1initrc_selinux(8)            SELinux Policy initrc           initrc_selinux(8)
2
3
4

NAME

6       initrc_selinux  -  Security  Enhanced  Linux Policy for the initrc pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  initrc  processes  via  flexible
11       mandatory access control.
12
13       The  initrc  processes  execute with the initrc_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep initrc_t
20
21
22

ENTRYPOINTS

24       The  initrc_t SELinux type can be entered via the openct_initrc_exec_t,
25       smsd_initrc_exec_t,    cfengine_initrc_exec_t,    zabbix_initrc_exec_t,
26       pcp_pmcd_initrc_exec_t,  rpcbind_initrc_exec_t,  dnsmasq_initrc_exec_t,
27       mysqlmanagerd_initrc_exec_t,    pcp_pmproxy_initrc_exec_t,    rpcd_ini‐
28       trc_exec_t,   shell_exec_t,   dspam_initrc_exec_t,  acct_initrc_exec_t,
29       gpsd_initrc_exec_t,     tgtd_initrc_exec_t,      cpuplug_initrc_exec_t,
30       abrt_initrc_exec_t, glance_scrubber_initrc_exec_t, qpidd_initrc_exec_t,
31       mysqld_initrc_exec_t,   cluster_initrc_exec_t,   foghorn_initrc_exec_t,
32       glusterd_initrc_exec_t,   wdmd_initrc_exec_t,   openhpid_initrc_exec_t,
33       kdump_initrc_exec_t,  sslh_initrc_exec_t,  auditd_initrc_exec_t,   lld‐
34       pad_initrc_exec_t, ciped_initrc_exec_t, tor_initrc_exec_t, postfix_ini‐
35       trc_exec_t,   pppd_initrc_exec_t,   syslogd_initrc_exec_t,    ntop_ini‐
36       trc_exec_t,   svnserve_initrc_exec_t,   cyphesis_initrc_exec_t,   virt‐
37       logd_initrc_exec_t,  rhsmcertd_initrc_exec_t,  bluetooth_initrc_exec_t,
38       certmaster_initrc_exec_t,  rabbitmq_initrc_exec_t, canna_initrc_exec_t,
39       rngd_initrc_exec_t,    sendmail_initrc_exec_t,     ipsec_initrc_exec_t,
40       apcupsd_initrc_exec_t,      automount_initrc_exec_t,     denyhosts_ini‐
41       trc_exec_t, pingd_initrc_exec_t, saslauthd_initrc_exec_t,  couchdb_ini‐
42       trc_exec_t,  arpwatch_initrc_exec_t,  postgrey_initrc_exec_t, nscd_ini‐
43       trc_exec_t,  spamd_initrc_exec_t,  varnishlog_initrc_exec_t,  slpd_ini‐
44       trc_exec_t,  sysstat_initrc_exec_t,  snort_initrc_exec_t,  openvpn_ini‐
45       trc_exec_t,   puppetmaster_initrc_exec_t,   pcp_pmlogger_initrc_exec_t,
46       cvs_initrc_exec_t,    roundup_initrc_exec_t,    pcp_pmie_initrc_exec_t,
47       cupsd_initrc_exec_t,    cobblerd_initrc_exec_t,     pads_initrc_exec_t,
48       smokeping_initrc_exec_t, cgconfig_initrc_exec_t, sensord_initrc_exec_t,
49       dhcpd_initrc_exec_t, keystone_initrc_exec_t,  zoneminder_initrc_exec_t,
50       ypbind_initrc_exec_t, drbd_initrc_exec_t, entropyd_initrc_exec_t, ajax‐
51       term_initrc_exec_t,  uuidd_initrc_exec_t,  httpd_initrc_exec_t,   bitl‐
52       bee_initrc_exec_t,   piranha_pulse_initrc_exec_t,  ctdbd_initrc_exec_t,
53       portreserve_initrc_exec_t,     minissdpd_initrc_exec_t,      cyrus_ini‐
54       trc_exec_t, bcfg2_initrc_exec_t, portmap_initrc_exec_t, pcp_plugin_ini‐
