1mozilla_plugin_selinux(8)SELinux Policy mozilla_pluginmozilla_plugin_selinux(8)
2
3
4

NAME

6       mozilla_plugin_selinux   -  Security  Enhanced  Linux  Policy  for  the
7       mozilla_plugin processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the mozilla_plugin processes via flexi‐
11       ble mandatory access control.
12
13       The  mozilla_plugin processes execute with the mozilla_plugin_t SELinux
14       type. You can check if you have these processes  running  by  executing
15       the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep mozilla_plugin_t
20
21
22

ENTRYPOINTS

24       The  mozilla_plugin_t SELinux type can be entered via the mozilla_plug‐
25       in_exec_t file type.
26
27       The default entrypoint paths for the mozilla_plugin_t  domain  are  the
28       following:
29
30       /usr/lib/xulrunner[^/]*/plugin-container,        /usr/lib/nspluginwrap‐
31       per/npviewer.bin,    /usr/bin/nspluginscan,    /usr/bin/nspluginviewer,
32       /usr/libexec/WebKitPluginProcess, /usr/lib/firefox/plugin-container
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       mozilla_plugin  policy  is  very flexible allowing users to setup their
42       mozilla_plugin processes in as secure a method as possible.
43
44       The following process types are defined for mozilla_plugin:
45
46       mozilla_plugin_t, mozilla_plugin_config_t
47
48       Note: semanage permissive -a mozilla_plugin_t can be used to  make  the
49       process  type mozilla_plugin_t permissive. SELinux does not deny access
50       to permissive process types, but the AVC (SELinux denials) messages are
51       still generated.
52
53

BOOLEANS

55       SELinux   policy  is  customizable  based  on  least  access  required.
56       mozilla_plugin policy is extremely flexible and  has  several  booleans
57       that allow you to manipulate the policy and run mozilla_plugin with the
58       tightest access possible.
59
60
61
62       If you want to allow mozilla plugin domain to bind  unreserved  tcp/udp
63       ports,  you must turn on the mozilla_plugin_bind_unreserved_ports bool‐
64       ean. Disabled by default.
65
66       setsebool -P mozilla_plugin_bind_unreserved_ports 1
67
68
69
70       If you want to allow mozilla plugin domain to connect  to  the  network
71       using  TCP,  you  must  turn  on the mozilla_plugin_can_network_connect
72       boolean. Enabled by default.
73
74       setsebool -P mozilla_plugin_can_network_connect 1
75
76
77
78       If you want to allow mozilla plugin to use Bluejeans, you must turn  on
79       the mozilla_plugin_use_bluejeans boolean. Disabled by default.
80
81       setsebool -P mozilla_plugin_use_bluejeans 1
82
83
84
85       If  you  want  to allow mozilla plugin to support GPS, you must turn on
86       the mozilla_plugin_use_gps boolean. Disabled by default.
87
88       setsebool -P mozilla_plugin_use_gps 1
89
90
91
92       If you want to allow mozilla plugin to  support  spice  protocols,  you
93       must turn on the mozilla_plugin_use_spice boolean. Disabled by default.
94
95       setsebool -P mozilla_plugin_use_spice 1
96
97
98
99       If you want to allow users to resolve user passwd entries directly from
100       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
101       gin_nsswitch_use_ldap boolean. Disabled by default.
102
103       setsebool -P authlogin_nsswitch_use_ldap 1
104
105
106
107       If you want to allow all domains to execute in fips_mode, you must turn
108       on the fips_mode boolean. Enabled by default.
109
110       setsebool -P fips_mode 1
111
112
113
114       If you want to allow confined applications to run  with  kerberos,  you
115       must turn on the kerberos_enabled boolean. Enabled by default.
116
117       setsebool -P kerberos_enabled 1
118
119
120
121       If  you  want  to  allow  system  to run with NIS, you must turn on the
122       nis_enabled boolean. Disabled by default.
123
124       setsebool -P nis_enabled 1
125
126
127
128       If you want to allow confined applications to use nscd  shared  memory,
129       you must turn on the nscd_use_shm boolean. Disabled by default.
130
131       setsebool -P nscd_use_shm 1
132
133
134
135       If  you  want  to  allow  all  unconfined  executables to use libraries
136       requiring text relocation that are  not  labeled  textrel_shlib_t,  you
137       must turn on the selinuxuser_execmod boolean. Enabled by default.
138
139       setsebool -P selinuxuser_execmod 1
140
141
142
143       If  you  want  to  allow  unconfined users to transition to the Mozilla
144       plugin domain when running xulrunner plugin-container, you must turn on
145       the unconfined_mozilla_plugin_transition boolean. Enabled by default.
146
147       setsebool -P unconfined_mozilla_plugin_transition 1
148
149
150
151       If  you  want  to  support  NFS  home directories, you must turn on the
152       use_nfs_home_dirs boolean. Disabled by default.
153
154       setsebool -P use_nfs_home_dirs 1
155
156
157
158       If you want to support SAMBA home directories, you  must  turn  on  the
159       use_samba_home_dirs boolean. Disabled by default.
160
161       setsebool -P use_samba_home_dirs 1
162
163
164

