1initrc_selinux(8) SELinux Policy initrc initrc_selinux(8)
2
3
4
6 initrc_selinux - Security Enhanced Linux Policy for the initrc pro‐
7 cesses
8
10 Security-Enhanced Linux secures the initrc processes via flexible
11 mandatory access control.
12
13 The initrc processes execute with the initrc_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep initrc_t
20
21
22
24 The initrc_t SELinux type can be entered via the openct_initrc_exec_t,
25 smsd_initrc_exec_t, cfengine_initrc_exec_t, zabbix_initrc_exec_t,
26 pcp_pmcd_initrc_exec_t, rpcbind_initrc_exec_t, dnsmasq_initrc_exec_t,
27 mysqlmanagerd_initrc_exec_t, pcp_pmproxy_initrc_exec_t, rpcd_ini‐
28 trc_exec_t, shell_exec_t, dspam_initrc_exec_t, acct_initrc_exec_t,
29 gpsd_initrc_exec_t, tgtd_initrc_exec_t, cpuplug_initrc_exec_t,
30 abrt_initrc_exec_t, glance_scrubber_initrc_exec_t, qpidd_initrc_exec_t,
31 mysqld_initrc_exec_t, cluster_initrc_exec_t, foghorn_initrc_exec_t,
32 glusterd_initrc_exec_t, wdmd_initrc_exec_t, openhpid_initrc_exec_t,
33 kdump_initrc_exec_t, sslh_initrc_exec_t, auditd_initrc_exec_t, lld‐
34 pad_initrc_exec_t, ciped_initrc_exec_t, tor_initrc_exec_t, postfix_ini‐
35 trc_exec_t, pppd_initrc_exec_t, syslogd_initrc_exec_t, ntop_ini‐
36 trc_exec_t, svnserve_initrc_exec_t, cyphesis_initrc_exec_t, virt‐
37 logd_initrc_exec_t, rhsmcertd_initrc_exec_t, bluetooth_initrc_exec_t,
38 certmaster_initrc_exec_t, rabbitmq_initrc_exec_t, canna_initrc_exec_t,
39 rngd_initrc_exec_t, sendmail_initrc_exec_t, ipsec_initrc_exec_t,
40 apcupsd_initrc_exec_t, automount_initrc_exec_t, denyhosts_ini‐
41 trc_exec_t, pingd_initrc_exec_t, saslauthd_initrc_exec_t, couchdb_ini‐
42 trc_exec_t, arpwatch_initrc_exec_t, postgrey_initrc_exec_t, nscd_ini‐
43 trc_exec_t, spamd_initrc_exec_t, varnishlog_initrc_exec_t, slpd_ini‐
44 trc_exec_t, sysstat_initrc_exec_t, snort_initrc_exec_t, openvpn_ini‐
45 trc_exec_t, puppetmaster_initrc_exec_t, pcp_pmlogger_initrc_exec_t,
46 cvs_initrc_exec_t, roundup_initrc_exec_t, pcp_pmie_initrc_exec_t,
47 cupsd_initrc_exec_t, cobblerd_initrc_exec_t, pads_initrc_exec_t,
48 smokeping_initrc_exec_t, cgconfig_initrc_exec_t, sensord_initrc_exec_t,
49 dhcpd_initrc_exec_t, keystone_initrc_exec_t, zoneminder_initrc_exec_t,
50 ypbind_initrc_exec_t, drbd_initrc_exec_t, entropyd_initrc_exec_t, ajax‐
51 term_initrc_exec_t, uuidd_initrc_exec_t, httpd_initrc_exec_t, bitl‐
52 bee_initrc_exec_t, piranha_pulse_initrc_exec_t, ctdbd_initrc_exec_t,
53 portreserve_initrc_exec_t, minissdpd_initrc_exec_t, cyrus_ini‐
54 trc_exec_t, bcfg2_initrc_exec_t, portmap_initrc_exec_t, pcp_plugin_ini‐
55 trc_exec_t, ksmtuned_initrc_exec_t, neutron_initrc_exec_t, dictd_ini‐
56 trc_exec_t, asterisk_initrc_exec_t, minidlna_initrc_exec_t,
