xdm_selinux(8)

1xdm_selinux(8)                SELinux Policy xdm                xdm_selinux(8)
2
3
4

NAME

6       xdm_selinux - Security Enhanced Linux Policy for the xdm processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the xdm processes via flexible manda‐
10       tory access control.
11
12       The xdm processes execute with the xdm_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep xdm_t
19
20
21

ENTRYPOINTS

23       The xdm_t SELinux type can be entered via the xdm_exec_t file type.
24
25       The default entrypoint paths for the xdm_t domain are the following:
26
27       /usr/s?bin/nodm,        /usr/s?bin/gdm(3)?,        /usr/s?bin/lightdm*,
28       /usr/s?bin/[mxgkw]dm, /usr/s?bin/gdm-binary, /usr/s?bin/lxdm(-binary)?,
29       /usr/X11R6/bin/[xgkw]dm,   /usr/bin/razor-lightdm-.*,    /usr/bin/sddm,
30       /usr/bin/slim,   /usr/bin/gpe-dm,   /opt/kde3/bin/kdm,   /usr/sbin/mdm-
31       binary,       /usr/bin/sddm-greeter,       /etc/rc.d/init.d/x11-common,
32       /usr/libexec/gdm-disable-wayland
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       xdm policy is very flexible allowing users to setup their xdm processes
42       in as secure a method as possible.
43
44       The following process types are defined for xdm:
45
46       xdm_t, xdm_unconfined_t
47
48       Note: semanage permissive -a xdm_t can be used to make the process type
49       xdm_t  permissive.  SELinux  does not deny access to permissive process
50       types, but the AVC (SELinux denials) messages are still generated.
51
52

BOOLEANS

54       SELinux policy is customizable based on  least  access  required.   xdm
55       policy is extremely flexible and has several booleans that allow you to
56       manipulate the policy and run xdm with the tightest access possible.
57
58
59
60       If you want to allows xdm_t to bind on vnc_port_t(5910), you must  turn
61       on the xdm_bind_vnc_tcp_port boolean. Disabled by default.
62
63       setsebool -P xdm_bind_vnc_tcp_port 1
64
65
66
67       If you want to allow the graphical login program to execute bootloader,
68       you must turn on the xdm_exec_bootloader boolean. Disabled by default.
69
70       setsebool -P xdm_exec_bootloader 1
71
72
73
74       If you want to allow the graphical login program to login  directly  as
75       sysadm_r:sysadm_t,  you  must  turn  on  the  xdm_sysadm_login boolean.
76       Enabled by default.
77
78       setsebool -P xdm_sysadm_login 1
79
80
81
82       If you want to allow the graphical login program  to  create  files  in
83       HOME  dirs  as xdm_home_t, you must turn on the xdm_write_home boolean.
84       Enabled by default.
85
86       setsebool -P xdm_write_home 1
87
88
89
90       If you want to allow users to resolve user passwd entries directly from
91       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
92       gin_nsswitch_use_ldap boolean. Disabled by default.
93
94       setsebool -P authlogin_nsswitch_use_ldap 1
95
96
97
98       If you want to deny user domains applications to map a memory region as
99       both  executable  and  writable,  this  is dangerous and the executable
100       should be reported in bugzilla, you must turn on the deny_execmem bool‐
101       ean. Enabled by default.
102
103       setsebool -P deny_execmem 1
104
105
106
107       If  you  want  to deny any process from ptracing or debugging any other
108       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
109       default.
110
111       setsebool -P deny_ptrace 1
112
113
114
115       If you want to allow all domains to execute in fips_mode, you must turn
116       on the fips_mode boolean. Enabled by default.
117
118       setsebool -P fips_mode 1
119
120
121
122       If you want to allow confined applications to run  with  kerberos,  you
123       must turn on the kerberos_enabled boolean. Enabled by default.
124
125       setsebool -P kerberos_enabled 1
126
127
128
129       If  you  want  to  allow  system  to run with NIS, you must turn on the
130       nis_enabled boolean. Disabled by default.
131
132       setsebool -P nis_enabled 1
133
134
135
136       If you want to allow confined applications to use nscd  shared  memory,
137       you must turn on the nscd_use_shm boolean. Disabled by default.
138
139       setsebool -P nscd_use_shm 1
140
141
142
143       If you want to enable polyinstantiated directory support, you must turn
144       on the polyinstantiation_enabled boolean. Disabled by default.
145
146       setsebool -P polyinstantiation_enabled 1
147
148
149
150       If you want to allow unconfined executables to make  their  stack  exe‐
151       cutable.   This  should  never, ever be necessary. Probably indicates a
152       badly coded executable, but could indicate an attack.  This  executable
153       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
154       stack boolean. Enabled by default.
155
156       setsebool -P selinuxuser_execstack 1
157
158
159
160       If you want to support ecryptfs home directories, you must turn on  the
161       use_ecryptfs_home_dirs boolean. Disabled by default.
162
163       setsebool -P use_ecryptfs_home_dirs 1
164
165
166
167       If  you  want  to support fusefs home directories, you must turn on the
168       use_fusefs_home_dirs boolean. Disabled by default.
169
170       setsebool -P use_fusefs_home_dirs 1
171
172
173
174       If you want to support NFS home  directories,  you  must  turn  on  the
175       use_nfs_home_dirs boolean. Disabled by default.
176
177       setsebool -P use_nfs_home_dirs 1
178
179
180
181       If  you  want  to  support SAMBA home directories, you must turn on the
182       use_samba_home_dirs boolean. Disabled by default.
183
184       setsebool -P use_samba_home_dirs 1
185
186
187