MANAGED FILES

166       The SELinux process type mozilla_plugin_t can manage files labeled with
167       the following file types.  The paths listed are the default  paths  for
168       these  file  types.  Note the processes UID still need to have DAC per‐
169       missions.
170
171       cifs_t
172
173
174       dosfs_t
175
176
177       ecryptfs_t
178
179            /home/[^/]+/.Private(/.*)?
180            /home/[^/]+/.ecryptfs(/.*)?
181
182       fusefs_t
183
184            /var/run/user/[^/]*/gvfs
185
186       gnome_home_type
187
188
189       home_cert_t
190
191            /root/.pki(/.*)?
192            /root/.cert(/.*)?
193            /home/[^/]+/.pki(/.*)?
194            /home/[^/]+/.cert(/.*)?
195            /home/[^/]+/.local/share/networkmanagement/certificates(/.*)?
196            /home/[^/]+/.kde/share/apps/networkmanagement/certificates(/.*)?
197
198       mozilla_home_t
199
200            /home/[^/]+/.lyx(/.*)?
201            /home/[^/]+/.java(/.*)?
202            /home/[^/]+/.adobe(/.*)?
203            /home/[^/]+/.gnash(/.*)?
204            /home/[^/]+/.webex(/.*)?
205            /home/[^/]+/.IBMERS(/.*)?
206            /home/[^/]+/.galeon(/.*)?
207            /home/[^/]+/.spicec(/.*)?
208            /home/[^/]+/POkemon.*(/.*)?
209            /home/[^/]+/.icedtea(/.*)?
210            /home/[^/]+/.mozilla(/.*)?
211            /home/[^/]+/.phoenix(/.*)?
212            /home/[^/]+/.netscape(/.*)?
213            /home/[^/]+/.ICAClient(/.*)?
214            /home/[^/]+/.quakelive(/.*)?
215            /home/[^/]+/.macromedia(/.*)?
216            /home/[^/]+/.thunderbird(/.*)?
217            /home/[^/]+/.gcjwebplugin(/.*)?
218            /home/[^/]+/.grl-podcasts(/.*)?
219            /home/[^/]+/.cache/mozilla(/.*)?
220            /home/[^/]+/.icedteaplugin(/.*)?
221            /home/[^/]+/zimbrauserdata(/.*)?
222            /home/[^/]+/.juniper_networks(/.*)?
223            /home/[^/]+/.cache/icedtea-web(/.*)?
224            /home/[^/]+/abc
225            /home/[^/]+/mozilla.pdf
226            /home/[^/]+/.gnashpluginrc
227
228       mozilla_plugin_tmp_t
229
230
231       mozilla_plugin_tmpfs_t
232
233
234       mplayer_home_t
235
236            /home/[^/]+/.mplayer(/.*)?
237
238       nfs_t
239
240
241       pulseaudio_home_t
242
243            /root/.pulse(/.*)?
244            /root/.config/pulse(/.*)?
245            /root/.esd_auth
246            /root/.pulse-cookie
247            /home/[^/]+/.pulse(/.*)?
248            /home/[^/]+/.config/pulse(/.*)?
249            /home/[^/]+/.esd_auth
250            /home/[^/]+/.pulse-cookie
251
252       texlive_home_t
253
254            /home/[^/]+/.texlive2012(/.*)?
255            /home/[^/]+/.texlive2013(/.*)?
256            /home/[^/]+/.texlive2014(/.*)?
257
258       user_fonts_cache_t
259
260            /root/.fontconfig(/.*)?
261            /root/.fonts/auto(/.*)?
262            /root/.fonts.cache-.*
263            /home/[^/]+/.fontconfig(/.*)?
264            /home/[^/]+/.fonts/auto(/.*)?
265            /home/[^/]+/.fonts.cache-.*
266
267       user_tmp_t
268
269            /dev/shm/mono.*
270            /var/run/user(/.*)?
271            /tmp/.ICE-unix(/.*)?
272            /tmp/.X11-unix(/.*)?
273            /dev/shm/pulse-shm.*
274            /tmp/.X0-lock
275            /tmp/hsperfdata_root
276            /var/tmp/hsperfdata_root
277            /home/[^/]+/tmp
278            /home/[^/]+/.tmp
279            /tmp/gconfd-[^/]+
280
281

