abrt_selinux(8)

1abrt_selinux(8)               SELinux Policy abrt              abrt_selinux(8)
2
3
4

NAME

6       abrt_selinux - Security Enhanced Linux Policy for the abrt processes
7

DESCRIPTION

9       Security-Enhanced  Linux secures the abrt processes via flexible manda‐
10       tory access control.
11
12       The abrt processes execute with the abrt_t SELinux type. You can  check
13       if  you  have  these processes running by executing the ps command with
14       the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep abrt_t
19
20
21

ENTRYPOINTS

23       The abrt_t SELinux type can be entered via the abrt_exec_t file type.
24
25       The default entrypoint paths for the abrt_t domain are the following:
26
27       /usr/sbin/abrt-harvest.*,     /usr/sbin/abrtd,     /usr/sbin/abrt-dbus,
28       /usr/sbin/abrt-install-ccpp-hook
29

PROCESS TYPES

31       SELinux defines process types (domains) for each process running on the
32       system
33
34       You can see the context of a process using the -Z option to ps
35
36       Policy governs the access confined processes have  to  files.   SELinux
37       abrt  policy  is  very flexible allowing users to setup their abrt pro‐
38       cesses in as secure a method as possible.
39
40       The following process types are defined for abrt:
41
42       abrt_t, abrt_dump_oops_t, abrt_handle_event_t, abrt_helper_t, abrt_retrace_worker_t, abrt_retrace_coredump_t, abrt_watch_log_t, abrt_upload_watch_t
43
44       Note: semanage permissive -a abrt_t can be used  to  make  the  process
45       type  abrt_t  permissive.  SELinux  does  not deny access to permissive
46       process types, but the AVC (SELinux denials) messages are still  gener‐
47       ated.
48
49

BOOLEANS

51       SELinux  policy  is  customizable based on least access required.  abrt
52       policy is extremely flexible and has several booleans that allow you to
53       manipulate the policy and run abrt with the tightest access possible.
54
55
56
57       If  you  want  to  determine  whether  ABRT  can  run  in the abrt_han‐
58       dle_event_t domain to handle ABRT event scripts, you must turn  on  the
59       abrt_handle_event boolean. Disabled by default.
60
61       setsebool -P abrt_handle_event 1
62
63
64
65       If you want to allow users to resolve user passwd entries directly from
66       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
67       gin_nsswitch_use_ldap boolean. Disabled by default.
68
69       setsebool -P authlogin_nsswitch_use_ldap 1
70
71
72
73       If you want to deny user domains applications to map a memory region as
74       both executable and writable, this  is  dangerous  and  the  executable
75       should be reported in bugzilla, you must turn on the deny_execmem bool‐
76       ean. Enabled by default.
77
78       setsebool -P deny_execmem 1
79
80
81
82       If you want to allow all domains to execute in fips_mode, you must turn
83       on the fips_mode boolean. Enabled by default.
84
85       setsebool -P fips_mode 1
86
87
88
89       If  you  want  to allow confined applications to run with kerberos, you
90       must turn on the kerberos_enabled boolean. Disabled by default.
91
92       setsebool -P kerberos_enabled 1
93
94
95
96       If you want to allow system to run with  NIS,  you  must  turn  on  the
97       nis_enabled boolean. Disabled by default.
98
99       setsebool -P nis_enabled 1
100
101
102
103       If  you  want to allow confined applications to use nscd shared memory,
104       you must turn on the nscd_use_shm boolean. Disabled by default.
105
106       setsebool -P nscd_use_shm 1
107
108
109