55       trc_exec_t, ksmtuned_initrc_exec_t,  neutron_initrc_exec_t,  dictd_ini‐
56       trc_exec_t,       asterisk_initrc_exec_t,       minidlna_initrc_exec_t,
57       antivirus_initrc_exec_t,  watchdog_initrc_exec_t,  aiccu_initrc_exec_t,
58       varnishd_initrc_exec_t,   likewise_initrc_exec_t,   psad_initrc_exec_t,
59       kismet_initrc_exec_t,    iwhd_initrc_exec_t,    vdagentd_initrc_exec_t,
60       shorewall_initrc_exec_t,   radvd_initrc_exec_t,  blkmapd_initrc_exec_t,
61       fail2ban_initrc_exec_t,   snmpd_initrc_exec_t,   radiusd_initrc_exec_t,
62       ntpd_initrc_exec_t,  named_initrc_exec_t, cgred_initrc_exec_t, puppeta‐
63       gent_initrc_exec_t,     l2tpd_initrc_exec_t,      soundd_initrc_exec_t,
64       virtd_initrc_exec_t,    afs_initrc_exec_t,    conntrackd_initrc_exec_t,
65       lircd_initrc_exec_t,     slapd_initrc_exec_t,      mdadm_initrc_exec_t,
66       pcscd_initrc_exec_t,   rhnsd_initrc_exec_t,   postgresql_initrc_exec_t,
67       vnstatd_initrc_exec_t, polipo_initrc_exec_t,  callweaver_initrc_exec_t,
68       ddclient_initrc_exec_t,  tuned_initrc_exec_t,  amtu_initrc_exec_t, zab‐
69       bix_agent_initrc_exec_t,  vhostmd_initrc_exec_t,  mcelog_initrc_exec_t,
70       hddtemp_initrc_exec_t,      nis_initrc_exec_t,     crond_initrc_exec_t,
71       exim_initrc_exec_t, innd_initrc_exec_t, sanlock_initrc_exec_t, dlm_con‐
72       trold_initrc_exec_t,  iodined_initrc_exec_t,  sshd_initrc_exec_t,  ice‐
73       cast_initrc_exec_t,  collectd_initrc_exec_t,  pcp_pmwebd_initrc_exec_t,
74       pki_tps_script_exec_t, uucpd_initrc_exec_t, mscan_initrc_exec_t, hyper‐
75       vkvp_initrc_exec_t,  irqbalance_initrc_exec_t,   chronyd_initrc_exec_t,
76       boinc_initrc_exec_t,  naemon_initrc_exec_t,  pki_ra_script_exec_t, con‐
77       dor_initrc_exec_t,  sblim_initrc_exec_t,   osad_initrc_exec_t,   bin_t,
78       dovecot_initrc_exec_t,    rwho_initrc_exec_t,    fcoemon_initrc_exec_t,
79       nfsd_initrc_exec_t, gpm_initrc_exec_t, mpd_initrc_exec_t, kerberos_ini‐
80       trc_exec_t,   munin_initrc_exec_t,   fsdaemon_initrc_exec_t,  tcsd_ini‐
81       trc_exec_t, squid_initrc_exec_t,  pkcs_slotd_initrc_exec_t,  rtkit_dae‐
82       mon_initrc_exec_t,     apmd_initrc_exec_t,     fetchmail_initrc_exec_t,
83       pcp_pmmgr_initrc_exec_t,  NetworkManager_initrc_exec_t,   cmirrord_ini‐
84       trc_exec_t,  glance_api_initrc_exec_t,  sssd_initrc_exec_t,  samba_ini‐
85       trc_exec_t,   bacula_initrc_exec_t,    ulogd_initrc_exec_t,    ccs_ini‐
86       trc_exec_t,   ricci_initrc_exec_t,   setrans_initrc_exec_t,  nslcd_ini‐
87       trc_exec_t,   prelude_initrc_exec_t,    iptables_initrc_exec_t,    ora‐
88       cleasm_initrc_exec_t,   mon_statd_initrc_exec_t,  gdomap_initrc_exec_t,
89       zebra_initrc_exec_t,  redis_initrc_exec_t,  dhcpc_helper_exec_t,   mon‐
90       god_initrc_exec_t,   usr_t,   ftpd_initrc_exec_t,  isnsd_initrc_exec_t,
