrt-harvest.*,     /usr/sbin/abrtd,     /usr/sbin/abrt-dbus,
28       /usr/sbin/abrt-install-ccpp-hook
29

PROCESS TYPES

31       SELinux defines process types (domains) for each process running on the
32       system
33
34       You can see the context of a process using the -Z option to ps
35
36       Policy governs the access confined processes have  to  files.   SELinux
37       abrt  policy  is  very flexible allowing users to setup their abrt pro‐
38       cesses in as secure a method as possible.
39
40       The following process types are defined for abrt:
41
42       abrt_t, abrt_dump_oops_t, abrt_handle_event_t, abrt_helper_t, abrt_retrace_worker_t, abrt_retrace_coredump_t, abrt_watch_log_t, abrt_upload_watch_t
43
44       Note: semanage permissive -a abrt_t can be used  to  make  the  process
45       type  abrt_t  permissive.  SELinux  does  not deny access to permissive
46       process types, but the AVC (SELinux denials) messages are still  gener‐
47       ated.
48
49

BOOLEANS

51       SELinux  policy  is  customizable based on least access required.  abrt
52       policy is extremely flexible and has several booleans that allow you to
53       manipulate the policy and run abrt with the tightest access possible.
54
55
56
57       If  you  want  to  determine  whether  ABRT  can  run  in the abrt_han‐
58       dle_event_t domain to handle ABRT event scripts, you must turn  on  the
59       abrt_handle_event boolean. Disabled by default.
60
61       setsebool -P abrt_handle_event 1
62
63
64
65       If you want to allow users to resolve user passwd entries directly from
66       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
67       gin_nsswitch_use_ldap boolean. Disabled by default.
68
69       setsebool -P authlogin_nsswitch_use_ldap 1
70
71
72
73       If you want to deny user domains applications to map a memory region as
74       both executable and writable, this  is  dangerous  and  the  executable
75       should be reported in bugzilla, you must turn on the deny_execmem bool‐
76       ean. Enabled by default.
77
78       setsebool -P deny_execmem 1
79
80
81
82       If you want to allow all domains to execute in fips_mode, you must turn
83       on the fips_mode boolean. Enabled by default.
84
85       setsebool -P fips_mode 1
86
87
88
89       If  you  want  to allow confined applications to run with kerberos, you
90       must turn on the kerberos_enabled boolean. Enabled by default.
91
92       setsebool -P kerberos_enabled 1
93
94
95
96       If you want to allow system to run with  NIS,  you  must  turn  on  the
97       nis_enabled boolean. Disabled by default.
98
99       setsebool -P nis_enabled 1
100
101
102
103       If  you  want to allow confined applications to use nscd shared memory,
104       you must turn on the nscd_use_shm boolean. Disabled by default.
105
106       setsebool -P nscd_use_shm 1
107
108
109