MANAGED FILES

111       The SELinux process type abrt_t can manage files labeled with the  fol‐
112       lowing  file  types.   The paths listed are the default paths for these
113       file types.  Note the processes UID still need to have DAC permissions.
114
115       abrt_etc_t
116
117            /etc/abrt(/.*)?
118
119       abrt_tmp_t
120
121
122       abrt_upload_watch_tmp_t
123
124
125       abrt_var_cache_t
126
127            /var/tmp/abrt(/.*)?
128            /var/cache/abrt(/.*)?
129            /var/spool/abrt(/.*)?
130            /var/spool/debug(/.*)?
131            /var/cache/abrt-di(/.*)?
132            /var/spool/rhsm/debug(/.*)?
133
134       abrt_var_log_t
135
136            /var/log/abrt-logger.*
137
138       abrt_var_run_t
139
140            /var/run/abrt(/.*)?
141            /var/run/abrtd?.lock
142            /var/run/abrtd?.socket
143            /var/run/abrt.pid
144
145       cluster_conf_t
146
147            /etc/cluster(/.*)?
148
149       cluster_var_lib_t
150
151            /var/lib/pcsd(/.*)?
152            /var/lib/cluster(/.*)?
153            /var/lib/openais(/.*)?
154            /var/lib/pengine(/.*)?
155            /var/lib/corosync(/.*)?
156            /usr/lib/heartbeat(/.*)?
157            /var/lib/heartbeat(/.*)?
158            /var/lib/pacemaker(/.*)?
159
160       cluster_var_run_t
161
162            /var/run/crm(/.*)?
163            /var/run/cman_.*
164            /var/run/rsctmp(/.*)?
165            /var/run/aisexec.*
166            /var/run/heartbeat(/.*)?
167            /var/run/corosync-qnetd(/.*)?
168            /var/run/corosync-qdevice(/.*)?
169            /var/run/corosync.pid
170            /var/run/cpglockd.pid
171            /var/run/rgmanager.pid
172            /var/run/cluster/rgmanager.sk
173
174       kdump_crash_t
175
176            /var/crash(/.*)?
177
178       mail_home_rw_t
179
180            /root/Maildir(/.*)?
181            /root/.esmtp_queue(/.*)?
182            /var/lib/arpwatch/.esmtp_queue(/.*)?
183            /home/[^/]+/.maildir(/.*)?
184            /home/[^/]+/Maildir(/.*)?
185            /home/[^/]+/.esmtp_queue(/.*)?
186
187       mock_var_lib_t
188
189            /var/lib/mock(/.*)?
190
191       public_content_rw_t
192
193            /var/spool/abrt-upload(/.*)?
194
195       rhsmcertd_var_run_t
196
197            /var/run/rhsm(/.*)?
198
199       root_t
200
201            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
202            /
203            /initrd
204
205       rpm_log_t
206
207            /var/log/hawkey.*
208            /var/log/up2date.*
209            /var/log/yum.log.*
210
211       rpm_var_cache_t
212
213            /var/cache/dnf(/.*)?
214            /var/cache/yum(/.*)?
215            /var/spool/up2date(/.*)?
216            /var/cache/PackageKit(/.*)?
217
218       rpm_var_run_t
219
220            /var/run/yum.*
221            /var/run/PackageKit(/.*)?
222
223       sysfs_t
224
225            /sys(/.*)?
226
227       usr_t
228
229            /opt/.*
230            /usr/.*
231            /emul/.*
232            /export(/.*)?
233            /ostree(/.*)?
234            /usr/doc(/.*)?/lib(/.*)?
235            /usr/inclu.e(/.*)?
236            /usr/share/rpm(/.*)?
237            /usr/share/doc(/.*)?/README.*
238            /usr/lib/modules(/.*)/vmlinuz
239            /usr/lib/modules(/.*)/initramfs.img
240            /usr/lib/sysimage(/.*)?
241            /usr/lib/ostree-boot(/.*)?
242            /opt
243            /usr
244            /emul
245
246