57 antivirus_initrc_exec_t, watchdog_initrc_exec_t, aiccu_initrc_exec_t,
58 varnishd_initrc_exec_t, likewise_initrc_exec_t, psad_initrc_exec_t,
59 kismet_initrc_exec_t, iwhd_initrc_exec_t, vdagentd_initrc_exec_t,
60 shorewall_initrc_exec_t, radvd_initrc_exec_t, blkmapd_initrc_exec_t,
61 fail2ban_initrc_exec_t, snmpd_initrc_exec_t, radiusd_initrc_exec_t,
62 ntpd_initrc_exec_t, named_initrc_exec_t, cgred_initrc_exec_t, puppeta‐
63 gent_initrc_exec_t, l2tpd_initrc_exec_t, soundd_initrc_exec_t,
64 virtd_initrc_exec_t, afs_initrc_exec_t, conntrackd_initrc_exec_t,
65 lircd_initrc_exec_t, slapd_initrc_exec_t, mdadm_initrc_exec_t,
66 pcscd_initrc_exec_t, rhnsd_initrc_exec_t, postgresql_initrc_exec_t,
67 vnstatd_initrc_exec_t, polipo_initrc_exec_t, callweaver_initrc_exec_t,
68 ddclient_initrc_exec_t, tuned_initrc_exec_t, amtu_initrc_exec_t, zab‐
69 bix_agent_initrc_exec_t, vhostmd_initrc_exec_t, mcelog_initrc_exec_t,
70 hddtemp_initrc_exec_t, nis_initrc_exec_t, crond_initrc_exec_t,
71 exim_initrc_exec_t, innd_initrc_exec_t, sanlock_initrc_exec_t, dlm_con‐
72 trold_initrc_exec_t, iodined_initrc_exec_t, sshd_initrc_exec_t, ice‐
73 cast_initrc_exec_t, collectd_initrc_exec_t, pcp_pmwebd_initrc_exec_t,
74 pki_tps_script_exec_t, uucpd_initrc_exec_t, mscan_initrc_exec_t, hyper‐
75 vkvp_initrc_exec_t, irqbalance_initrc_exec_t, chronyd_initrc_exec_t,
76 boinc_initrc_exec_t, naemon_initrc_exec_t, pki_ra_script_exec_t, con‐
77 dor_initrc_exec_t, sblim_initrc_exec_t, osad_initrc_exec_t, bin_t,
78 dovecot_initrc_exec_t, rwho_initrc_exec_t, fcoemon_initrc_exec_t,
79 nfsd_initrc_exec_t, gpm_initrc_exec_t, mpd_initrc_exec_t, kerberos_ini‐
80 trc_exec_t, munin_initrc_exec_t, fsdaemon_initrc_exec_t, tcsd_ini‐
81 trc_exec_t, squid_initrc_exec_t, pkcs_slotd_initrc_exec_t, rtkit_dae‐
82 mon_initrc_exec_t, apmd_initrc_exec_t, fetchmail_initrc_exec_t,
83 pcp_pmmgr_initrc_exec_t, NetworkManager_initrc_exec_t, cmirrord_ini‐
84 trc_exec_t, glance_api_initrc_exec_t, sssd_initrc_exec_t, samba_ini‐
85 trc_exec_t, bacula_initrc_exec_t, ulogd_initrc_exec_t, ccs_ini‐
86 trc_exec_t, ricci_initrc_exec_t, setrans_initrc_exec_t, nslcd_ini‐
87 trc_exec_t, prelude_initrc_exec_t, iptables_initrc_exec_t, ora‐
88 cleasm_initrc_exec_t, mon_statd_initrc_exec_t, gdomap_initrc_exec_t,
89 zebra_initrc_exec_t, redis_initrc_exec_t, dhcpc_helper_exec_t, mon‐
90 god_initrc_exec_t, usr_t, ftpd_initrc_exec_t, isnsd_initrc_exec_t,
91 privoxy_initrc_exec_t, firewalld_initrc_exec_t, mrtg_initrc_exec_t,
92 certmonger_initrc_exec_t, jabberd_initrc_exec_t, clvmd_initrc_exec_t,
93 glance_registry_initrc_exec_t, avahi_initrc_exec_t, memcached_ini‐
94 trc_exec_t, initrc_exec_t, nagios_initrc_exec_t file types.