FILE CONTEXTS

283       SELinux requires files to have an extended attribute to define the file
284       type.
285
286       You can see the context of a file using the -Z option to ls
287
288       Policy  governs  the  access  confined  processes  have to these files.
289       SELinux mozilla_plugin policy is very flexible allowing users to  setup
290       their mozilla_plugin processes in as secure a method as possible.
291
292       STANDARD FILE CONTEXT
293
294       SELinux  defines  the file context types for the mozilla_plugin, if you
295       wanted to store files with these types in a diffent paths, you need  to
296       execute  the  semanage  command to sepecify alternate labeling and then
297       use restorecon to put the labels on disk.
298
299       semanage fcontext -a -t mozilla_plugin_rw_t '/srv/mymozilla_plugin_con‐
300       tent(/.*)?'
301       restorecon -R -v /srv/mymozilla_plugin_content
302
303       Note:  SELinux  often  uses  regular expressions to specify labels that
304       match multiple files.
305
306       The following file types are defined for mozilla_plugin:
307
308
309
310       mozilla_plugin_config_exec_t
311
312       - Set files with the mozilla_plugin_config_exec_t type, if you want  to
313       transition an executable to the mozilla_plugin_config_t domain.
314
315
316
317       mozilla_plugin_exec_t
318
319       - Set files with the mozilla_plugin_exec_t type, if you want to transi‐
320       tion an executable to the mozilla_plugin_t domain.
321
322
323       Paths:
324            /usr/lib/xulrunner[^/]*/plugin-container,   /usr/lib/nspluginwrap‐
325            per/npviewer.bin,  /usr/bin/nspluginscan, /usr/bin/nspluginviewer,
326            /usr/libexec/WebKitPluginProcess,     /usr/lib/firefox/plugin-con‐
327            tainer
328
329
330       mozilla_plugin_rw_t
331
332       - Set files with the mozilla_plugin_rw_t type, if you want to treat the
333       files as mozilla plugin read/write content.
334
335
336
337       mozilla_plugin_tmp_t
338
339       - Set files with the mozilla_plugin_tmp_t type, if you  want  to  store
340       mozilla plugin temporary files in the /tmp directories.
341
342
343
344       mozilla_plugin_tmpfs_t
345
346       -  Set files with the mozilla_plugin_tmpfs_t type, if you want to store
347       mozilla plugin files on a tmpfs file system.
348
349
350
351       Note: File context can be temporarily modified with the chcon  command.
352       If  you want to permanently change the file context you need to use the
353       semanage fcontext command.  This will modify the SELinux labeling data‐
354       base.  You will need to use restorecon to apply the labels.
355
356

COMMANDS

358       semanage  fcontext  can also be used to manipulate default file context
359       mappings.
360
361       semanage permissive can also be used to manipulate  whether  or  not  a
362       process type is permissive.
363
364       semanage  module can also be used to enable/disable/install/remove pol‐
365       icy modules.
366
367       semanage boolean can also be used to manipulate the booleans
368
369
370       system-config-selinux is a GUI tool available to customize SELinux pol‐
371       icy settings.
372
373

AUTHOR

375       This manual page was auto-generated using sepolicy manpage .
376
377

SEE ALSO

379       selinux(8),  mozilla_plugin(8),  semanage(8),  restorecon(8), chcon(1),
380       sepolicy(8),      setsebool(8),       mozilla_plugin_config_selinux(8),
381       mozilla_plugin_config_selinux(8)
382
383
384
385mozilla_plugin                     19-05-30          mozilla_plugin_selinux(8)
Impressum