antivirus_selinux(8)

1antivirus_selinux(8)       SELinux Policy antivirus       antivirus_selinux(8)
2
3
4

NAME

6       antivirus_selinux  -  Security  Enhanced Linux Policy for the antivirus
7       processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the antivirus  processes  via  flexible
11       mandatory access control.
12
13       The  antivirus processes execute with the antivirus_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep antivirus_t
20
21
22

ENTRYPOINTS

24       The  antivirus_t  SELinux  type can be entered via the antivirus_exec_t
25       file type.
26
27       The default entrypoint paths for the antivirus_t domain are the follow‐
28       ing:
29
30       /usr/sbin/amavisd.*,  /usr/sbin/amavi,  /usr/sbin/clamd, /usr/bin/clam‐
31       scan, /usr/bin/clamdscan, /usr/bin/freshclam,  /usr/sbin/clamav-milter,
32       /usr/lib/AntiVir/antivir
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       antivirus  policy  is  very  flexible  allowing  users  to  setup their
42       antivirus processes in as secure a method as possible.
43
44       The following process types are defined for antivirus:
45
46       antivirus_t
47
48       Note: semanage permissive -a  antivirus_t  can  be  used  to  make  the
49       process  type  antivirus_t  permissive. SELinux does not deny access to
50       permissive process types, but the AVC (SELinux  denials)  messages  are
51       still generated.
52
53

BOOLEANS

55       SELinux   policy  is  customizable  based  on  least  access  required.
56       antivirus policy is extremely flexible and has  several  booleans  that
57       allow  you to manipulate the policy and run antivirus with the tightest
58       access possible.
59
60
61
62       If you want to determine whether antivirus programs can  use  JIT  com‐
63       piler,  you  must  turn  on  the antivirus_use_jit boolean. Disabled by
64       default.
65
66       setsebool -P antivirus_use_jit 1
67
68
69
70       If you want to allow users to resolve user passwd entries directly from
71       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
72       gin_nsswitch_use_ldap boolean. Disabled by default.
73
74       setsebool -P authlogin_nsswitch_use_ldap 1
75
76
77
78       If you want to allow all domains to execute in fips_mode, you must turn
79       on the fips_mode boolean. Enabled by default.
80
81       setsebool -P fips_mode 1
82
83
84
85       If  you  want  to allow confined applications to run with kerberos, you
86       must turn on the kerberos_enabled boolean. Enabled by default.
87
88       setsebool -P kerberos_enabled 1
89
90
91
92       If you want to allow system to run with  NIS,  you  must  turn  on  the
93       nis_enabled boolean. Disabled by default.
94
95       setsebool -P nis_enabled 1
96
97
98
99       If  you  want to allow confined applications to use nscd shared memory,
100       you must turn on the nscd_use_shm boolean. Disabled by default.
101
102       setsebool -P nscd_use_shm 1
103
104
105

NSSWITCH DOMAIN

107       If you want to allow users to resolve user passwd entries directly from
108       ldap rather then using a sssd server for the antivirus_t, you must turn
109       on the authlogin_nsswitch_use_ldap boolean.
110
111       setsebool -P authlogin_nsswitch_use_ldap 1
112
113
114       If you want to allow confined applications to run with kerberos for the
115       antivirus_t, you must turn on the kerberos_enabled boolean.
116
117       setsebool -P kerberos_enabled 1
118
119