95
96 The default entrypoint paths for the initrc_t domain are the following:
97
98 All executeables with the default executable label, usually stored in
99 /usr/bin and /usr/sbin. /etc/rc.d/init.d/openct,
100 /etc/rc.d/init.d/smsd, /etc/rc.d/init.d/((cf-serverd)|(cf-moni‐
101 tord)|(cf-execd)), /etc/rc.d/init.d/(zabbix|zabbix-server),
102 /etc/rc.d/init.d/pmcd, /etc/rc.d/init.d/rpcbind, /etc/rc.d/init.d/dns‐
103 masq, /etc/rc.d/init.d/mysqlmanager, /etc/rc.d/init.d/pmproxy,
104 /etc/rc.d/init.d/nfslock, /etc/rc.d/init.d/rpcidmapd, /bin/d?ash,
105 /bin/ksh.*, /bin/zsh.*, /usr/bin/d?ash, /usr/bin/ksh.*, /usr/bin/zsh.*,
106 /bin/esh, /bin/bash, /bin/fish, /bin/mksh, /bin/sash, /bin/tcsh,
107 /bin/yash, /bin/bash2, /usr/bin/esh, /sbin/nologin, /usr/bin/bash,
108 /usr/bin/fish, /usr/bin/mksh, /usr/bin/sash, /usr/bin/tcsh,
109 /usr/bin/yash, /usr/bin/bash2, /usr/sbin/sesh, /usr/sbin/smrsh,
110 /usr/bin/scponly, /usr/libexec/sesh, /usr/sbin/nologin, /usr/bin/git-
111 shell, /usr/sbin/scponlyc, /usr/libexec/sudo/sesh, /usr/bin/cockpit-
112 bridge, /usr/libexec/cockpit-agent, /usr/libexec/git-core/git-shell,
113 /etc/rc.d/init.d/dspam, /etc/rc.d/init.d/psacct, /etc/rc.d/init.d/gpsd,
114 /etc/rc.d/init.d/tgtd, /etc/rc.d/init.d/cpuplugd,
115 /etc/rc.d/init.d/abrt, /etc/rc.d/init.d/openstack-glance-scrubber,
116 /etc/rc.d/init.d/qpidd, /etc/rc.d/init.d/mysqld, /etc/rc.d/init.d/ope‐
117 nais, /etc/rc.d/init.d/corosync, /etc/rc.d/init.d/cpglockd,
118 /etc/rc.d/init.d/heartbeat, /etc/rc.d/init.d/pacemaker,
119 /etc/rc.d/init.d/rgmanager, /etc/rc.d/init.d/gluster.*, /usr/sbin/glus‐
120 terd, /etc/rc.d/init.d/wdmd, /etc/rc.d/init.d/openhpid,
121 /etc/rc.d/init.d/kdump, /etc/rc.d/init.d/sslh, /etc/rc.d/init.d/auditd,
122 /etc/rc.d/init.d/lldpad, /etc/rc.d/init.d/ciped.*,
123 /etc/rc.d/init.d/tor, /etc/rc.d/init.d/postfix,
124 /etc/ppp/(auth|ip(v6|x)?)-(up|down), /etc/rc.d/init.d/ppp,
125 /etc/rc.d/init.d/rsyslog, /etc/rc.d/init.d/ntop,
126 /etc/rc.d/init.d/svnserve, /etc/rc.d/init.d/cyphesis,
127 /etc/rc.d/init.d/virtlogd, /etc/rc.d/init.d/rhsmcertd,
128 /etc/rc.d/init.d/dund, /etc/rc.d/init.d/pand, /etc/rc.d/init.d/blue‐
129 tooth, /etc/rc.d/init.d/certmaster, /etc/rc.d/init.d/rabbitmq-server,
130 /etc/rc.d/init.d/canna, /etc/rc.d/init.d/rngd, /etc/rc.d/init.d/send‐
131 mail, /etc/rc.d/init.d/ipsec, /etc/rc.d/init.d/racoon,
132 /etc/rc.d/init.d/strongswan, /etc/rc.d/init.d/apcupsd,
133 /etc/rc.d/init.d/autofs, /etc/rc.d/init.d/denyhosts,
134 /etc/rc.d/init.d/whatsup-pingd, /etc/rc.d/init.d/sasl,
135 /etc/rc.d/init.d/couchdb, /etc/rc.d/init.d/arpwatch,
136 /etc/rc.d/init.d/postgrey, /etc/rc.d/init.d/nscd,
137 /etc/rc.d/init.d/mimedefang.*, /etc/rc.d/init.d/spamd,
138 /etc/rc.d/init.d/pyzord, /etc/rc.d/init.d/spampd, /etc/rc.d/init.d/var‐
139 nishlog, /etc/rc.d/init.d/varnishncsa, /etc/rc.d/init.d/slpd,
140 /etc/rc.d/init.d/sysstat, /etc/rc.d/init.d/snortd,
141 /etc/rc.d/init.d/openvpn, /etc/rc.d/init.d/puppetmaster,