PORT TYPES

189       SELinux defines port types to represent TCP and UDP ports.
190
191       You can see the types associated with a port  by  using  the  following
192       command:
193
194       semanage port -l
195
196
197       Policy  governs  the  access  confined  processes  have to these ports.
198       SELinux xdm policy is very flexible allowing users to setup  their  xdm
199       processes in as secure a method as possible.
200
201       The following port types are defined for xdm:
202
203
204       xdmcp_port_t
205
206
207
208       Default Defined Ports:
209                 tcp 177
210                 udp 177
211

MANAGED FILES

213       The  SELinux  process type xdm_t can manage files labeled with the fol‐
214       lowing file types.  The paths listed are the default  paths  for  these
215       file types.  Note the processes UID still need to have DAC permissions.
216
217       anon_inodefs_t
218
219
220       auth_cache_t
221
222            /var/cache/coolkey(/.*)?
223
224       auth_home_t
225
226            /root/.yubico(/.*)?
227            /root/.google_authenticator
228            /root/.google_authenticator~
229            /home/[^/]+/.yubico(/.*)?
230            /home/[^/]+/.google_authenticator
231            /home/[^/]+/.google_authenticator~
232
233       cgroup_t
234
235            /sys/fs/cgroup
236
237       cifs_t
238
239
240       dosfs_t
241
242
243       ecryptfs_t
244
245            /home/[^/]+/.Private(/.*)?
246            /home/[^/]+/.ecryptfs(/.*)?
247
248       etc_runtime_t
249
250            /[^/]+
251            /etc/mtab.*
252            /etc/blkid(/.*)?
253            /etc/nologin.*
254            /etc/.fstab.hal..+
255            /halt
256            /fastboot
257            /poweroff
258            /.autofsck
259            /etc/cmtab
260            /forcefsck
261            /.suspended
262            /fsckoptions
263            /.autorelabel
264            /etc/.updated
265            /var/.updated
266            /etc/killpower
267            /etc/nohotplug
268            /etc/securetty
269            /etc/ioctl.save
270            /etc/fstab.REVOKE
271            /etc/network/ifstate
272            /etc/sysconfig/hwconf
273            /etc/ptal/ptal-printd-like
274            /etc/sysconfig/iptables.save
275            /etc/xorg.conf.d/00-system-setup-keyboard.conf
276            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
277
278       faillog_t
279
280            /var/log/btmp.*
281            /var/log/faillog.*
282            /var/log/tallylog.*
283            /var/run/faillock(/.*)?
284
285       fonts_cache_t
286
287            /var/cache/fontconfig(/.*)?
288
289       fusefs_t
290
291            /var/run/user/[^/]*/gvfs
292
293       gconf_home_t
294
295            /root/.local.*
296            /root/.gconf(d)?(/.*)?
297            /home/[^/]+/.local.*
298            /home/[^/]+/.gconf(d)?(/.*)?
299
300       gnome_home_type
301
302
303       initrc_var_run_t
304
305            /var/run/utmp
306            /var/run/random-seed
307            /var/run/runlevel.dir
308            /var/run/setmixer_flag
309
310       kdbusfs_t
311
312
313       krb5_host_rcache_t
314
315            /var/cache/krb5rcache(/.*)?
316            /var/tmp/nfs_0
317            /var/tmp/DNS_25
318            /var/tmp/host_0
319            /var/tmp/imap_0
320            /var/tmp/HTTP_23
321            /var/tmp/HTTP_48
322            /var/tmp/ldap_55
323            /var/tmp/ldap_487
324            /var/tmp/ldapmap1_0
325
326       lastlog_t
327
328            /var/log/lastlog.*
329
330       locale_t
331
332            /etc/locale.conf
333            /etc/vconsole.conf
334            /usr/lib/locale(/.*)?
335            /usr/share/locale(/.*)?
336            /usr/share/zoneinfo(/.*)?
337            /usr/share/X11/locale(/.*)?
338            /etc/timezone
339            /etc/localtime
340            /etc/sysconfig/clock
341            /etc/avahi/etc/localtime
342            /var/empty/sshd/etc/localtime
343            /var/named/chroot/etc/localtime
344            /var/spool/postfix/etc/localtime
345
346       nfs_t
347
348
349       pam_var_console_t
350
351            /var/run/console(/.*)?
352
353       pam_var_run_t
354
355            /var/(db|adm)/sudo(/.*)?
