1init_selinux(8) SELinux Policy init init_selinux(8)
2
6 init_selinux - Security Enhanced Linux Policy for the init processes
7
9 Security-Enhanced Linux secures the init processes via flexible manda‐
10 tory access control.
11 The init processes execute with the init_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15 For example:
17 ps -eZ | grep init_t
19
23 The init_t SELinux type can be entered via the shell_exec_t,
24 init_exec_t file types.
25 The default entrypoint paths for the init_t domain are the following:
27 /bin/d?ash, /bin/ksh.*, /bin/zsh.*, /usr/bin/d?ash, /usr/bin/ksh.*,
29 /usr/bin/zsh.*, /bin/esh, /bin/bash, /bin/fish, /bin/mksh, /bin/sash,
30 /bin/tcsh, /bin/yash, /bin/bash2, /usr/bin/esh, /sbin/nologin,
31 /usr/bin/bash, /usr/bin/fish, /usr/bin/mksh, /usr/bin/sash,
32 /usr/bin/tcsh, /usr/bin/yash, /usr/bin/bash2, /usr/sbin/sesh,
33 /usr/sbin/smrsh, /usr/bin/scponly, /usr/libexec/sesh, /usr/sbin/nolo‐
34 gin, /usr/bin/git-shell, /usr/sbin/scponlyc, /usr/libexec/sudo/sesh,
35 /usr/bin/cockpit-bridge, /usr/libexec/cockpit-agent, /usr/libexec/git-
36 core/git-shell, /sbin/init(ng)?, /usr/sbin/init(ng)?, /usr/lib/sys‐
37 temd/[^/]*, /usr/lib/systemd/system-generators/[^/]*, /bin/systemd,
38 /sbin/upstart, /usr/bin/systemd, /usr/sbin/upstart
39
41 SELinux defines process types (domains) for each process running on the
42 system
43 You can see the context of a process using the -Z option to ps
45 Policy governs the access confined processes have to files. SELinux
47 init policy is very flexible allowing users to setup their init pro‐
48 cesses in as secure a method as possible.
49 The following process types are defined for init:
51 init_t, initrc_t
53 Note: semanage permissive -a init_t can be used to make the process
55 type init_t permissive. SELinux does not deny access to permissive
56 process types, but the AVC (SELinux denials) messages are still gener‐
57 ated.
58
61 SELinux policy is customizable based on least access required. init
62 policy is extremely flexible and has several booleans that allow you to
63 manipulate the policy and run init with the tightest access possible.
64 If you want to allow users to resolve user passwd entries directly from
68 ldap rather then using a sssd server, you must turn on the authlo‐
69 gin_nsswitch_use_ldap boolean. Disabled by default.
70 setsebool -P authlogin_nsswitch_use_ldap 1
72 If you want to deny all system processes and Linux users to use blue‐
76 tooth wireless technology, you must turn on the deny_bluetooth boolean.
77 Enabled by default.
78 setsebool -P deny_bluetooth 1
80 If you want to allow all domains to execute in fips_mode, you must turn
84 on the fips_mode boolean. Enabled by default.
85 setsebool -P fips_mode 1
87 If you want to allow confined applications to run with kerberos, you
91 must turn on the kerberos_enabled boolean. Enabled by default.
92 setsebool -P kerberos_enabled 1
94 If you want to allow system to run with NIS, you must turn on the
98 nis_enabled boolean. Disabled by default.
99 setsebool -P nis_enabled 1
101 If you want to allow confined applications to use nscd shared memory,
105 you must turn on the nscd_use_shm boolean. Disabled by default.
106 setsebool -P nscd_use_shm 1
108 If you want to allow create vbox modules during startup new kernel, you
112 must turn on the use_virtualbox boolean. Disabled by default.
113 setsebool -P use_virtualbox 1
115
119 The SELinux process type init_t can manage files labeled with the fol‐
120 lowing file types. The paths listed are the default paths for these
121 file types. Note the processes UID still need to have DAC permissions.
122 auditd_etc_t
124 /etc/audit(/.*)?
126 binfmt_misc_fs_t
128 boolean_type
131 bpf_t
134 /sys/fs/bpf
136 cgroup_t
138 /sys/fs/cgroup
140 consolekit_log_t
142 /var/log/ConsoleKit(/.*)?