MANAGED FILES

111       The SELinux process type abrt_t can manage files labeled with the  fol‐
112       lowing  file  types.   The paths listed are the default paths for these
113       file types.  Note the processes UID still need to have DAC permissions.
114
115       abrt_etc_t
116
117            /etc/abrt(/.*)?
118
119       abrt_tmp_t
120
121
122       abrt_upload_watch_tmp_t
123
124
125       abrt_var_cache_t
126
127            /var/tmp/abrt(/.*)?
128            /var/cache/abrt(/.*)?
129            /var/spool/abrt(/.*)?
130            /var/spool/debug(/.*)?
131            /var/cache/abrt-di(/.*)?
132            /var/spool/rhsm/debug(/.*)?
133
134       abrt_var_log_t
135
136            /var/log/abrt-logger.*
137
138       abrt_var_run_t
139
140            /var/run/abrt(/.*)?
141            /var/run/abrtd?.lock
142            /var/run/abrtd?.socket
143            /var/run/abrt.pid
144
145       cluster_conf_t
146
147            /etc/cluster(/.*)?
148
149       cluster_var_lib_t
150
151            /var/lib/pcsd(/.*)?
152            /var/lib/cluster(/.*)?
153            /var/lib/openais(/.*)?
154            /var/lib/pengine(/.*)?
155            /var/lib/corosync(/.*)?
156            /usr/lib/heartbeat(/.*)?
157            /var/lib/heartbeat(/.*)?
158            /var/lib/pacemaker(/.*)?
159
160       cluster_var_run_t
161
162            /var/run/crm(/.*)?
163            /var/run/cman_.*
164            /var/run/rsctmp(/.*)?
165            /var/run/aisexec.*
166            /var/run/heartbeat(/.*)?
167            /var/run/corosync-qnetd(/.*)?
168            /var/run/corosync-qdevice(/.*)?
169            /var/run/corosync.pid
170            /var/run/cpglockd.pid
171            /var/run/rgmanager.pid
172            /var/run/cluster/rgmanager.sk
173
174       kdump_crash_t
175
176            /var/crash(/.*)?
177
178       mail_home_rw_t
179
180            /root/Maildir(/.*)?
181            /root/.esmtp_queue(/.*)?
182            /var/lib/arpwatch/.esmtp_queue(/.*)?
183            /home/[^/]+/.maildir(/.*)?
184            /home/[^/]+/Maildir(/.*)?
185            /home/[^/]+/.esmtp_queue(/.*)?
186
187       mock_var_lib_t
188
189            /var/lib/mock(/.*)?
190
191       public_content_rw_t
192
193            /var/spool/abrt-upload(/.*)?
194
195       rhsmcertd_var_run_t
196
197            /var/run/rhsm(/.*)?
198
199       root_t
200
201            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
202            /
203            /initrd
204
205       rpm_log_t
206
207            /var/log/up2date.*
208            /var/log/yum.log.*
209
210       rpm_var_cache_t
211
212            /var/cache/dnf(/.*)?
213            /var/cache/yum(/.*)?
214            /var/spool/up2date(/.*)?
215            /var/cache/PackageKit(/.*)?
216
217       rpm_var_run_t
218
219            /var/run/yum.*
220            /var/run/PackageKit(/.*)?
221
222       sysfs_t
223
224            /sys(/.*)?
225
226       usr_t
227
228            /opt/.*
229            /usr/.*
230            /emul/.*
231            /export(/.*)?
232            /ostree(/.*)?
233            /usr/doc(/.*)?/lib(/.*)?
234            /usr/inclu.e(/.*)?
235            /usr/share/rpm(/.*)?
236            /usr/share/doc(/.*)?/README.*
237            /usr/lib/modules(/.*)/vmlinuz
238            /usr/lib/modules(/.*)/initramfs.img
239            /usr/lib/sysimage(/.*)?
240            /usr/lib/ostree-boot(/.*)?
241            /opt
242            /usr
243            /emul
244
245

