staff_selinux(8)

1staff_selinux(8)      staff SELinux Policy documentation      staff_selinux(8)
2
3
4

NAME

6       staff_u  -  Administrator's unprivileged user - Security Enhanced Linux
7       Policy
8
9

DESCRIPTION

11       staff_u is an SELinux User defined in the SELinux policy. SELinux users
12       have  default  roles,  staff_r.   The  default role has a default type,
13       staff_t, associated with it.
14
15       The SELinux user will usually login to a system  with  a  context  that
16       looks like:
17
18       staff_u:staff_r:staff_t:s0 - s0:c0.c1023
19
20       Linux  users  are  automatically  assigned  an  SELinux users at login.
21       Login programs use the SELinux User to assign initial  context  to  the
22       user's shell.
23
24       SELinux policy uses the context to control the user's access.
25
26       By  default  all  users  are  assigned  to  the  SELinux  user  via the
27       __default__ flag
28
29       On Targeted policy systems the __default__  user  is  assigned  to  the
30       unconfined_u SELinux user.
31
32       You can list all Linux User to SELinux user mapping using:
33
34       semanage login -l
35
36       If  you  wanted  to  change the default user mapping to use the staff_u
37       user, you would execute:
38
39       semanage login -m -s staff_u __default__
40
41
42       If you want to map the one Linux user (joe) to the SELinux user  staff,
43       you would execute:
44
45       $ semanage login -a -s staff_u joe
46
47
48

USER DESCRIPTION

50       The  SELinux  user staff_u is defined in policy as a unprivileged user.
51       SELinux prevents unprivileged users  from  doing  administration  tasks
52       without transitioning to a different role.
53
54

SUDO

56       The SELinux user staff can execute sudo.
57
58       You  can  set up sudo to allow staff to transition to an administrative
59       domain:
60
61       Add one or more of the following record to sudoers using visudo.
62
63
64       USERNAME ALL=(ALL) ROLE=webadm_r TYPE=webadm_t COMMAND
65       sudo will run COMMAND as staff_u:webadm_r:webadm_t:LEVEL
66
67       You might also need to add one or more  of  these  new  roles  to  your
68       SELinux user record.
69
70       List the SELinux roles your SELinux user can reach by executing:
71
72       $ semanage user -l |grep selinux_name
73
74       Modify the roles list and add staff_r to this list.
75
76       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
77       logadm_r dbadm_r auditadm_r' staff_u
78
79       For more details you can see semanage man page.
80
81
82       USERNAME ALL=(ALL) ROLE=unconfined_r TYPE=unconfined_t COMMAND
83       sudo will run COMMAND as staff_u:unconfined_r:unconfined_t:LEVEL
84
85       You might also need to add one or more  of  these  new  roles  to  your
86       SELinux user record.
87
88       List the SELinux roles your SELinux user can reach by executing:
89
90       $ semanage user -l |grep selinux_name
91
92       Modify the roles list and add staff_r to this list.
93
94       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
95       logadm_r dbadm_r auditadm_r' staff_u
96
97       For more details you can see semanage man page.
98
99
100       USERNAME ALL=(ALL) ROLE=sysadm_r TYPE=sysadm_t COMMAND
101       sudo will run COMMAND as staff_u:sysadm_r:sysadm_t:LEVEL
102
103       You might also need to add one or more  of  these  new  roles  to  your
104       SELinux user record.
105
106       List the SELinux roles your SELinux user can reach by executing:
107
108       $ semanage user -l |grep selinux_name
109
110       Modify the roles list and add staff_r to this list.
111
112       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
113       logadm_r dbadm_r auditadm_r' staff_u
114
115       For more details you can see semanage man page.
116
117
118       USERNAME ALL=(ALL) ROLE=secadm_r TYPE=secadm_t COMMAND
119       sudo will run COMMAND as staff_u:secadm_r:secadm_t:LEVEL
120
121       You might also need to add one or more  of  these  new  roles  to  your
122       SELinux user record.
123
124       List the SELinux roles your SELinux user can reach by executing:
125
126       $ semanage user -l |grep selinux_name
127
128       Modify the roles list and add staff_r to this list.
129
130       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
131       logadm_r dbadm_r auditadm_r' staff_u
132
133       For more details you can see semanage man page.
134
135
136       USERNAME ALL=(ALL) ROLE=logadm_r TYPE=logadm_t COMMAND
137       sudo will run COMMAND as staff_u:logadm_r:logadm_t:LEVEL
138
139       You might also need to add one or more  of  these  new  roles  to  your
140       SELinux user record.
141
142       List the SELinux roles your SELinux user can reach by executing:
143
144       $ semanage user -l |grep selinux_name
145
146       Modify the roles list and add staff_r to this list.
147
148       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
149       logadm_r dbadm_r auditadm_r' staff_u
150
151       For more details you can see semanage man page.
152
153
154       USERNAME ALL=(ALL) ROLE=dbadm_r TYPE=dbadm_t COMMAND
155       sudo will run COMMAND as staff_u:dbadm_r:dbadm_t:LEVEL
156
157       You might also need to add one or more  of  these  new  roles  to  your
158       SELinux user record.
159
160       List the SELinux roles your SELinux user can reach by executing:
161
162       $ semanage user -l |grep selinux_name
163
164       Modify the roles list and add staff_r to this list.
165
166       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
167       logadm_r dbadm_r auditadm_r' staff_u
168
169       For more details you can see semanage man page.
170
171
172       USERNAME ALL=(ALL) ROLE=auditadm_r TYPE=auditadm_t COMMAND
173       sudo will run COMMAND as staff_u:auditadm_r:auditadm_t:LEVEL
174
175       You might also need to add one or more  of  these  new  roles  to  your
176       SELinux user record.
177
178       List the SELinux roles your SELinux user can reach by executing:
179
180       $ semanage user -l |grep selinux_name
181
182       Modify the roles list and add staff_r to this list.
183
184       $  semanage user -m -R 'staff_r webadm_r unconfined_r sysadm_r secadm_r
185       logadm_r dbadm_r auditadm_r' staff_u
186
187       For more details you can see semanage man page.
188
189
190       The SELinux type staff_t is not allowed to execute sudo.
191
192