144 data_home_t
146 /root/.local/share(/.*)?
148 /home/[^/]+/.local/share(/.*)?
149 device_t
151 /dev/.*
153 /lib/udev/devices(/.*)?
154 /usr/lib/udev/devices(/.*)?
155 /dev
156 /etc/udev/devices
157 /var/named/chroot/dev
158 /var/spool/postfix/dev
159 /var/named/chroot_sdb/dev
160 etc_aliases_t
162 /etc/mail/.*.db
164 /etc/mail/aliases.*
165 /etc/postfix/aliases.*
166 /etc/aliases
167 /etc/aliases.db
168 etc_runtime_t
170 /[^/]+
172 /etc/mtab.*
173 /etc/blkid(/.*)?
174 /etc/nologin.*
175 /etc/.fstab.hal..+
176 /halt
177 /fastboot
178 /poweroff
179 /.autofsck
180 /etc/cmtab
181 /forcefsck
182 /.suspended
183 /fsckoptions
184 /.autorelabel
185 /etc/.updated
186 /var/.updated
187 /etc/killpower
188 /etc/nohotplug
189 /etc/securetty
190 /etc/ioctl.save
191 /etc/fstab.REVOKE
192 /etc/network/ifstate
193 /etc/sysconfig/hwconf
194 /etc/ptal/ptal-printd-like
195 /etc/sysconfig/iptables.save
196 /etc/xorg.conf.d/00-system-setup-keyboard.conf
197 /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
198 faillog_t
200 /var/log/btmp.*
202 /var/log/faillog.*
203 /var/log/tallylog.*
204 /var/run/faillock(/.*)?
205 gnome_home_type
207 init_tmp_t
210 init_var_lib_t
213 /var/lib/systemd(/.*)?
215 /var/lib/private/systemd(/.*)?
216 init_var_run_t
218 /var/run/systemd(/.*)?
220 initrc_state_t
222 initrc_var_run_t
225 /var/run/utmp
227 /var/run/random-seed
228 /var/run/runlevel.dir
229 /var/run/setmixer_flag
230 ipsec_var_run_t
232 /var/racoon(/.*)?
234 /var/run/pluto(/.*)?
235 /var/run/charon.*
236 /var/run/racoon.pid
237 /var/run/charon.ctl
238 /var/run/charon.vici
239 iscsi_lock_t
241 /var/lock/iscsi(/.*)?
243 krb5_host_rcache_t
245 /var/cache/krb5rcache(/.*)?
247 /var/tmp/nfs_0
248 /var/tmp/DNS_25
249 /var/tmp/host_0
250 /var/tmp/imap_0
251 /var/tmp/HTTP_23
252 /var/tmp/HTTP_48
253 /var/tmp/ldap_55
254 /var/tmp/ldap_487
255 /var/tmp/ldapmap1_0
256 krb5_keytab_t
258 /etc/krb5.keytab
260 /etc/krb5kdc/kadm5.keytab
261 /var/kerberos/krb5kdc/kadm5.keytab
262 lastlog_t
264 /var/log/lastlog.*
266 ld_so_cache_t
268 /etc/ld.so.cache
270 /etc/ld.so.cache~
271 /etc/ld.so.preload
272 /etc/ld.so.preload~
273 locale_t
275 /etc/locale.conf
277 /etc/vconsole.conf
278 /usr/lib/locale(/.*)?
279 /usr/share/locale(/.*)?
280 /usr/share/zoneinfo(/.*)?
281 /usr/share/X11/locale(/.*)?
282 /etc/timezone
283 /etc/localtime
284 /etc/sysconfig/clock
285 /etc/avahi/etc/localtime
286 /var/empty/sshd/etc/localtime
287 /var/named/chroot/etc/localtime
288 /var/spool/postfix/etc/localtime
289 lockfile
291 machineid_t
294 /etc/machine-id
296 /var/run/systemd/machine-id
297 mdadm_var_run_t
299 /dev/md/.*
301 /var/run/mdadm(/.*)?
302 /dev/.mdadm.map
303 mnt_t
305 /mnt(/[^/]*)?
307 /mnt(/[^/]*)?
308 /rhev(/[^/]*)?
309 /rhev/[^/]*/.*
310 /media(/[^/]*)?
311 /media(/[^/]*)?