356            /var/lib/sudo(/.*)?
357            /var/run/sudo(/.*)?
358            /var/run/motd.d(/.*)?
359            /var/run/sepermit(/.*)?
360            /var/run/pam_mount(/.*)?
361            /var/run/motd
362
363       security_t
364
365            /selinux
366
367       sysfs_t
368
369            /sys(/.*)?
370
371       systemd_passwd_var_run_t
372
373            /var/run/systemd/ask-password(/.*)?
374            /var/run/systemd/ask-password-block(/.*)?
375
376       user_fonts_t
377
378            /root/.fonts(/.*)?
379            /tmp/.font-unix(/.*)?
380            /home/[^/]+/.fonts(/.*)?
381            /home/[^/]+/.local/share/fonts(/.*)?
382
383       user_tmp_t
384
385            /dev/shm/mono.*
386            /var/run/user(/.*)?
387            /tmp/.ICE-unix(/.*)?
388            /tmp/.X11-unix(/.*)?
389            /dev/shm/pulse-shm.*
390            /tmp/.X0-lock
391            /tmp/hsperfdata_root
392            /var/tmp/hsperfdata_root
393            /home/[^/]+/tmp
394            /home/[^/]+/.tmp
395            /tmp/gconfd-[^/]+
396
397       user_tmp_type
398
399            all user tmp files
400
401       var_auth_t
402
403            /var/ace(/.*)?
404            /var/rsa(/.*)?
405            /var/lib/abl(/.*)?
406            /var/lib/rsa(/.*)?
407            /var/lib/pam_ssh(/.*)?
408            /var/run/pam_ssh(/.*)?
409            /var/lib/pam_shield(/.*)?
410            /var/opt/quest/vas/vasd(/.*)?
411            /var/lib/google-authenticator(/.*)?
412
413       wtmp_t
414
415            /var/log/wtmp.*
416
417       xauth_home_t
418
419            /root/.Xauth.*
420            /root/.xauth.*
421            /root/.Xauthority.*
422            /root/.serverauth.*
423            /var/lib/pqsql/.xauth.*
424            /var/lib/pqsql/.Xauthority.*
425            /var/lib/nxserver/home/.xauth.*
426            /var/lib/nxserver/home/.Xauthority.*
427            /home/[^/]+/.Xauth.*
428            /home/[^/]+/.xauth.*
429            /home/[^/]+/.Xauthority.*
430            /home/[^/]+/.serverauth.*
431
432       xdm_home_t
433
434            /root/.dmrc.*
435            /root/.wayland-errors.*
436            /root/.xsession-errors.*
437            /home/[^/]+/.dmrc.*
438            /home/[^/]+/.cache/gdm(/.*)?
439            /home/[^/]+/.wayland-errors.*
440            /home/[^/]+/.xsession-errors.*
441            /home/[^/]+/.local/share/xorg(/.*)?
442
443       xdm_lock_t
444
445
446       xdm_log_t
447
448            /var/log/[mkwx]dm.log.*
449            /var/log/mdm(/.*)?
450            /var/log/lxdm.log.*
451            /var/log/slim.log.*
452
453       xdm_rw_etc_t
454
455            /etc/X11/wdm(/.*)?
456            /etc/opt/VirtualGL(/.*)?
457
458       xdm_spool_t
459
460            /var/spool/[mg]dm(/.*)?
461
462       xdm_tmpfs_t
463
464
465       xdm_var_lib_t
466
467            /var/lib/[mxkwg]dm(/.*)?
468            /var/cache/[mg]dm(/.*)?
469            /var/lib/gdm(3)?(/.*)?
470            /var/lib/lxdm(/.*)?
471            /var/lib/sddm(/.*)?
472            /var/lib/lightdm(/.*)?
473            /var/cache/lightdm(/.*)?
474            /var/lib/lightdm-data(/.*)?
475
476       xdm_var_run_t
477
478            /etc/kde[34]?/kdm/backgroundrc
479            /var/run/[kgm]dm(/.*)?
480            /var/run/gdm(3)?.pid
481            /var/run/gdm(3)?(/.*)?
482            /usr/lib/qt-.*/etc/settings(/.*)?
483            /var/run/slim.*
484            /var/run/lxdm(/.*)?
485            /var/run/sddm(/.*)?
486            /var/run/xauth(/.*)?
487            /var/run/xdmctl(/.*)?
488            /var/run/lightdm(/.*)?
489            /var/run/systemd/multi-session-x(/.*)?
490            /var/run/xdm.pid
491            /var/run/lxdm.pid
492            /var/run/lxdm.auth
493            /var/run/gdm_socket
494
495       xkb_var_lib_t
496
497            /var/lib/xkb(/.*)?
498            /usr/X11R6/lib/X11/xkb/.*
499            /usr/X11R6/lib/X11/xkb
500
501       xserver_log_t
502
503            /var/[xgkw]dm(/.*)?
504            /usr/var/[xgkw]dm(/.*)?
505            /var/log/gdm(3)?(/.*)?
506            /var/log/Xorg.*
507            /var/log/XFree86.*
508            /var/log/lightdm(/.*)?
509            /var/log/nvidia-installer.log.*
510
511       xserver_tmpfs_t
512
513
514