91       privoxy_initrc_exec_t,   firewalld_initrc_exec_t,   mrtg_initrc_exec_t,
92       certmonger_initrc_exec_t,  jabberd_initrc_exec_t,  clvmd_initrc_exec_t,
93       glance_registry_initrc_exec_t,   avahi_initrc_exec_t,    memcached_ini‐
94       trc_exec_t, initrc_exec_t, nagios_initrc_exec_t file types.
95
96       The default entrypoint paths for the initrc_t domain are the following:
97
98       All  executeables  with the default executable label, usually stored in
99       /usr/bin        and        /usr/sbin.          /etc/rc.d/init.d/openct,
100       /etc/rc.d/init.d/smsd,         /etc/rc.d/init.d/((cf-serverd)|(cf-moni‐
101       tord)|(cf-execd)),             /etc/rc.d/init.d/(zabbix|zabbix-server),
102       /etc/rc.d/init.d/pmcd,  /etc/rc.d/init.d/rpcbind, /etc/rc.d/init.d/dns‐
103       masq,     /etc/rc.d/init.d/mysqlmanager,      /etc/rc.d/init.d/pmproxy,
104       /etc/rc.d/init.d/nfslock,    /etc/rc.d/init.d/rpcidmapd,    /bin/d?ash,
105       /bin/ksh.*, /bin/zsh.*, /usr/bin/d?ash, /usr/bin/ksh.*, /usr/bin/zsh.*,
106       /bin/esh,   /bin/bash,   /bin/fish,  /bin/mksh,  /bin/sash,  /bin/tcsh,
107       /bin/yash,  /bin/bash2,  /usr/bin/esh,  /sbin/nologin,   /usr/bin/bash,
108       /usr/bin/fish,     /usr/bin/mksh,     /usr/bin/sash,     /usr/bin/tcsh,
109       /usr/bin/yash,   /usr/bin/bash2,    /usr/sbin/sesh,    /usr/sbin/smrsh,
110       /usr/bin/scponly,  /usr/libexec/sesh,  /usr/sbin/nologin, /usr/bin/git-
111       shell,  /usr/sbin/scponlyc,  /usr/libexec/sudo/sesh,  /usr/bin/cockpit-
112       bridge,   /usr/libexec/cockpit-agent,  /usr/libexec/git-core/git-shell,
113       /etc/rc.d/init.d/dspam, /etc/rc.d/init.d/psacct, /etc/rc.d/init.d/gpsd,
114       /etc/rc.d/init.d/tgtd,                       /etc/rc.d/init.d/cpuplugd,
115       /etc/rc.d/init.d/abrt,      /etc/rc.d/init.d/openstack-glance-scrubber,
116       /etc/rc.d/init.d/qpidd,  /etc/rc.d/init.d/mysqld, /etc/rc.d/init.d/ope‐
117       nais,       /etc/rc.d/init.d/corosync,       /etc/rc.d/init.d/cpglockd,
118       /etc/rc.d/init.d/heartbeat,                 /etc/rc.d/init.d/pacemaker,
119       /etc/rc.d/init.d/rgmanager, /etc/rc.d/init.d/gluster.*, /usr/sbin/glus‐
120       terd,         /etc/rc.d/init.d/wdmd,         /etc/rc.d/init.d/openhpid,
121       /etc/rc.d/init.d/kdump, /etc/rc.d/init.d/sslh, /etc/rc.d/init.d/auditd,
122       /etc/rc.d/init.d/lldpad,                      /etc/rc.d/init.d/ciped.*,
123       /etc/rc.d/init.d/tor,                         /etc/rc.d/init.d/postfix,
124       /etc/ppp/(auth|ip(v6|x)?)-(up|down),              /etc/rc.d/init.d/ppp,
125       /etc/rc.d/init.d/rsyslog,                        /etc/rc.d/init.d/ntop,
126       /etc/rc.d/init.d/svnserve,                   /etc/rc.d/init.d/cyphesis,
127       /etc/rc.d/init.d/virtlogd,                  /etc/rc.d/init.d/rhsmcertd,
128       /etc/rc.d/init.d/dund,   /etc/rc.d/init.d/pand,  /etc/rc.d/init.d/blue‐