FILE CONTEXTS

247       SELinux requires files to have an extended attribute to define the file
248       type.
249
250       You can see the context of a file using the -Z option to ls
251
252       Policy  governs  the  access  confined  processes  have to these files.
253       SELinux abrt policy is very flexible allowing users to setup their abrt
254       processes in as secure a method as possible.
255
256       EQUIVALENCE DIRECTORIES
257
258
259       abrt  policy  stores  data  with  multiple different file context types
260       under the /var/cache/abrt directory.  If you would like  to  store  the
261       data  in a different directory you can use the semanage command to cre‐
262       ate an equivalence mapping.  If you wanted to store this data under the
263       /srv dirctory you would execute the following command:
264
265       semanage fcontext -a -e /var/cache/abrt /srv/abrt
266       restorecon -R -v /srv/abrt
267
268       abrt  policy  stores  data  with  multiple different file context types
269       under the /var/run/abrt directory.  If you would like to store the data
270       in  a different directory you can use the semanage command to create an
271       equivalence mapping.  If you wanted to store this data under  the  /srv
272       dirctory you would execute the following command:
273
274       semanage fcontext -a -e /var/run/abrt /srv/abrt
275       restorecon -R -v /srv/abrt
276
277       abrt  policy  stores  data  with  multiple different file context types
278       under the /var/spool/abrt directory.  If you would like  to  store  the
279       data  in a different directory you can use the semanage command to cre‐
280       ate an equivalence mapping.  If you wanted to store this data under the
281       /srv dirctory you would execute the following command:
282
283       semanage fcontext -a -e /var/spool/abrt /srv/abrt
284       restorecon -R -v /srv/abrt
285
286       STANDARD FILE CONTEXT
287
288       SELinux  defines  the file context types for the abrt, if you wanted to
289       store files with these types in a diffent paths, you  need  to  execute
290       the  semanage  command  to  sepecify  alternate  labeling  and then use
291       restorecon to put the labels on disk.
292
293       semanage  fcontext  -a  -t  abrt_upload_watch_tmp_t   '/srv/myabrt_con‐
294       tent(/.*)?'
295       restorecon -R -v /srv/myabrt_content
296
297       Note:  SELinux  often  uses  regular expressions to specify labels that
298       match multiple files.
299
300       The following file types are defined for abrt:
301
302
303
304       abrt_dump_oops_exec_t
305
306       - Set files with the abrt_dump_oops_exec_t type, if you want to transi‐
307       tion an executable to the abrt_dump_oops_t domain.
308
309
310       Paths:
311            /usr/bin/abrt-dump-.*,                /usr/bin/abrt-uefioops-oops,
312            /usr/libexec/abrt-hook-ccpp
313
314
315       abrt_etc_t
316
317       - Set files with the abrt_etc_t type, if you want to store  abrt  files
318       in the /etc directories.
319
320
321
322       abrt_exec_t
323
324       -  Set  files  with  the abrt_exec_t type, if you want to transition an
325       executable to the abrt_t domain.
326
327
328       Paths:
329            /usr/sbin/abrt-harvest.*,  /usr/sbin/abrtd,   /usr/sbin/abrt-dbus,
330            /usr/sbin/abrt-install-ccpp-hook
331
332
333       abrt_handle_event_exec_t
334
335       -  Set  files  with  the  abrt_handle_event_exec_t type, if you want to
336       transition an executable to the abrt_handle_event_t domain.
337
338
339
340       abrt_helper_exec_t
341
342       - Set files with the abrt_helper_exec_t type, if you want to transition
343       an executable to the abrt_helper_t domain.
344
345
346
347       abrt_initrc_exec_t
348
349       - Set files with the abrt_initrc_exec_t type, if you want to transition
350       an executable to the abrt_initrc_t domain.
351
352
353
354       abrt_retrace_cache_t
355
356       - Set files with the abrt_retrace_cache_t type, if you  want  to  store
357       the files under the /var/cache directory.
358
359
360       Paths:
361            /var/cache/abrt-retrace(/.*)?, /var/cache/retrace-server(/.*)?
362
363
364       abrt_retrace_coredump_exec_t
365
366       -  Set files with the abrt_retrace_coredump_exec_t type, if you want to
367       transition an executable to the abrt_retrace_coredump_t domain.
368
369
370
371       abrt_retrace_spool_t
372
373       - Set files with the abrt_retrace_spool_t type, if you  want  to  store
374       the abrt retrace files under the /var/spool directory.
375
376
377       Paths:
378            /var/spool/faf(/.*)?,               /var/spool/abrt-retrace(/.*)?,
379            /var/spool/retrace-server(/.*)?
380
381
382       abrt_retrace_worker_exec_t
383
384       - Set files with the abrt_retrace_worker_exec_t type, if  you  want  to
385       transition an executable to the abrt_retrace_worker_t domain.
386
387
388       Paths:
389            /usr/bin/abrt-retrace-worker, /usr/bin/retrace-server-worker
390
391
392       abrt_tmp_t
393
394       -  Set files with the abrt_tmp_t type, if you want to store abrt tempo‐
395       rary files in the /tmp directories.
396
397
398
399       abrt_unit_file_t
400
401       - Set files with the abrt_unit_file_t type, if you want  to  treat  the
402       files as abrt unit content.
403
404
405
406       abrt_upload_watch_exec_t
407
408       -  Set  files  with  the  abrt_upload_watch_exec_t type, if you want to
409       transition an executable to the abrt_upload_watch_t domain.
410
411
412
413       abrt_upload_watch_tmp_t
414
415       - Set files with the abrt_upload_watch_tmp_t type, if you want to store
416       abrt upload watch temporary files in the /tmp directories.
417
418
419
420       abrt_var_cache_t
421
422       -  Set  files  with the abrt_var_cache_t type, if you want to store the
423       files under the /var/cache directory.
424
425
426       Paths:
427            /var/tmp/abrt(/.*)?, /var/cache/abrt(/.*)?, /var/spool/abrt(/.*)?,
428            /var/spool/debug(/.*)?,                  /var/cache/abrt-di(/.*)?,
429            /var/spool/rhsm/debug(/.*)?
430
431
432       abrt_var_lib_t
433
434       - Set files with the abrt_var_lib_t type, if you want to store the abrt
435       files under the /var/lib directory.
436
437
438
439       abrt_var_log_t
440
441       - Set files with the abrt_var_log_t type, if you want to treat the data
442       as abrt var log data, usually stored under the /var/log directory.
443
444
445
446       abrt_var_run_t
447
448       - Set files with the abrt_var_run_t type, if you want to store the abrt
449       files under the /run or /var/run directory.
450
451
452       Paths:
453            /var/run/abrt(/.*)?, /var/run/abrtd?.lock, /var/run/abrtd?.socket,
454            /var/run/abrt.pid
455
456
457       abrt_watch_log_exec_t
458
459       - Set files with the abrt_watch_log_exec_t type, if you want to transi‐
460       tion an executable to the abrt_watch_log_t domain.
461
462
463
464       Note:  File context can be temporarily modified with the chcon command.
465       If you want to permanently change the file context you need to use  the
466       semanage fcontext command.  This will modify the SELinux labeling data‐
467       base.  You will need to use restorecon to apply the labels.
468
469