X WINDOWS LOGIN

194       The SELinux user staff_u is able to X Windows login.
195
196

NETWORK

198       The SELinux user staff_u is able to listen on the following tcp ports.
199
200              6000-6020
201
202              3689
203
204              all ports > 1024
205
206              32768-60999
207
208              all ports with out defined types
209
210
211       The SELinux user staff_u is able to connect to the following tcp ports.
212
213              8955
214
215              all ports
216
217              53,853
218
219              5432,9898
220
221              389,636,3268,3269,7389
222
223              111
224
225              all ports < 1024
226
227              32768-60999
228
229              all ports with out defined types
230
231              88,750,4444
232
233              9080
234
235
236       The SELinux user staff_u is able to listen on the following udp ports.
237
238              all ports with out defined types
239
240              32768-60999
241
242              all ports > 1024
243
244
245       The SELinux user staff_u is able to connect to the following tcp ports.
246
247              8955
248
249              all ports
250
251              53,853
252
253              5432,9898
254
255              389,636,3268,3269,7389
256
257              111
258
259              all ports < 1024
260
261              32768-60999
262
263              all ports with out defined types
264
265              88,750,4444
266
267              9080
268
269

BOOLEANS

271       SELinux policy is customizable based on least access  required.   staff
272       policy is extremely flexible and has several booleans that allow you to
273       manipulate the policy and run staff with the tightest access possible.
274
275
276
277       If you want to allow staff user  to  create  and  transition  to  svirt
278       domains,  you  must  turn  on  the staff_use_svirt boolean. Disabled by
279       default.
280
281       setsebool -P staff_use_svirt 1
282
283
284
285       If you want to allow users to resolve user passwd entries directly from
286       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
287       gin_nsswitch_use_ldap boolean. Disabled by default.
288
289       setsebool -P authlogin_nsswitch_use_ldap 1
290
291
292
293       If you want to determine whether crond can execute  jobs  in  the  user
294       domain  as  opposed to the the generic cronjob domain, you must turn on
295       the cron_userdomain_transition boolean. Enabled by default.
296
297       setsebool -P cron_userdomain_transition 1
298
299
300
301       If you want to deny all system processes and Linux users to  use  blue‐
302       tooth wireless technology, you must turn on the deny_bluetooth boolean.
303       Enabled by default.
304
305       setsebool -P deny_bluetooth 1
306
307
308
309       If you want to deny user domains applications to map a memory region as
310       both  executable  and  writable,  this  is dangerous and the executable
311       should be reported in bugzilla, you must turn on the deny_execmem bool‐
312       ean. Enabled by default.
313
314       setsebool -P deny_execmem 1
315
316
317
318       If  you  want  to deny any process from ptracing or debugging any other
319       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
320       default.
321
322       setsebool -P deny_ptrace 1
323
324
325
326       If you want to allow all domains to execute in fips_mode, you must turn
327       on the fips_mode boolean. Enabled by default.
328
329       setsebool -P fips_mode 1
330
331
332
333       If you want to determine whether calling user domains can  execute  Git
334       daemon  in  the  git_session_t  domain,  you  must turn on the git_ses‐
335       sion_users boolean. Disabled by default.
336
337       setsebool -P git_session_users 1
338
339
340
341       If you  want  to  allow  httpd  cgi  support,  you  must  turn  on  the
342       httpd_enable_cgi boolean. Enabled by default.
343
344       setsebool -P httpd_enable_cgi 1
345
346
347
348       If  you  want  to allow confined applications to run with kerberos, you