129       tooth,  /etc/rc.d/init.d/certmaster,  /etc/rc.d/init.d/rabbitmq-server,
130       /etc/rc.d/init.d/canna,  /etc/rc.d/init.d/rngd,  /etc/rc.d/init.d/send‐
131       mail,         /etc/rc.d/init.d/ipsec,          /etc/rc.d/init.d/racoon,
132       /etc/rc.d/init.d/strongswan,                  /etc/rc.d/init.d/apcupsd,
133       /etc/rc.d/init.d/autofs,                    /etc/rc.d/init.d/denyhosts,
134       /etc/rc.d/init.d/whatsup-pingd,                  /etc/rc.d/init.d/sasl,
135       /etc/rc.d/init.d/couchdb,                    /etc/rc.d/init.d/arpwatch,
136       /etc/rc.d/init.d/postgrey,                       /etc/rc.d/init.d/nscd,
137       /etc/rc.d/init.d/mimedefang.*,                  /etc/rc.d/init.d/spamd,
138       /etc/rc.d/init.d/pyzord, /etc/rc.d/init.d/spampd, /etc/rc.d/init.d/var‐
139       nishlog,      /etc/rc.d/init.d/varnishncsa,      /etc/rc.d/init.d/slpd,
140       /etc/rc.d/init.d/sysstat,                      /etc/rc.d/init.d/snortd,
141       /etc/rc.d/init.d/openvpn,                /etc/rc.d/init.d/puppetmaster,
142       /etc/rc.d/init.d/pmlogger,                        /etc/rc.d/init.d/cvs,
143       /etc/rc.d/init.d/roundup, /etc/rc.d/init.d/pmie, /etc/rc.d/init.d/cups,
144       /etc/rc.d/init.d/cobblerd,                       /etc/rc.d/init.d/pads,
145       /etc/rc.d/init.d/smokeping,                  /etc/rc.d/init.d/cgconfig,
146       /etc/rc.d/init.d/sensord,                   /etc/rc.d/init.d/dhcpd(6)?,
147       /etc/rc.d/init.d/dhcrelay(6)?,     /etc/rc.d/init.d/openstack-keystone,
148       /etc/rc.d/init.d/zoneminder,                   /etc/rc.d/init.d/ypbind,
149       /etc/rc.d/init.d/drbd,   /etc/rc.d/init.d/((audio-entropyd)|(haveged)),
150       /etc/rc.d/init.d/ajaxterm,  /etc/rc.d/init.d/uuidd,  /etc/init.d/chero‐
151       kee,         /etc/rc.d/init.d/httpd,         /etc/rc.d/init.d/lighttpd,
152       /etc/rc.d/init.d/bitlbee,                       /etc/rc.d/init.d/pulse,
153       /etc/rc.d/init.d/ctdb,                    /etc/rc.d/init.d/portreserve,
154       /etc/rc.d/init.d/minissdpd,                   /etc/rc.d/init.d/cyrus.*,
155       /etc/rc.d/init.d/bcfg2-server,                /etc/rc.d/init.d/portmap,
156       /etc/rc.d/init.d/ksmtuned,                  /etc/rc.d/init.d/neutron.*,
157       /etc/rc.d/init.d/quantum.*,                     /etc/rc.d/init.d/dictd,
158       /etc/rc.d/init.d/asterisk,                   /etc/rc.d/init.d/minidlna,
159       /etc/rc.d/init.d/clamd.*,                      /etc/rc.d/init.d/amavis,
160       /etc/rc.d/init.d/amavisd-snmp,               /etc/rc.d/init.d/watchdog,
161       /etc/rc.d/init.d/aiccu,                       /etc/rc.d/init.d/varnish,
162       /etc/rc.d/init.d/lwiod,                         /etc/rc.d/init.d/lwsmd,
163       /etc/rc.d/init.d/lsassd,                       /etc/rc.d/init.d/lwregd,
164       /etc/rc.d/init.d/dcerpcd,                     /etc/rc.d/init.d/srvsvcd,