142 /etc/rc.d/init.d/pmlogger, /etc/rc.d/init.d/cvs,
143 /etc/rc.d/init.d/roundup, /etc/rc.d/init.d/pmie, /etc/rc.d/init.d/cups,
144 /etc/rc.d/init.d/cobblerd, /etc/rc.d/init.d/pads,
145 /etc/rc.d/init.d/smokeping, /etc/rc.d/init.d/cgconfig,
146 /etc/rc.d/init.d/sensord, /etc/rc.d/init.d/dhcpd(6)?,
147 /etc/rc.d/init.d/dhcrelay(6)?, /etc/rc.d/init.d/openstack-keystone,
148 /etc/rc.d/init.d/zoneminder, /etc/rc.d/init.d/ypbind,
149 /etc/rc.d/init.d/drbd, /etc/rc.d/init.d/((audio-entropyd)|(haveged)),
150 /etc/rc.d/init.d/ajaxterm, /etc/rc.d/init.d/uuidd, /etc/init.d/chero‐
151 kee, /etc/rc.d/init.d/httpd, /etc/rc.d/init.d/lighttpd,
152 /etc/rc.d/init.d/bitlbee, /etc/rc.d/init.d/pulse,
153 /etc/rc.d/init.d/ctdb, /etc/rc.d/init.d/portreserve,
154 /etc/rc.d/init.d/minissdpd, /etc/rc.d/init.d/cyrus.*,
155 /etc/rc.d/init.d/bcfg2-server, /etc/rc.d/init.d/portmap,
156 /etc/rc.d/init.d/ksmtuned, /etc/rc.d/init.d/neutron.*,
157 /etc/rc.d/init.d/quantum.*, /etc/rc.d/init.d/dictd,
158 /etc/rc.d/init.d/asterisk, /etc/rc.d/init.d/minidlna,
159 /etc/rc.d/init.d/clamd.*, /etc/rc.d/init.d/amavis,
160 /etc/rc.d/init.d/amavisd-snmp, /etc/rc.d/init.d/watchdog,
161 /etc/rc.d/init.d/aiccu, /etc/rc.d/init.d/varnish,
162 /etc/rc.d/init.d/lwiod, /etc/rc.d/init.d/lwsmd,
163 /etc/rc.d/init.d/lsassd, /etc/rc.d/init.d/lwregd,
164 /etc/rc.d/init.d/dcerpcd, /etc/rc.d/init.d/srvsvcd,
165 /etc/rc.d/init.d/likewise, /etc/rc.d/init.d/eventlogd,
166 /etc/rc.d/init.d/netlogond, /etc/rc.d/init.d/psad,
167 /etc/rc.d/init.d/kismet.*, /etc/rc.d/init.d/iwhd,
168 /etc/rc.d/init.d/spice-vdagentd, /etc/rc.d/init.d/shorewall.*,
169 /etc/rc.d/init.d/radvd, /etc/rc.d/init.d/blkmapd,
170 /etc/rc.d/init.d/fail2ban, /etc/rc.d/init.d/(snmpd|snmptrapd),
171 /etc/rc.d/init.d/radiusd, /etc/rc.d/init.d/ntpd,
172 /etc/rc.d/init.d/named, /etc/rc.d/init.d/unbound,
173 /etc/rc.d/init.d/named-sdb, /etc/rc.d/init.d/cgred,
174 /etc/rc.d/init.d/puppet, /etc/rc.d/init.d/.*l2tpd,
175 /etc/rc.d/init.d/nasd, /etc/rc.d/init.d/libvirtd,
176 /etc/rc.d/init.d/(open)?afs, /etc/rc.d/init.d/openafs-client,
177 /etc/rc.d/init.d/lirc, /etc/rc.d/init.d/slapd, /etc/rc.d/init.d/mdmoni‐
178 tor, /etc/rc.d/init.d/pcscd, /etc/rc.d/init.d/rhnsd,
179 /etc/rc.d/init.d/(se)?postgresql, /etc/rc.d/init.d/vnstat,
180 /etc/rc.d/init.d/polipo, /etc/rc.d/init.d/callweaver,
181 /etc/rc.d/init.d/ddclient, /etc/rc.d/init.d/tuned,
182 /etc/rc.d/init.d/amtu, /etc/rc.d/init.d/zabbix-agentd,
183 /etc/rc.d/init.d/vhostmd, /etc/rc.d/init.d/mcelog,
184 /etc/rc.d/init.d/hddtemp, /etc/rc.d/init.d/ypserv,
185 /etc/rc.d/init.d/ypxfrd, /etc/rc.d/init.d/yppasswd,
186 /etc/rc.d/init.d/atd, /etc/rc.d/init.d/exim, /etc/rc.d/init.d/innd,
187 /etc/rc.d/init.d/sanlock, /etc/rc.d/init.d/((iodined)|(iodine-server)),
188 /etc/rc.d/init.d/sshd, /etc/rc.d/init.d/icecast, /etc/rc.d/init.d/col‐
189 lectd, /etc/rc.d/init.d/pmwebd, /etc/rc.d/init.d/uucp,
190 /etc/rc.d/init.d/MailScanner, /etc/rc.d/init.d/hypervkvpd,