FILE CONTEXTS

516       SELinux requires files to have an extended attribute to define the file
517       type.
518
519       You can see the context of a file using the -Z option to ls
520
521       Policy governs the access  confined  processes  have  to  these  files.
522       SELinux  xdm  policy is very flexible allowing users to setup their xdm
523       processes in as secure a method as possible.
524
525       EQUIVALENCE DIRECTORIES
526
527
528       xdm policy stores data with multiple different file context types under
529       the /var/lib/lightdm directory.  If you would like to store the data in
530       a different directory you can use the semanage  command  to  create  an
531       equivalence  mapping.   If you wanted to store this data under the /srv
532       dirctory you would execute the following command:
533
534       semanage fcontext -a -e /var/lib/lightdm /srv/lightdm
535       restorecon -R -v /srv/lightdm
536
537       xdm policy stores data with multiple different file context types under
538       the /var/run/gdm(3)? directory.  If you would like to store the data in
539       a different directory you can use the semanage  command  to  create  an
540       equivalence  mapping.   If you wanted to store this data under the /srv
541       dirctory you would execute the following command:
542
543       semanage fcontext -a -e /var/run/gdm(3)? /srv/gdm(3)?
544       restorecon -R -v /srv/gdm(3)?
545
546       xdm policy stores data with multiple different file context types under
547       the  /var/run/lxdm directory.  If you would like to store the data in a
548       different directory you can use  the  semanage  command  to  create  an
549       equivalence  mapping.   If you wanted to store this data under the /srv
550       dirctory you would execute the following command:
551
552       semanage fcontext -a -e /var/run/lxdm /srv/lxdm
553       restorecon -R -v /srv/lxdm
554
555       STANDARD FILE CONTEXT
556
557       SELinux defines the file context types for the xdm, if  you  wanted  to
558       store  files  with  these types in a diffent paths, you need to execute
559       the semanage command  to  sepecify  alternate  labeling  and  then  use
560       restorecon to put the labels on disk.
561
562       semanage fcontext -a -t xdm_log_t '/srv/myxdm_content(/.*)?'
563       restorecon -R -v /srv/myxdm_content
564
565       Note:  SELinux  often  uses  regular expressions to specify labels that
566       match multiple files.
567
568       The following file types are defined for xdm:
569
570
571
572       xdm_etc_t
573
574       - Set files with the xdm_etc_t type, if you want to store xdm files  in
575       the /etc directories.
576
577
578
579       xdm_exec_t
580
581       - Set files with the xdm_exec_t type, if you want to transition an exe‐
582       cutable to the xdm_t domain.
583
584
585       Paths:
586            /usr/s?bin/nodm,     /usr/s?bin/gdm(3)?,      /usr/s?bin/lightdm*,
587            /usr/s?bin/[mxgkw]dm,                       /usr/s?bin/gdm-binary,
588            /usr/s?bin/lxdm(-binary)?,                /usr/X11R6/bin/[xgkw]dm,
589            /usr/bin/razor-lightdm-.*,      /usr/bin/sddm,      /usr/bin/slim,
590            /usr/bin/gpe-dm,     /opt/kde3/bin/kdm,      /usr/sbin/mdm-binary,
591            /usr/bin/sddm-greeter,                /etc/rc.d/init.d/x11-common,
592            /usr/libexec/gdm-disable-wayland
593
594
595       xdm_home_t
596
597       - Set files with the xdm_home_t type, if you want to store xdm files in
598       the users home directory.
599
600
601       Paths:
602            /root/.dmrc.*,  /root/.wayland-errors.*, /root/.xsession-errors.*,
603            /home/[^/]+/.dmrc.*,                 /home/[^/]+/.cache/gdm(/.*)?,