165       /etc/rc.d/init.d/likewise,                  /etc/rc.d/init.d/eventlogd,
166       /etc/rc.d/init.d/netlogond,                      /etc/rc.d/init.d/psad,
167       /etc/rc.d/init.d/kismet.*,                       /etc/rc.d/init.d/iwhd,
168       /etc/rc.d/init.d/spice-vdagentd,          /etc/rc.d/init.d/shorewall.*,
169       /etc/rc.d/init.d/radvd,                       /etc/rc.d/init.d/blkmapd,
170       /etc/rc.d/init.d/fail2ban,          /etc/rc.d/init.d/(snmpd|snmptrapd),
171       /etc/rc.d/init.d/radiusd,                        /etc/rc.d/init.d/ntpd,
172       /etc/rc.d/init.d/named,                       /etc/rc.d/init.d/unbound,
173       /etc/rc.d/init.d/named-sdb,                     /etc/rc.d/init.d/cgred,
174       /etc/rc.d/init.d/puppet,                      /etc/rc.d/init.d/.*l2tpd,
175       /etc/rc.d/init.d/nasd,                       /etc/rc.d/init.d/libvirtd,
176       /etc/rc.d/init.d/(open)?afs,           /etc/rc.d/init.d/openafs-client,
177       /etc/rc.d/init.d/lirc, /etc/rc.d/init.d/slapd, /etc/rc.d/init.d/mdmoni‐
178       tor,           /etc/rc.d/init.d/pcscd,          /etc/rc.d/init.d/rhnsd,
179       /etc/rc.d/init.d/(se)?postgresql,              /etc/rc.d/init.d/vnstat,
180       /etc/rc.d/init.d/polipo,                   /etc/rc.d/init.d/callweaver,
181       /etc/rc.d/init.d/ddclient,                      /etc/rc.d/init.d/tuned,
182       /etc/rc.d/init.d/amtu,                  /etc/rc.d/init.d/zabbix-agentd,
183       /etc/rc.d/init.d/vhostmd,                      /etc/rc.d/init.d/mcelog,
184       /etc/rc.d/init.d/hddtemp,                      /etc/rc.d/init.d/ypserv,
185       /etc/rc.d/init.d/ypxfrd,                     /etc/rc.d/init.d/yppasswd,
186       /etc/rc.d/init.d/atd,   /etc/rc.d/init.d/exim,   /etc/rc.d/init.d/innd,
187       /etc/rc.d/init.d/sanlock, /etc/rc.d/init.d/((iodined)|(iodine-server)),
188       /etc/rc.d/init.d/sshd,  /etc/rc.d/init.d/icecast, /etc/rc.d/init.d/col‐
189       lectd,         /etc/rc.d/init.d/pmwebd,          /etc/rc.d/init.d/uucp,
190       /etc/rc.d/init.d/MailScanner,              /etc/rc.d/init.d/hypervkvpd,
191       /etc/rc.d/init.d/irqbalance,                  /etc/rc.d/init.d/chronyd,
192       /etc/rc.d/init.d/boinc-client,                 /etc/rc.d/init.d/naemon,
193       /etc/rc.d/init.d/condor,                     /etc/rc.d/init.d/gatherer,
194       /etc/rc.d/init.d/sblim-sfcbd,                    /etc/rc.d/init.d/osad,
195       /etc/rc.d/init.d/dovecot,                       /etc/rc.d/init.d/rwhod,
196       /etc/rc.d/init.d/fcoe,    /etc/rc.d/init.d/nfs,   /etc/rc.d/init.d/gpm,
197       /etc/rc.d/init.d/mpd, /etc/rc.d/init.d/kprop, /etc/rc.d/init.d/kadmind,
198       /etc/rc.d/init.d/krb524d,                     /etc/rc.d/init.d/krb5kdc,
199       /etc/rc.d/init.d/munin-node,   /etc/rc.d/init.d/(smartd|smartmontools),
200       /etc/rc.d/init.d/(tcsd|trousers),               /etc/rc.d/init.d/squid,