191 /etc/rc.d/init.d/irqbalance, /etc/rc.d/init.d/chronyd,
192 /etc/rc.d/init.d/boinc-client, /etc/rc.d/init.d/naemon,
193 /etc/rc.d/init.d/condor, /etc/rc.d/init.d/gatherer,
194 /etc/rc.d/init.d/sblim-sfcbd, /etc/rc.d/init.d/osad,
195 /etc/rc.d/init.d/dovecot, /etc/rc.d/init.d/rwhod,
196 /etc/rc.d/init.d/fcoe, /etc/rc.d/init.d/nfs, /etc/rc.d/init.d/gpm,
197 /etc/rc.d/init.d/mpd, /etc/rc.d/init.d/kprop, /etc/rc.d/init.d/kadmind,
198 /etc/rc.d/init.d/krb524d, /etc/rc.d/init.d/krb5kdc,
199 /etc/rc.d/init.d/munin-node, /etc/rc.d/init.d/(smartd|smartmontools),
200 /etc/rc.d/init.d/(tcsd|trousers), /etc/rc.d/init.d/squid,
201 /etc/rc.d/init.d/pkcsslotd, /etc/rc.d/init.d/rtkit-daemon,
202 /etc/rc.d/init.d/acpid, /etc/rc.d/init.d/fetchmail,
203 /etc/rc.d/init.d/pmmgr, /etc/NetworkManager/dispatcher.d(/.*)?,
204 /etc/rc.d/init.d/wicd, /etc/rc.d/init.d/cmirrord,
205 /etc/rc.d/init.d/openstack-glance-api, /etc/rc.d/init.d/sssd,
206 /etc/rc.d/init.d/nmb, /etc/rc.d/init.d/smb, /etc/rc.d/init.d/winbind,
207 /etc/rc.d/init.d/bacula.*, /etc/rc.d/init.d/ulogd,
208 /etc/rc.d/init.d/((ccs)|(ccsd)), /etc/rc.d/init.d/ricci,
209 /etc/rc.d/init.d/mcstrans, /etc/rc.d/init.d/nslcd,
210 /etc/rc.d/init.d/prelude-lml, /etc/rc.d/init.d/prelude-manager,
211 /etc/rc.d/init.d/prelude-correlator, /etc/rc.d/init.d/ip6?tables,
212 /etc/rc.d/init.d/ebtables, /etc/rc.d/init.d/nftables,
213 /etc/rc.d/init.d/oracleasm, /etc/rc.d/init.d/mon_statd,
214 /etc/rc.d/init.d/gdomap, /etc/rc.d/init.d/bgpd, /etc/rc.d/init.d/ripd,
215 /etc/rc.d/init.d/isisd, /etc/rc.d/init.d/ospfd, /etc/rc.d/init.d/zebra,
216 /etc/rc.d/init.d/babeld, /etc/rc.d/init.d/ospf6d, /etc/rc.d/init.d/rip‐
217 ngd, /etc/rc.d/init.d/redis, /etc/firestarter/firestarter.sh,
218 /etc/rc.d/init.d/mongod, /etc/rc.d/init.d/mongos, /opt/.*, /usr/.*,
219 /emul/.*, /export(/.*)?, /ostree(/.*)?, /usr/doc(/.*)?/lib(/.*)?,
220 /usr/inclu.e(/.*)?, /usr/share/rpm(/.*)?,
221 /usr/share/doc(/.*)?/README.*, /usr/lib/modules(/.*)/vmlinuz,
222 /usr/lib/modules(/.*)/initramfs.img, /usr/lib/sysimage(/.*)?,
223 /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul, /etc/rc.d/init.d/vsftpd,
224 /etc/rc.d/init.d/proftpd, /etc/rc.d/init.d/isnsd,
225 /etc/rc.d/init.d/privoxy, /etc/rc.d/init.d/firewalld,
226 /etc/rc.d/init.d/mrtg, /etc/rc.d/init.d/certmonger,
227 /etc/rc.d/init.d/jabberd, /etc/rc.d/init.d/openstack-glance-registry,
228 /etc/rc.d/init.d/avahi.*, /etc/rc.d/init.d/memcached, /etc/init.d/.*,
229 /etc/rc.d/rc.[^/]+, /etc/rc.d/init.d/.*, /opt/nfast/sbin/init.d-nci‐
230 pher, /usr/libexec/dcc/stop-.*, /usr/libexec/dcc/start-.*,
231 /usr/lib/systemd/fedora[^/]*, /opt/nfast/scripts/init.d/(.*),
232 /etc/rc.d/rc, /etc/X11/prefdm, /usr/sbin/startx, /usr/bin/sepg_ctl,
233 /usr/sbin/start-dirsrv, /usr/sbin/open_init_pty, /usr/sbin/restart-
234 dirsrv, /etc/sysconfig/network-scripts/ifup-ipsec, /usr/share/system-
235 config-services/system-config-services-mechanism.py,
236 /etc/rc.d/init.d/nrpe, /etc/rc.d/init.d/nagios