349       must turn on the kerberos_enabled boolean. Disabled by default.
350
351       setsebool -P kerberos_enabled 1
352
353
354
355       If you want to allow system to run with  NIS,  you  must  turn  on  the
356       nis_enabled boolean. Disabled by default.
357
358       setsebool -P nis_enabled 1
359
360
361
362       If  you  want to allow confined applications to use nscd shared memory,
363       you must turn on the nscd_use_shm boolean. Disabled by default.
364
365       setsebool -P nscd_use_shm 1
366
367
368
369       If you want to determine  whether  calling  user  domains  can  execute
370       Polipo  daemon  in  the  polipo_session_t  domain, you must turn on the
371       polipo_session_users boolean. Disabled by default.
372
373       setsebool -P polipo_session_users 1
374
375
376
377       If you want to allow pppd to be run for a regular user, you  must  turn
378       on the pppd_for_user boolean. Disabled by default.
379
380       setsebool -P pppd_for_user 1
381
382
383
384       If  you  want  to  allow  all  unconfined  executables to use libraries
385       requiring text relocation that are  not  labeled  textrel_shlib_t,  you
386       must turn on the selinuxuser_execmod boolean. Disabled by default.
387
388       setsebool -P selinuxuser_execmod 1
389
390
391
392       If  you  want  to allow unconfined executables to make their stack exe‐
393       cutable.  This should never, ever be necessary.  Probably  indicates  a
394       badly  coded  executable, but could indicate an attack. This executable
395       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
396       stack boolean. Disabled by default.
397
398       setsebool -P selinuxuser_execstack 1
399
400
401
402       If  you  want  to allow users to connect to the local mysql server, you
403       must turn on the selinuxuser_mysql_connect_enabled boolean. Disabled by
404       default.
405
406       setsebool -P selinuxuser_mysql_connect_enabled 1
407
408
409
410       If  you  want to allow users to connect to PostgreSQL, you must turn on
411       the   selinuxuser_postgresql_connect_enabled   boolean.   Disabled   by
412       default.
413
414       setsebool -P selinuxuser_postgresql_connect_enabled 1
415
416
417
418       If  you want to allow user to r/w files on filesystems that do not have
419       extended attributes (FAT, CDROM, FLOPPY), you must turn on  the  selin‐
420       uxuser_rw_noexattrfile boolean. Disabled by default.
421
422       setsebool -P selinuxuser_rw_noexattrfile 1
423
424
425
426       If you want to allow user  to use ssh chroot environment, you must turn
427       on the selinuxuser_use_ssh_chroot boolean. Disabled by default.
428
429       setsebool -P selinuxuser_use_ssh_chroot 1
430
431
432
433       If you want to support NFS home  directories,  you  must  turn  on  the
434       use_nfs_home_dirs boolean. Enabled by default.
435
436       setsebool -P use_nfs_home_dirs 1
437
438
439
440       If  you  want  to  support SAMBA home directories, you must turn on the
441       use_samba_home_dirs boolean. Disabled by default.
442
443       setsebool -P use_samba_home_dirs 1
444
445
446

HOME_EXEC

448       The SELinux user staff_u is able execute home content files.
449
450

TRANSITIONS

452       Three things can happen when staff_t attempts to execute a program.
453
454       1. SELinux Policy can deny staff_t from executing the program.
455
456
457
458       2. SELinux Policy can allow staff_t to execute the program in the  cur‐
459       rent user type.
460
461              Execute  the  following  to  see the types that the SELinux user
462              staff_t can execute without transitioning:
463
464              sesearch -A -s staff_t -c file -p execute_no_trans
465
466
467
468       3. SELinux can allow staff_t to execute the program and transition to a
469       new type.
470
471              Execute  the  following  to  see the types that the SELinux user
472              staff_t can execute and transition:
473
474              $ sesearch -A -s staff_t -c process -p transition
475
476
477