SHARING FILES

471       If you want to share files with multiple domains (Apache,  FTP,  rsync,
472       Samba),  you can set a file context of public_content_t and public_con‐
473       tent_rw_t.  These context allow any of the above domains  to  read  the
474       content.   If  you want a particular domain to write to the public_con‐
475       tent_rw_t domain, you must set the appropriate boolean.
476
477       Allow abrt servers to read the /var/abrt directory by adding  the  pub‐
478       lic_content_t  file  type  to  the  directory and by restoring the file
479       type.
480
481       semanage fcontext -a -t public_content_t "/var/abrt(/.*)?"
482       restorecon -F -R -v /var/abrt
483
484       Allow abrt servers to read and write /var/abrt/incoming by  adding  the
485       public_content_rw_t  type  to  the  directory and by restoring the file
486       type.  You also need to turn on the abrt_anon_write boolean.
487
488       semanage fcontext -a -t public_content_rw_t "/var/abrt/incoming(/.*)?"
489       restorecon -F -R -v /var/abrt/incoming
490       setsebool -P abrt_anon_write 1
491
492
493       If you want to allow ABRT to modify public files used for  public  file
494       transfer services., you must turn on the abrt_anon_write boolean.
495
496       setsebool -P abrt_anon_write 1
497
498

COMMANDS

500       semanage  fcontext  can also be used to manipulate default file context
501       mappings.
502
503       semanage permissive can also be used to manipulate  whether  or  not  a
504       process type is permissive.
505
506       semanage  module can also be used to enable/disable/install/remove pol‐
507       icy modules.
508
509       semanage boolean can also be used to manipulate the booleans
510
511
512       system-config-selinux is a GUI tool available to customize SELinux pol‐
513       icy settings.
514
515

AUTHOR

517       This manual page was auto-generated using sepolicy manpage .
518
519