gpg_web_selinux(8)

1gpg_web_selinux(8)          SELinux Policy gpg_web          gpg_web_selinux(8)
2
3
4

NAME

6       gpg_web_selinux  -  Security Enhanced Linux Policy for the gpg_web pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  gpg_web  processes  via  flexible
11       mandatory access control.
12
13       The  gpg_web processes execute with the gpg_web_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep gpg_web_t
20
21
22

ENTRYPOINTS

24       The gpg_web_t SELinux type can be entered via the gpg_exec_t file type.
25
26       The  default  entrypoint paths for the gpg_web_t domain are the follow‐
27       ing:
28
29       /usr/bin/gpg(2)?, /usr/lib/gnupg/.*, /usr/bin/gpgsm
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       gpg_web policy is very flexible allowing users to setup  their  gpg_web
39       processes in as secure a method as possible.
40
41       The following process types are defined for gpg_web:
42
43       gpg_web_t
44
45       Note:  semanage permissive -a gpg_web_t can be used to make the process
46       type gpg_web_t permissive. SELinux does not deny access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.  gpg_web
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run gpg_web with the tightest  access  possi‐
55       ble.
56
57
58
59       If you want to allow all domains to execute in fips_mode, you must turn
60       on the fips_mode boolean. Enabled by default.
61
62       setsebool -P fips_mode 1
63
64
65

MANAGED FILES

67       The SELinux process type gpg_web_t can manage files  labeled  with  the
68       following file types.  The paths listed are the default paths for these
69       file types.  Note the processes UID still need to have DAC permissions.
70
71       httpd_sys_rw_content_t
72
73            /etc/rt(/.*)?
74            /etc/glpi(/.*)?
75            /etc/horde(/.*)?
76            /etc/drupal.*
77            /etc/z-push(/.*)?
78            /var/lib/svn(/.*)?
79            /var/www/svn(/.*)?
80            /etc/owncloud(/.*)?
81            /var/www/html(/.*)?/uploads(/.*)?
82            /var/www/html(/.*)?/wp-content(/.*)?
83            /var/www/html(/.*)?/wp_backups(/.*)?
84            /var/www/html(/.*)?/sites/default/files(/.*)?
85            /var/www/html(/.*)?/sites/default/settings.php
86            /etc/mock/koji(/.*)?
87            /etc/nextcloud(/.*)?
88            /var/lib/drupal.*
89            /etc/zabbix/web(/.*)?
90            /var/lib/moodle(/.*)?
91            /var/log/z-push(/.*)?
92            /var/spool/gosa(/.*)?
93            /etc/WebCalendar(/.*)?
94            /usr/share/joomla(/.*)?
95            /var/lib/dokuwiki(/.*)?
96            /var/lib/owncloud(/.*)?
97            /var/spool/viewvc(/.*)?
98            /var/lib/nextcloud(/.*)?
99            /var/lib/pootle/po(/.*)?
100            /var/lib/phpMyAdmin(/.*)?
101            /var/www/moodledata(/.*)?
102            /srv/gallery2/smarty(/.*)?
103            /var/www/moodle/data(/.*)?
104            /var/lib/graphite-web(/.*)?
105            /var/log/shibboleth-www(/.*)?
106            /var/www/gallery/albums(/.*)?
107            /var/www/html/owncloud/data(/.*)?
108            /var/www/html/nextcloud/data(/.*)?
109            /usr/share/wordpress-mu/wp-content(/.*)?
110            /usr/share/wordpress/wp-content/upgrade(/.*)?
111            /usr/share/wordpress/wp-content/uploads(/.*)?
112            /var/www/html/configuration.php
113
114       public_content_rw_t
115
116            /var/spool/abrt-upload(/.*)?
117
118

SHARING FILES

120       If you want to share files with multiple domains (Apache,  FTP,  rsync,
121       Samba),  you can set a file context of public_content_t and public_con‐
122       tent_rw_t.  These context allow any of the above domains  to  read  the
123       content.   If  you want a particular domain to write to the public_con‐
124       tent_rw_t domain, you must set the appropriate boolean.
125
126       Allow gpg_web servers to read the /var/gpg_web directory by adding  the
127       public_content_t  file  type to the directory and by restoring the file
128       type.
129
130       semanage fcontext -a -t public_content_t "/var/gpg_web(/.*)?"
131       restorecon -F -R -v /var/gpg_web
132
133       Allow gpg_web servers to read and write /var/gpg_web/incoming by adding
134       the public_content_rw_t type to the directory and by restoring the file
135       type.  You also need to turn on the gpg_web_anon_write boolean.
136
137       semanage  fcontext  -a  -t   public_content_rw_t   "/var/gpg_web/incom‐
138       ing(/.*)?"
139       restorecon -F -R -v /var/gpg_web/incoming
140       setsebool -P gpg_web_anon_write 1
141
142
143       If  you  want  to  allow gpg web domain to modify public files used for
144       public file transfer services., you must turn on the gpg_web_anon_write
145       boolean.
146
147       setsebool -P gpg_web_anon_write 1
148
149

COMMANDS

151       semanage  fcontext  can also be used to manipulate default file context
152       mappings.
153
154       semanage permissive can also be used to manipulate  whether  or  not  a
155       process type is permissive.
156
157       semanage  module can also be used to enable/disable/install/remove pol‐
158       icy modules.
159
160       semanage boolean can also be used to manipulate the booleans
161
162
163       system-config-selinux is a GUI tool available to customize SELinux pol‐
164       icy settings.
165
166

AUTHOR

168       This manual page was auto-generated using sepolicy manpage .
169
170