201       /etc/rc.d/init.d/pkcsslotd,              /etc/rc.d/init.d/rtkit-daemon,
202       /etc/rc.d/init.d/acpid,                     /etc/rc.d/init.d/fetchmail,
203       /etc/rc.d/init.d/pmmgr,         /etc/NetworkManager/dispatcher.d(/.*)?,
204       /etc/rc.d/init.d/wicd,                       /etc/rc.d/init.d/cmirrord,
205       /etc/rc.d/init.d/openstack-glance-api,           /etc/rc.d/init.d/sssd,
206       /etc/rc.d/init.d/nmb,  /etc/rc.d/init.d/smb,  /etc/rc.d/init.d/winbind,
207       /etc/rc.d/init.d/bacula.*,                      /etc/rc.d/init.d/ulogd,
208       /etc/rc.d/init.d/((ccs)|(ccsd)),                /etc/rc.d/init.d/ricci,
209       /etc/rc.d/init.d/mcstrans,                      /etc/rc.d/init.d/nslcd,
210       /etc/rc.d/init.d/prelude-lml,         /etc/rc.d/init.d/prelude-manager,
211       /etc/rc.d/init.d/prelude-correlator,       /etc/rc.d/init.d/ip6?tables,
212       /etc/rc.d/init.d/ebtables,                   /etc/rc.d/init.d/nftables,
213       /etc/rc.d/init.d/oracleasm,                 /etc/rc.d/init.d/mon_statd,
214       /etc/rc.d/init.d/gdomap,  /etc/rc.d/init.d/bgpd, /etc/rc.d/init.d/ripd,
215       /etc/rc.d/init.d/isisd, /etc/rc.d/init.d/ospfd, /etc/rc.d/init.d/zebra,
216       /etc/rc.d/init.d/babeld, /etc/rc.d/init.d/ospf6d, /etc/rc.d/init.d/rip‐
217       ngd,      /etc/rc.d/init.d/redis,      /etc/firestarter/firestarter.sh,
218       /etc/rc.d/init.d/mongod,   /etc/rc.d/init.d/mongos,  /opt/.*,  /usr/.*,
219       /emul/.*,   /export(/.*)?,   /ostree(/.*)?,   /usr/doc(/.*)?/lib(/.*)?,
220       /usr/inclu.e(/.*)?,                               /usr/share/rpm(/.*)?,
221       /usr/share/doc(/.*)?/README.*,           /usr/lib/modules(/.*)/vmlinuz,
222       /usr/lib/modules(/.*)/initramfs.img,           /usr/lib/sysimage(/.*)?,
223       /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul, /etc/rc.d/init.d/vsftpd,
224       /etc/rc.d/init.d/proftpd,                       /etc/rc.d/init.d/isnsd,
225       /etc/rc.d/init.d/privoxy,                   /etc/rc.d/init.d/firewalld,
226       /etc/rc.d/init.d/mrtg,                     /etc/rc.d/init.d/certmonger,
227       /etc/rc.d/init.d/jabberd,   /etc/rc.d/init.d/openstack-glance-registry,
228       /etc/rc.d/init.d/avahi.*,  /etc/rc.d/init.d/memcached,  /etc/init.d/.*,
229       /etc/rc.d/rc.[^/]+,  /etc/rc.d/init.d/.*,   /opt/nfast/sbin/init.d-nci‐
230       pher,        /usr/libexec/dcc/stop-.*,       /usr/libexec/dcc/start-.*,
231       /usr/lib/systemd/fedora[^/]*,           /opt/nfast/scripts/init.d/(.*),
232       /etc/rc.d/rc,   /etc/X11/prefdm,  /usr/sbin/startx,  /usr/bin/sepg_ctl,
233       /usr/sbin/start-dirsrv,   /usr/sbin/open_init_pty,   /usr/sbin/restart-
234       dirsrv,  /etc/sysconfig/network-scripts/ifup-ipsec,  /usr/share/system-
235       config-services/system-config-services-mechanism.py,
236       /etc/rc.d/init.d/nrpe, /etc/rc.d/init.d/nagios
237