FILE CONTEXTS

248       SELinux requires files to have an extended attribute to define the file
249       type.
250
251       You can see the context of a file using the -Z option to ls
252
253       Policy  governs  the  access  confined  processes  have to these files.
254       SELinux abrt policy is very flexible allowing users to setup their abrt
255       processes in as secure a method as possible.
256
257       EQUIVALENCE DIRECTORIES
258
259
260       abrt  policy  stores  data  with  multiple different file context types
261       under the /var/cache/abrt directory.  If you would like  to  store  the
262       data  in a different directory you can use the semanage command to cre‐
263       ate an equivalence mapping.  If you wanted to store this data under the
264       /srv dirctory you would execute the following command:
265
266       semanage fcontext -a -e /var/cache/abrt /srv/abrt
267       restorecon -R -v /srv/abrt
268
269       abrt  policy  stores  data  with  multiple different file context types
270       under the /var/run/abrt directory.  If you would like to store the data
271       in  a different directory you can use the semanage command to create an
272       equivalence mapping.  If you wanted to store this data under  the  /srv
273       dirctory you would execute the following command:
274
275       semanage fcontext -a -e /var/run/abrt /srv/abrt
276       restorecon -R -v /srv/abrt
277
278       abrt  policy  stores  data  with  multiple different file context types
279       under the /var/spool/abrt directory.  If you would like  to  store  the
280       data  in a different directory you can use the semanage command to cre‐
281       ate an equivalence mapping.  If you wanted to store this data under the
282       /srv dirctory you would execute the following command:
283
284       semanage fcontext -a -e /var/spool/abrt /srv/abrt
285       restorecon -R -v /srv/abrt
286
287       STANDARD FILE CONTEXT
288
289       SELinux  defines  the file context types for the abrt, if you wanted to
290       store files with these types in a diffent paths, you  need  to  execute
291       the  semanage  command  to  sepecify  alternate  labeling  and then use
292       restorecon to put the labels on disk.
293
294       semanage  fcontext  -a  -t  abrt_upload_watch_tmp_t   '/srv/myabrt_con‐
295       tent(/.*)?'
296       restorecon -R -v /srv/myabrt_content
297
298       Note:  SELinux  often  uses  regular expressions to specify labels that
299       match multiple files.
300
301       The following file types are defined for abrt:
302
303
304
305       abrt_dump_oops_exec_t
306
307       - Set files with the abrt_dump_oops_exec_t type, if you want to transi‐
308       tion an executable to the abrt_dump_oops_t domain.
309
310
311       Paths:
312            /usr/bin/abrt-dump-.*,                /usr/bin/abrt-uefioops-oops,
313            /usr/libexec/abrt-hook-ccpp
314
315
316       abrt_etc_t
317
318       - Set files with the abrt_etc_t type, if you want to store  abrt  files
319       in the /etc directories.
320
321
322
323       abrt_exec_t
324
325       -  Set  files  with  the abrt_exec_t type, if you want to transition an
326       executable to the abrt_t domain.
327
328
329       Paths:
330            /usr/sbin/abrt-harvest.*,  /usr/sbin/abrtd,   /usr/sbin/abrt-dbus,
331            /usr/sbin/abrt-install-ccpp-hook
332
333
334       abrt_handle_event_exec_t
335
336       -  Set  files  with  the  abrt_handle_event_exec_t type, if you want to
337       transition an executable to the abrt_handle_event_t domain.
338
339
340
341       abrt_helper_exec_t
342
343       - Set files with the abrt_helper_exec_t type, if you want to transition
344       an executable to the abrt_helper_t domain.
345
346
347
348       abrt_initrc_exec_t
349
350       - Set files with the abrt_initrc_exec_t type, if you want to transition
351       an executable to the abrt_initrc_t domain.
352
353
354
355       abrt_retrace_cache_t
356
357       - Set files with the abrt_retrace_cache_t type, if you  want  to  store
358       the files under the /var/cache directory.
359
360
361       Paths:
362            /var/cache/abrt-retrace(/.*)?, /var/cache/retrace-server(/.*)?
363
364
365       abrt_retrace_coredump_exec_t
366
367       -  Set files with the abrt_retrace_coredump_exec_t type, if you want to
368       transition an executable to the abrt_retrace_coredump_t domain.
369
370
371
372       abrt_retrace_spool_t
373
374       - Set files with the abrt_retrace_spool_t type, if you  want  to  store
375       the abrt retrace files under the /var/spool directory.
376
377
378       Paths:
379            /var/spool/faf(/.*)?,               /var/spool/abrt-retrace(/.*)?,
380            /var/spool/retrace-server(/.*)?
381
382
383       abrt_retrace_worker_exec_t
384
385       - Set files with the abrt_retrace_worker_exec_t type, if  you  want  to
386       transition an executable to the abrt_retrace_worker_t domain.
387
388
389       Paths:
390            /usr/bin/abrt-retrace-worker, /usr/bin/retrace-server-worker
391
392
393       abrt_tmp_t
394
395       -  Set files with the abrt_tmp_t type, if you want to store abrt tempo‐
396       rary files in the /tmp directories.
397
398
399
400       abrt_unit_file_t
401
402       - Set files with the abrt_unit_file_t type, if you want  to  treat  the
403       files as abrt unit content.
404
405
406
407       abrt_upload_watch_exec_t
408
409       -  Set  files  with  the  abrt_upload_watch_exec_t type, if you want to
410       transition an executable to the abrt_upload_watch_t domain.
411
412
413
414       abrt_upload_watch_tmp_t
415
416       - Set files with the abrt_upload_watch_tmp_t type, if you want to store
417       abrt upload watch temporary files in the /tmp directories.
418
419
420
421       abrt_var_cache_t
422
423       -  Set  files  with the abrt_var_cache_t type, if you want to store the
424       files under the /var/cache directory.
425
426
427       Paths:
428            /var/tmp/abrt(/.*)?, /var/cache/abrt(/.*)?, /var/spool/abrt(/.*)?,
429            /var/spool/debug(/.*)?,                  /var/cache/abrt-di(/.*)?,
430            /var/spool/rhsm/debug(/.*)?
431
432
433       abrt_var_lib_t
434
435       - Set files with the abrt_var_lib_t type, if you want to store the abrt
436       files under the /var/lib directory.
437
438
439
440       abrt_var_log_t
441
442       - Set files with the abrt_var_log_t type, if you want to treat the data
443       as abrt var log data, usually stored under the /var/log directory.
444
445
446
447       abrt_var_run_t
448
449       - Set files with the abrt_var_run_t type, if you want to store the abrt
450       files under the /run or /var/run directory.
451
452
453       Paths:
454            /var/run/abrt(/.*)?, /var/run/abrtd?.lock, /var/run/abrtd?.socket,
455            /var/run/abrt.pid
456
457
458       abrt_watch_log_exec_t
459
460       - Set files with the abrt_watch_log_exec_t type, if you want to transi‐
461       tion an executable to the abrt_watch_log_t domain.
462
463
464
465       Note:  File context can be temporarily modified with the chcon command.
466       If you want to permanently change the file context you need to use  the
467       semanage fcontext command.  This will modify the SELinux labeling data‐
468       base.  You will need to use restorecon to apply the labels.
469
470