312 /media/.hal-.*
313 /var/run/media(/[^/]*)?
314 /afs
315 /net
316 /misc
317 /rhev
318 mount_var_run_t
320 /run/mount(/.*)?
322 /dev/.mount(/.*)?
323 /var/run/mount(/.*)?
324 /var/run/davfs2(/.*)?
325 /var/cache/davfs2(/.*)?
326 named_conf_t
328 /etc/rndc.*
330 /etc/unbound(/.*)?
331 /var/named/chroot(/.*)?
332 /etc/named.rfc1912.zones
333 /var/named/chroot/etc/named.rfc1912.zones
334 /etc/named.conf
335 /var/named/named.ca
336 /etc/named.root.hints
337 /var/named/chroot/etc/named.conf
338 /etc/named.caching-nameserver.conf
339 /var/named/chroot/var/named/named.ca
340 /var/named/chroot/etc/named.root.hints
341 /var/named/chroot/etc/named.caching-nameserver.conf
342 passwd_file_t
344 /etc/group[-+]?
346 /etc/passwd[-+]?
347 /etc/passwd.adjunct.*
348 /etc/ptmptmp
349 /etc/.pwd.lock
350 /etc/group.lock
351 /etc/passwd.OLD
352 /etc/passwd.lock
353 print_spool_t
355 /var/spool/lpd(/.*)?
357 /var/spool/cups(/.*)?
358 /var/spool/cups-pdf(/.*)?
359 random_seed_t
361 /var/lib/random-seed
363 /usr/var/lib/random-seed
364 security_t
366 /selinux
368 svirt_file_type
370 sysctl_type
373 sysfs_t
376 /sys(/.*)?
378 systemd_home_t
380 /root/.local/share/systemd(/.*)?
382 /home/[^/]+/.local/share/systemd(/.*)?
383 systemd_logind_var_run_t
385 /var/run/.*nologin.*
387 /var/run/systemd/seats(/.*)?
388 /var/run/systemd/users(/.*)?
389 /var/run/systemd/shutdown(/.*)?
390 systemd_passwd_var_run_t
392 /var/run/systemd/ask-password(/.*)?
394 /var/run/systemd/ask-password-block(/.*)?
395 systemd_unit_file_type
397 tmpfs_t
400 /dev/shm
402 /var/run/shm
403 /usr/lib/udev/devices/shm
404 udev_rules_t
406 /etc/udev/rules.d(/.*)?
408 var_lib_nfs_t
410 /var/lib/nfs(/.*)?
412 var_lib_t
414 /opt/(.*/)?var/lib(/.*)?
416 /var/lib(/.*)?
417 var_log_t
419 /var/log/.*
421 /nsr/logs(/.*)?
422 /var/webmin(/.*)?
423 /var/log/secure[^/]*
424 /opt/zimbra/log(/.*)?
425 /var/log/maillog[^/]*
426 /var/log/spooler[^/]*
427 /var/log/messages[^/]*
428 /usr/centreon/log(/.*)?
429 /var/spool/rsyslog(/.*)?
430 /var/axfrdns/log/main(/.*)?
431 /var/spool/bacula/log(/.*)?
432 /var/tinydns/log/main(/.*)?
433 /var/dnscache/log/main(/.*)?
434 /var/stockmaniac/templates_cache(/.*)?
435 /opt/Symantec/scspagent/IDS/system(/.*)?
436 /var/log
437 /var/log/dmesg
438 /var/log/syslog
439 /var/named/chroot/var/log
440 var_run_t
442 /run/.*
444 /var/run/.*
445 /run
446 /var/run
447 /var/run
448 /var/spool/postfix/pid
449 wtmp_t
451 /var/log/wtmp.*
453
456 SELinux requires files to have an extended attribute to define the file
457 type.
458 You can see the context of a file using the -Z option to ls
460 Policy governs the access confined processes have to these files.
462 SELinux init policy is very flexible allowing users to setup their init
463 processes in as secure a method as possible.
464 EQUIVALENCE DIRECTORIES
466 init policy stores data with multiple different file context types
469 under the /var/run/systemd directory. If you would like to store the
470 data in a different directory you can use the semanage command to cre‐
471 ate an equivalence mapping. If you wanted to store this data under the
472 /srv dirctory you would execute the following command:
473 semanage fcontext -a -e /var/run/systemd /srv/systemd
475 restorecon -R -v /srv/systemd
476 STANDARD FILE CONTEXT
478 SELinux defines the file context types for the init, if you wanted to
480 store files with these types in a diffent paths, you need to execute
481 the semanage command to sepecify alternate labeling and then use
482 restorecon to put the labels on disk.