MANAGED FILES

121       The  SELinux process type antivirus_t can manage files labeled with the
122       following file types.  The paths listed are the default paths for these
123       file types.  Note the processes UID still need to have DAC permissions.
124
125       antivirus_db_t
126
127            /var/amavis(/.*)?
128            /var/clamav(/.*)?
129            /var/lib/clamd.*
130            /var/lib/amavis(/.*)?
131            /var/lib/clamav(/.*)?
132            /var/virusmails(/.*)?
133            /var/opt/f-secure(/.*)?
134            /var/spool/amavisd(/.*)?
135            /var/lib/clamav-unofficial-sigs(/.*)?
136
137       antivirus_home_t
138
139
140       antivirus_log_t
141
142            /var/log/clamd.*
143            /var/log/clamav.*
144            /var/log/freshclam.*
145            /var/log/amavisd.log.*
146            /var/log/clamav/freshclam.*
147
148       antivirus_tmp_t
149
150
151       antivirus_var_run_t
152
153            /var/run/clamd.*
154            /var/run/clamav.*
155            /var/run/amavis(d)?(/.*)?
156            /var/run/amavis(d)?/clamd.pid
157            /var/run/amavisd-snmp-subagent.pid
158
159       cluster_conf_t
160
161            /etc/cluster(/.*)?
162
163       cluster_var_lib_t
164
165            /var/lib/pcsd(/.*)?
166            /var/lib/cluster(/.*)?
167            /var/lib/openais(/.*)?
168            /var/lib/pengine(/.*)?
169            /var/lib/corosync(/.*)?
170            /usr/lib/heartbeat(/.*)?
171            /var/lib/heartbeat(/.*)?
172            /var/lib/pacemaker(/.*)?
173
174       cluster_var_run_t
175
176            /var/run/crm(/.*)?
177            /var/run/cman_.*
178            /var/run/rsctmp(/.*)?
179            /var/run/aisexec.*
180            /var/run/heartbeat(/.*)?
181            /var/run/corosync-qnetd(/.*)?
182            /var/run/corosync-qdevice(/.*)?
183            /var/run/corosync.pid
184            /var/run/cpglockd.pid
185            /var/run/rgmanager.pid
186            /var/run/cluster/rgmanager.sk
187
188       root_t
189
190            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
191            /
192            /initrd
193
194       snmpd_var_lib_t
195
196            /var/agentx(/.*)?
197            /var/net-snmp(/.*)
198            /var/lib/snmp(/.*)?
199            /var/net-snmp(/.*)?
200            /var/lib/net-snmp(/.*)?
201            /var/spool/snmptt(/.*)?
202            /usr/share/snmp/mibs/.index
203
204       systemd_passwd_var_run_t
205
206            /var/run/systemd/ask-password(/.*)?
207            /var/run/systemd/ask-password-block(/.*)?
208
209