237
239 SELinux defines process types (domains) for each process running on the
240 system
241
242 You can see the context of a process using the -Z option to ps
243
244 Policy governs the access confined processes have to files. SELinux
245 initrc policy is very flexible allowing users to setup their initrc
246 processes in as secure a method as possible.
247
248 The following process types are defined for initrc:
249
250 initrc_t
251
252 Note: semanage permissive -a initrc_t can be used to make the process
253 type initrc_t permissive. SELinux does not deny access to permissive
254 process types, but the AVC (SELinux denials) messages are still gener‐
255 ated.
256
257
259 SELinux policy is customizable based on least access required. initrc
260 policy is extremely flexible and has several booleans that allow you to
261 manipulate the policy and run initrc with the tightest access possible.
262
263
264
265 If you want to allow users to resolve user passwd entries directly from
266 ldap rather then using a sssd server, you must turn on the authlo‐
267 gin_nsswitch_use_ldap boolean. Disabled by default.
268
269 setsebool -P authlogin_nsswitch_use_ldap 1
270
271
272
273 If you want to deny user domains applications to map a memory region as
274 both executable and writable, this is dangerous and the executable
275 should be reported in bugzilla, you must turn on the deny_execmem bool‐
276 ean. Enabled by default.
277
278 setsebool -P deny_execmem 1
279
280
281
282 If you want to allow all domains to execute in fips_mode, you must turn
283 on the fips_mode boolean. Enabled by default.
284
285 setsebool -P fips_mode 1
286
287
288
289 If you want to allow confined applications to run with kerberos, you
290 must turn on the kerberos_enabled boolean. Enabled by default.
291
292 setsebool -P kerberos_enabled 1
293
294
295
296 If you want to control the ability to mmap a low area of the address
297 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
298 the mmap_low_allowed boolean. Disabled by default.
299
300 setsebool -P mmap_low_allowed 1
301
302
303
304 If you want to allow system to run with NIS, you must turn on the
305 nis_enabled boolean. Disabled by default.
306
307 setsebool -P nis_enabled 1
308
309
310
311 If you want to allow confined applications to use nscd shared memory,
312 you must turn on the nscd_use_shm boolean. Disabled by default.
313
314 setsebool -P nscd_use_shm 1
315
316
317
318 If you want to disable kernel module loading, you must turn on the
319 secure_mode_insmod boolean. Enabled by default.
320
321 setsebool -P secure_mode_insmod 1
322
323
324
325 If you want to allow unconfined executables to make their heap memory
326 executable. Doing this is a really bad idea. Probably indicates a
327 badly coded executable, but could indicate an attack. This executable
328 should be reported in bugzilla, you must turn on the selin‐
329 uxuser_execheap boolean. Disabled by default.