SHARING FILES

472       If you want to share files with multiple domains (Apache,  FTP,  rsync,
473       Samba),  you can set a file context of public_content_t and public_con‐
474       tent_rw_t.  These context allow any of the above domains  to  read  the
475       content.   If  you want a particular domain to write to the public_con‐
476       tent_rw_t domain, you must set the appropriate boolean.
477
478       Allow abrt servers to read the /var/abrt directory by adding  the  pub‐
479       lic_content_t  file  type  to  the  directory and by restoring the file
480       type.
481
482       semanage fcontext -a -t public_content_t "/var/abrt(/.*)?"
483       restorecon -F -R -v /var/abrt
484
485       Allow abrt servers to read and write /var/abrt/incoming by  adding  the
486       public_content_rw_t  type  to  the  directory and by restoring the file
487       type.  You also need to turn on the abrt_anon_write boolean.
488
489       semanage fcontext -a -t public_content_rw_t "/var/abrt/incoming(/.*)?"
490       restorecon -F -R -v /var/abrt/incoming
491       setsebool -P abrt_anon_write 1
492
493
494       If you want to allow ABRT to modify public files used for  public  file
495       transfer services., you must turn on the abrt_anon_write boolean.
496
497       setsebool -P abrt_anon_write 1
498
499

COMMANDS

501       semanage  fcontext  can also be used to manipulate default file context
502       mappings.
503
504       semanage permissive can also be used to manipulate  whether  or  not  a
505       process type is permissive.
506
507       semanage  module can also be used to enable/disable/install/remove pol‐
508       icy modules.
509
510       semanage boolean can also be used to manipulate the booleans
511
512
513       system-config-selinux is a GUI tool available to customize SELinux pol‐
514       icy settings.
515
516

AUTHOR

518       This manual page was auto-generated using sepolicy manpage .
519
520