483 semanage fcontext -a -t initrc_var_run_t '/srv/myinit_content(/.*)?'
485 restorecon -R -v /srv/myinit_content
486 Note: SELinux often uses regular expressions to specify labels that
488 match multiple files.
489 The following file types are defined for init:
491 init_exec_t
495 - Set files with the init_exec_t type, if you want to transition an
497 executable to the init_t domain.
498 Paths:
501 /sbin/init(ng)?, /usr/sbin/init(ng)?, /usr/lib/systemd/[^/]*,
502 /usr/lib/systemd/system-generators/[^/]*, /bin/systemd,
503 /sbin/upstart, /usr/bin/systemd, /usr/sbin/upstart
504 init_tmp_t
507 - Set files with the init_tmp_t type, if you want to store init tempo‐
509 rary files in the /tmp directories.
510 init_var_lib_t
514 - Set files with the init_var_lib_t type, if you want to store the init
516 files under the /var/lib directory.
517 Paths:
520 /var/lib/systemd(/.*)?, /var/lib/private/systemd(/.*)?
521 init_var_run_t
524 - Set files with the init_var_run_t type, if you want to store the init
526 files under the /run or /var/run directory.
527 initctl_t
531 - Set files with the initctl_t type, if you want to treat the files as
533 initctl data.
534 Paths:
537 /dev/initctl, /var/run/initctl, /var/run/systemd/initctl/fifo
538 initrc_devpts_t
541 - Set files with the initrc_devpts_t type, if you want to treat the
543 files as initrc devpts data.
544 initrc_exec_t
548 - Set files with the initrc_exec_t type, if you want to transition an
550 executable to the initrc_t domain.
551 Paths:
554 /etc/init.d/.*, /etc/rc.d/rc.[^/]+, /etc/rc.d/init.d/.*,
555 /opt/nfast/sbin/init.d-ncipher, /usr/libexec/dcc/stop-.*,
556 /usr/libexec/dcc/start-.*, /usr/lib/systemd/fedora[^/]*,
557 /opt/nfast/scripts/init.d/(.*), /etc/rc.d/rc, /etc/X11/prefdm,
558 /usr/sbin/startx, /usr/bin/sepg_ctl, /usr/sbin/start-dirsrv,
559 /usr/sbin/open_init_pty, /usr/sbin/restart-dirsrv, /etc/syscon‐
560 fig/network-scripts/ifup-ipsec, /usr/share/system-config-ser‐
561 vices/system-config-services-mechanism.py
562 initrc_state_t
565 - Set files with the initrc_state_t type, if you want to treat the
567 files as initrc state data.
568 initrc_tmp_t
572 - Set files with the initrc_tmp_t type, if you want to store initrc
574 temporary files in the /tmp directories.
575 initrc_var_log_t
579 - Set files with the initrc_var_log_t type, if you want to treat the
581 data as initrc var log data, usually stored under the /var/log direc‐
582 tory.
583 initrc_var_run_t
587 - Set files with the initrc_var_run_t type, if you want to store the
589 initrc files under the /run or /var/run directory.
590 Paths:
593 /var/run/utmp, /var/run/random-seed, /var/run/runlevel.dir,
594 /var/run/setmixer_flag
595 Note: File context can be temporarily modified with the chcon command.
598 If you want to permanently change the file context you need to use the
599 semanage fcontext command. This will modify the SELinux labeling data‐
600 base. You will need to use restorecon to apply the labels.
601
604 semanage fcontext can also be used to manipulate default file context
605 mappings.
606 semanage permissive can also be used to manipulate whether or not a
608 process type is permissive.
609 semanage module can also be used to enable/disable/install/remove pol‐
611 icy modules.
612 semanage boolean can also be used to manipulate the booleans
614 system-config-selinux is a GUI tool available to customize SELinux pol‐
617 icy settings.
618
621 This manual page was auto-generated using sepolicy manpage .
622
625 selinux(8), init(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
626 setsebool(8)
627init 19-06-18 init_selinux(8)