PROCESS TYPES

239       SELinux defines process types (domains) for each process running on the
240       system
241
242       You can see the context of a process using the -Z option to ps
243
244       Policy governs the access confined processes have  to  files.   SELinux
245       initrc  policy  is  very  flexible allowing users to setup their initrc
246       processes in as secure a method as possible.
247
248       The following process types are defined for initrc:
249
250       initrc_t
251
252       Note: semanage permissive -a initrc_t can be used to make  the  process
253       type  initrc_t  permissive.  SELinux does not deny access to permissive
254       process types, but the AVC (SELinux denials) messages are still  gener‐
255       ated.
256
257

BOOLEANS

259       SELinux  policy is customizable based on least access required.  initrc
260       policy is extremely flexible and has several booleans that allow you to
261       manipulate the policy and run initrc with the tightest access possible.
262
263
264
265       If you want to allow users to resolve user passwd entries directly from
266       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
267       gin_nsswitch_use_ldap boolean. Disabled by default.
268
269       setsebool -P authlogin_nsswitch_use_ldap 1
270
271
272
273       If you want to deny user domains applications to map a memory region as
274       both executable and writable, this  is  dangerous  and  the  executable
275       should be reported in bugzilla, you must turn on the deny_execmem bool‐
276       ean. Enabled by default.
277
278       setsebool -P deny_execmem 1
279
280
281
282       If you want to allow all domains to execute in fips_mode, you must turn
283       on the fips_mode boolean. Enabled by default.
284
285       setsebool -P fips_mode 1
286
287
288
289       If  you  want  to allow confined applications to run with kerberos, you
290       must turn on the kerberos_enabled boolean. Enabled by default.
291
292       setsebool -P kerberos_enabled 1
293
294
295
296       If you want to control the ability to mmap a low area  of  the  address
297       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
298       the mmap_low_allowed boolean. Disabled by default.
299
300       setsebool -P mmap_low_allowed 1
301
302
303
304       If you want to allow system to run with  NIS,  you  must  turn  on  the
305       nis_enabled boolean. Disabled by default.
306
307       setsebool -P nis_enabled 1
308
309
310
311       If  you  want to allow confined applications to use nscd shared memory,
312       you must turn on the nscd_use_shm boolean. Disabled by default.
313
314       setsebool -P nscd_use_shm 1
315
316
317
318       If you want to disable kernel module loading,  you  must  turn  on  the
319       secure_mode_insmod boolean. Enabled by default.
320
321       setsebool -P secure_mode_insmod 1
322
323
324
325       If  you  want to allow unconfined executables to make their heap memory
326       executable.  Doing this is a really  bad  idea.  Probably  indicates  a
327       badly  coded  executable, but could indicate an attack. This executable
328       should  be  reported  in  bugzilla,  you  must  turn  on   the   selin‐
329       uxuser_execheap boolean. Disabled by default.
330
331       setsebool -P selinuxuser_execheap 1
332
333
334
335       If  you  want  to allow unconfined executables to make their stack exe‐
336       cutable.  This should never, ever be necessary.  Probably  indicates  a
337       badly  coded  executable, but could indicate an attack. This executable
338       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
339       stack boolean. Enabled by default.
340
341       setsebool -P selinuxuser_execstack 1
342
343
344

MANAGED FILES

346       The  SELinux  process  type  initrc_t can manage files labeled with the
347       following file types.  The paths listed are the default paths for these
348       file types.  Note the processes UID still need to have DAC permissions.
349
350       file_type
351
352            all files on the system
353
354