604            /home/[^/]+/.wayland-errors.*,     /home/[^/]+/.xsession-errors.*,
605            /home/[^/]+/.local/share/xorg(/.*)?
606
607
608       xdm_lock_t
609
610       - Set files with the xdm_lock_t type, if you want to treat the files as
611       xdm lock data, stored under the /var/lock directory
612
613
614
615       xdm_log_t
616
617       -  Set  files with the xdm_log_t type, if you want to treat the data as
618       xdm log data, usually stored under the /var/log directory.
619
620
621       Paths:
622            /var/log/[mkwx]dm.log.*, /var/log/mdm(/.*)?,  /var/log/lxdm.log.*,
623            /var/log/slim.log.*
624
625
626       xdm_rw_etc_t
627
628       -  Set  files  with  the xdm_rw_etc_t type, if you want to store xdm rw
629       files in the /etc directories.
630
631
632       Paths:
633            /etc/X11/wdm(/.*)?, /etc/opt/VirtualGL(/.*)?
634
635
636       xdm_spool_t
637
638       - Set files with the xdm_spool_t type, if you want  to  store  the  xdm
639       files under the /var/spool directory.
640
641
642
643       xdm_tmpfs_t
644
645       -  Set  files with the xdm_tmpfs_t type, if you want to store xdm files
646       on a tmpfs file system.
647
648
649
650       xdm_unconfined_exec_t
651
652       - Set files with the xdm_unconfined_exec_t type, if you want to transi‐
653       tion an executable to the xdm_unconfined_t domain.
654
655
656       Paths:
657            /etc/[mg]dm/Init(/.*)?,               /etc/[mg]dm/PostLogin(/.*)?,
658            /etc/[mg]dm/PreSession(/.*)?, /etc/[mg]dm/PostSession(/.*)?
659
660
661       xdm_var_lib_t
662
663       - Set files with the xdm_var_lib_t type, if you want to store  the  xdm
664       files under the /var/lib directory.
665
666
667       Paths:
668            /var/lib/[mxkwg]dm(/.*)?,                 /var/cache/[mg]dm(/.*)?,
669            /var/lib/gdm(3)?(/.*)?, /var/lib/lxdm(/.*)?,  /var/lib/sddm(/.*)?,
670            /var/lib/lightdm(/.*)?,                  /var/cache/lightdm(/.*)?,
671            /var/lib/lightdm-data(/.*)?
672
673
674       xdm_var_run_t
675
676       - Set files with the xdm_var_run_t type, if you want to store  the  xdm
677       files under the /run or /var/run directory.
678
679
680       Paths:
681            /etc/kde[34]?/kdm/backgroundrc,            /var/run/[kgm]dm(/.*)?,
682            /var/run/gdm(3)?.pid,                      /var/run/gdm(3)?(/.*)?,
683            /usr/lib/qt-.*/etc/settings(/.*)?,                /var/run/slim.*,
684            /var/run/lxdm(/.*)?,  /var/run/sddm(/.*)?,   /var/run/xauth(/.*)?,
685            /var/run/xdmctl(/.*)?,    /var/run/lightdm(/.*)?,    /var/run/sys‐
686            temd/multi-session-x(/.*)?,  /var/run/xdm.pid,  /var/run/lxdm.pid,
687            /var/run/lxdm.auth, /var/run/gdm_socket
688
689
690       Note:  File context can be temporarily modified with the chcon command.
691       If you want to permanently change the file context you need to use  the
692       semanage fcontext command.  This will modify the SELinux labeling data‐
693       base.  You will need to use restorecon to apply the labels.
694
695

COMMANDS

697       semanage fcontext can also be used to manipulate default  file  context
698       mappings.
699
700       semanage  permissive  can  also  be used to manipulate whether or not a
701       process type is permissive.
702
703       semanage module can also be used to enable/disable/install/remove  pol‐
704       icy modules.
705
706       semanage port can also be used to manipulate the port definitions
707
708       semanage boolean can also be used to manipulate the booleans
709
710
711       system-config-selinux is a GUI tool available to customize SELinux pol‐
712       icy settings.
713
714

AUTHOR

716       This manual page was auto-generated using sepolicy manpage .
717
718