330
331 setsebool -P selinuxuser_execheap 1
332
333
334
335 If you want to allow unconfined executables to make their stack exe‐
336 cutable. This should never, ever be necessary. Probably indicates a
337 badly coded executable, but could indicate an attack. This executable
338 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
339 stack boolean. Enabled by default.
340
341 setsebool -P selinuxuser_execstack 1
342
343
344
346 The SELinux process type initrc_t can manage files labeled with the
347 following file types. The paths listed are the default paths for these
348 file types. Note the processes UID still need to have DAC permissions.
349
350 file_type
351
352 all files on the system
353
354
356 SELinux requires files to have an extended attribute to define the file
357 type.
358
359 You can see the context of a file using the -Z option to ls
360
361 Policy governs the access confined processes have to these files.
362 SELinux initrc policy is very flexible allowing users to setup their
363 initrc processes in as secure a method as possible.
364
365 STANDARD FILE CONTEXT
366
367 SELinux defines the file context types for the initrc, if you wanted to
368 store files with these types in a diffent paths, you need to execute
369 the semanage command to sepecify alternate labeling and then use
370 restorecon to put the labels on disk.
371
372 semanage fcontext -a -t initrc_var_run_t '/srv/myinitrc_content(/.*)?'
373 restorecon -R -v /srv/myinitrc_content
374
375 Note: SELinux often uses regular expressions to specify labels that
376 match multiple files.
377
378 The following file types are defined for initrc:
379
380
381
382 initrc_devpts_t
383
384 - Set files with the initrc_devpts_t type, if you want to treat the
385 files as initrc devpts data.
386
387
388
389 initrc_exec_t
390
391 - Set files with the initrc_exec_t type, if you want to transition an
392 executable to the initrc_t domain.
393
394
395 Paths:
396 /etc/init.d/.*, /etc/rc.d/rc.[^/]+, /etc/rc.d/init.d/.*,
397 /opt/nfast/sbin/init.d-ncipher, /usr/libexec/dcc/stop-.*,
398 /usr/libexec/dcc/start-.*, /usr/lib/systemd/fedora[^/]*,
399 /opt/nfast/scripts/init.d/(.*), /etc/rc.d/rc, /etc/X11/prefdm,
400 /usr/sbin/startx, /usr/bin/sepg_ctl, /usr/sbin/start-dirsrv,
401 /usr/sbin/open_init_pty, /usr/sbin/restart-dirsrv, /etc/syscon‐
402 fig/network-scripts/ifup-ipsec, /usr/share/system-config-ser‐
403 vices/system-config-services-mechanism.py
404
405
406 initrc_state_t
407
408 - Set files with the initrc_state_t type, if you want to treat the
409 files as initrc state data.
410
411
412
413 initrc_tmp_t
414
415 - Set files with the initrc_tmp_t type, if you want to store initrc
416 temporary files in the /tmp directories.
417
418
419
420 initrc_var_log_t
421
422 - Set files with the initrc_var_log_t type, if you want to treat the
423 data as initrc var log data, usually stored under the /var/log direc‐
424 tory.
425
426
427
428 initrc_var_run_t
429
430 - Set files with the initrc_var_run_t type, if you want to store the
431 initrc files under the /run or /var/run directory.
432
433
434 Paths:
435 /var/run/utmp, /var/run/random-seed, /var/run/runlevel.dir,
436 /var/run/setmixer_flag
437
438
439 Note: File context can be temporarily modified with the chcon command.
440 If you want to permanently change the file context you need to use the
441 semanage fcontext command. This will modify the SELinux labeling data‐
442 base. You will need to use restorecon to apply the labels.
443
444
446 semanage fcontext can also be used to manipulate default file context
447 mappings.
448
449 semanage permissive can also be used to manipulate whether or not a
450 process type is permissive.
451
452 semanage module can also be used to enable/disable/install/remove pol‐
453 icy modules.
454
455 semanage boolean can also be used to manipulate the booleans
456
457
458 system-config-selinux is a GUI tool available to customize SELinux pol‐
459 icy settings.
460
461
463 This manual page was auto-generated using sepolicy manpage .
464
465
467 selinux(8), initrc(8), semanage(8), restorecon(8), chcon(1), sepol‐
468 icy(8), setsebool(8)
469
470
471
472initrc 19-06-18 initrc_selinux(8)