FILE CONTEXTS

356       SELinux requires files to have an extended attribute to define the file
357       type.
358
359       You can see the context of a file using the -Z option to ls
360
361       Policy governs the access  confined  processes  have  to  these  files.
362       SELinux  initrc  policy  is very flexible allowing users to setup their
363       initrc processes in as secure a method as possible.
364
365       STANDARD FILE CONTEXT
366
367       SELinux defines the file context types for the initrc, if you wanted to
368       store  files  with  these types in a diffent paths, you need to execute
369       the semanage command  to  sepecify  alternate  labeling  and  then  use
370       restorecon to put the labels on disk.
371
372       semanage fcontext -a -t initrc_var_run_t '/srv/myinitrc_content(/.*)?'
373       restorecon -R -v /srv/myinitrc_content
374
375       Note:  SELinux  often  uses  regular expressions to specify labels that
376       match multiple files.
377
378       The following file types are defined for initrc:
379
380
381
382       initrc_devpts_t
383
384       - Set files with the initrc_devpts_t type, if you  want  to  treat  the
385       files as initrc devpts data.
386
387
388
389       initrc_exec_t
390
391       -  Set  files with the initrc_exec_t type, if you want to transition an
392       executable to the initrc_t domain.
393
394
395       Paths:
396            /etc/init.d/.*,      /etc/rc.d/rc.[^/]+,      /etc/rc.d/init.d/.*,
397            /opt/nfast/sbin/init.d-ncipher,          /usr/libexec/dcc/stop-.*,
398            /usr/libexec/dcc/start-.*,           /usr/lib/systemd/fedora[^/]*,
399            /opt/nfast/scripts/init.d/(.*),   /etc/rc.d/rc,   /etc/X11/prefdm,
400            /usr/sbin/startx,    /usr/bin/sepg_ctl,    /usr/sbin/start-dirsrv,
401            /usr/sbin/open_init_pty,   /usr/sbin/restart-dirsrv,  /etc/syscon‐
402            fig/network-scripts/ifup-ipsec,      /usr/share/system-config-ser‐
403            vices/system-config-services-mechanism.py
404
405
406       initrc_state_t
407
408       -  Set  files  with  the  initrc_state_t type, if you want to treat the
409       files as initrc state data.
410
411
412
413       initrc_tmp_t
414
415       - Set files with the initrc_tmp_t type, if you  want  to  store  initrc
416       temporary files in the /tmp directories.
417
418
419
420       initrc_var_log_t
421
422       -  Set  files  with the initrc_var_log_t type, if you want to treat the
423       data as initrc var log data, usually stored under the  /var/log  direc‐
424       tory.
425
426
427
428       initrc_var_run_t
429
430       -  Set  files  with the initrc_var_run_t type, if you want to store the
431       initrc files under the /run or /var/run directory.
432
433
434       Paths:
435            /var/run/utmp,    /var/run/random-seed,     /var/run/runlevel.dir,
436            /var/run/setmixer_flag
437
438
439       Note:  File context can be temporarily modified with the chcon command.
440       If you want to permanently change the file context you need to use  the
441       semanage fcontext command.  This will modify the SELinux labeling data‐
442       base.  You will need to use restorecon to apply the labels.
443
444

COMMANDS

446       semanage fcontext can also be used to manipulate default  file  context
447       mappings.
448
449       semanage  permissive  can  also  be used to manipulate whether or not a
450       process type is permissive.
451
452       semanage module can also be used to enable/disable/install/remove  pol‐
453       icy modules.
454
455       semanage boolean can also be used to manipulate the booleans
456
457
458       system-config-selinux is a GUI tool available to customize SELinux pol‐
459       icy settings.
460
461

AUTHOR

463       This manual page was auto-generated using sepolicy manpage .
464
465

SEE ALSO

467       selinux(8), initrc(8),  semanage(8),  restorecon(8),  chcon(1),  sepol‐
468       icy(8), setsebool(8)
469
470
471
472initrc                             19-06-18                  initrc_selinux(8)
Impressum