FILE CONTEXTS

211       SELinux requires files to have an extended attribute to define the file
212       type.
213
214       You can see the context of a file using the -Z option to ls
215
216       Policy governs the access  confined  processes  have  to  these  files.
217       SELinux antivirus policy is very flexible allowing users to setup their
218       antivirus processes in as secure a method as possible.
219
220       EQUIVALENCE DIRECTORIES
221
222
223       antivirus policy stores data with multiple different file context types
224       under  the  /var/lib/clamav  directory.  If you would like to store the
225       data in a different directory you can use the semanage command to  cre‐
226       ate an equivalence mapping.  If you wanted to store this data under the
227       /srv dirctory you would execute the following command:
228
229       semanage fcontext -a -e /var/lib/clamav /srv/clamav
230       restorecon -R -v /srv/clamav
231
232       antivirus policy stores data with multiple different file context types
233       under  the  /var/run/amavis(d)?  directory.  If you would like to store
234       the data in a different directory you can use the semanage  command  to
235       create  an equivalence mapping.  If you wanted to store this data under
236       the /srv dirctory you would execute the following command:
237
238       semanage fcontext -a -e /var/run/amavis(d)? /srv/amavis(d)?
239       restorecon -R -v /srv/amavis(d)?
240
241       STANDARD FILE CONTEXT
242
243       SELinux defines the file context types for the antivirus, if you wanted
244       to store files with these types in a diffent paths, you need to execute
245       the semanage command  to  sepecify  alternate  labeling  and  then  use
246       restorecon to put the labels on disk.
247
248       semanage   fcontext   -a   -t   antivirus_tmp_t  '/srv/myantivirus_con‐
249       tent(/.*)?'
250       restorecon -R -v /srv/myantivirus_content
251
252       Note: SELinux often uses regular expressions  to  specify  labels  that
253       match multiple files.
254
255       The following file types are defined for antivirus:
256
257
258
259       antivirus_conf_t
260
261       -  Set  files  with the antivirus_conf_t type, if you want to treat the
262       files as antivirus configuration data, usually stored  under  the  /etc
263       directory.
264
265
266       Paths:
267            /etc/amavis(d)?.conf, /etc/amavisd(/.*)?
268
269
270       antivirus_db_t
271
272       -  Set  files  with  the  antivirus_db_t type, if you want to treat the
273       files as antivirus database content.
274
275
276       Paths:
277            /var/amavis(/.*)?,      /var/clamav(/.*)?,       /var/lib/clamd.*,
278            /var/lib/amavis(/.*)?,      /var/lib/clamav(/.*)?,     /var/virus‐
279            mails(/.*)?,  /var/opt/f-secure(/.*)?,   /var/spool/amavisd(/.*)?,
280            /var/lib/clamav-unofficial-sigs(/.*)?
281
282
283       antivirus_exec_t
284
285       -  Set  files with the antivirus_exec_t type, if you want to transition
286       an executable to the antivirus_t domain.
287
288
289       Paths:
290            /usr/sbin/amavisd.*,       /usr/sbin/amavi,       /usr/sbin/clamd,
291            /usr/bin/clamscan,     /usr/bin/clamdscan,     /usr/bin/freshclam,
292            /usr/sbin/clamav-milter, /usr/lib/AntiVir/antivir
293
294
295       antivirus_home_t
296
297       - Set files with the  antivirus_home_t  type,  if  you  want  to  store
298       antivirus files in the users home directory.
299
300
301
302       antivirus_initrc_exec_t
303
304       - Set files with the antivirus_initrc_exec_t type, if you want to tran‐
305       sition an executable to the antivirus_initrc_t domain.
306
307
308       Paths:
309            /etc/rc.d/init.d/clamd.*,                 /etc/rc.d/init.d/amavis,
310            /etc/rc.d/init.d/amavisd-snmp
311
312
313       antivirus_log_t
314
315       -  Set  files  with  the antivirus_log_t type, if you want to treat the
316       data as antivirus log data, usually stored under  the  /var/log  direc‐
317       tory.
318
319
320       Paths:
321            /var/log/clamd.*,     /var/log/clamav.*,     /var/log/freshclam.*,
322            /var/log/amavisd.log.*, /var/log/clamav/freshclam.*
323
324
325       antivirus_tmp_t
326
327       - Set files with  the  antivirus_tmp_t  type,  if  you  want  to  store
328       antivirus temporary files in the /tmp directories.
329
330
331
332       antivirus_unit_file_t
333
334       -  Set  files with the antivirus_unit_file_t type, if you want to treat
335       the files as antivirus unit content.
336
337
338
339       antivirus_var_run_t
340
341       - Set files with the antivirus_var_run_t type, if you want to store the
342       antivirus files under the /run or /var/run directory.
343
344
345       Paths:
346            /var/run/clamd.*,   /var/run/clamav.*,  /var/run/amavis(d)?(/.*)?,
347            /var/run/amavis(d)?/clamd.pid, /var/run/amavisd-snmp-subagent.pid
348
349
350       Note: File context can be temporarily modified with the chcon  command.
351       If  you want to permanently change the file context you need to use the
352       semanage fcontext command.  This will modify the SELinux labeling data‐
353       base.  You will need to use restorecon to apply the labels.
354
355

COMMANDS

357       semanage  fcontext  can also be used to manipulate default file context
358       mappings.
359
360       semanage permissive can also be used to manipulate  whether  or  not  a
361       process type is permissive.
362
363       semanage  module can also be used to enable/disable/install/remove pol‐
364       icy modules.
365
366       semanage boolean can also be used to manipulate the booleans
367
368
369       system-config-selinux is a GUI tool available to customize SELinux pol‐
370       icy settings.
371
372

AUTHOR

374       This manual page was auto-generated using sepolicy manpage .
375
376