MANAGED FILES

479       The SELinux process type staff_t can manage files labeled with the fol‐
480       lowing  file  types.   The paths listed are the default paths for these
481       file types.  Note the processes UID still need to have DAC permissions.
482
483       alsa_home_t
484
485            /home/[^/]+/.asoundrc
486
487       anon_inodefs_t
488
489
490       auth_cache_t
491
492            /var/cache/coolkey(/.*)?
493
494       bluetooth_helper_tmp_t
495
496
497       bluetooth_helper_tmpfs_t
498
499
500       cgroup_t
501
502            /sys/fs/cgroup
503
504       chrome_sandbox_tmpfs_t
505
506
507       cifs_t
508
509
510       dirsrv_config_t
511
512            /etc/dirsrv(/.*)?
513
514       dirsrv_var_lib_t
515
516            /var/lib/dirsrv(/.*)?
517
518       dirsrv_var_log_t
519
520            /var/log/dirsrv(/.*)?
521
522       dirsrv_var_run_t
523
524            /var/run/slapd.*
525            /var/run/dirsrv(/.*)?
526
527       dosfs_t
528
529
530       faillog_t
531
532            /var/log/btmp.*
533            /var/log/faillog.*
534            /var/log/tallylog.*
535            /var/run/faillock(/.*)?
536
537       games_data_t
538
539            /var/games(/.*)?
540            /var/lib/games(/.*)?
541
542       gconf_tmp_t
543
544            /tmp/gconfd-[^/]+/.*
545
546       git_user_content_t
547
548            /home/[^/]+/public_git(/.*)?
549
550       gkeyringd_tmp_t
551
552            /var/run/user/[^/]*/keyring.*
553
554       gnome_home_type
555
556
557       gpg_agent_tmp_t
558
559            /home/[^/]+/.gnupg/log-socket
560
561       httpd_user_content_t
562
563            /home/[^/]+/((www)|(web)|(public_html))(/.+)?
564
565       httpd_user_htaccess_t
566
567            /home/[^/]+/((www)|(web)|(public_html))(/.*)?/.htaccess
568
569       httpd_user_ra_content_t
570
571            /home/[^/]+/((www)|(web)|(public_html))(/.*)?/logs(/.*)?
572
573       httpd_user_rw_content_t
574
575
576       httpd_user_script_exec_t
577
578            /home/[^/]+/((www)|(web)|(public_html))/cgi-bin(/.+)?
579
580       irc_home_t
581
582            /home/[^/]+/.irssi(/.*)?
583            /home/[^/]+/irclog(/.*)?
584            /home/[^/]+/.ircmotd
585
586       irc_tmp_t
587
588
589       irssi_home_t
590
591
592       mail_spool_t
593
594            /var/mail(/.*)?
595            /var/spool/imap(/.*)?
596            /var/spool/mail(/.*)?
597            /var/spool/smtpd(/.*)?
598
599       mpd_user_data_t
600
601
602       mqueue_spool_t
603
604            /var/spool/(client)?mqueue(/.*)?
605            /var/spool/mqueue.in(/.*)?
606
607       nfs_t
608
609
610       noxattrfs
611
612            all files on file systems which do not support extended attributes
613
614       pulseaudio_tmpfs_t
615
616
617       pulseaudio_tmpfsfile
618
619
620       sandbox_file_t
621
622
623       sandbox_tmpfs_type
624
625            all sandbox content in tmpfs file systems
626
627       screen_home_t
628
629            /root/.screen(/.*)?
630            /home/[^/]+/.screen(/.*)?
631            /home/[^/]+/.screenrc
632            /home/[^/]+/.tmux.conf
633
634       security_t
635
636            /selinux
637
638       session_dbusd_tmp_t
639
640            /var/run/user(/.*)?/dbus-[0-9]*(/.*)?
641            /var/run/user/[^/]*/systemd(/.*)?
642
643       ssh_home_t
644
645            /var/lib/[^/]+/.ssh(/.*)?
646            /root/.ssh(/.*)?
647            /var/lib/one/.ssh(/.*)?
648            /var/lib/pgsql/.ssh(/.*)?
649            /var/lib/openshift/[^/]+/.ssh(/.*)?
650            /var/lib/amanda/.ssh(/.*)?
651            /var/lib/stickshift/[^/]+/.ssh(/.*)?
652            /var/lib/gitolite/.ssh(/.*)?
653            /var/lib/nocpulse/.ssh(/.*)?
654            /var/lib/gitolite3/.ssh(/.*)?
655            /var/lib/openshift/gear/[^/]+/.ssh(/.*)?
656            /root/.shosts
657            /home/[^/]+/.ssh(/.*)?
658            /home/[^/]+/.ansible/cp/.*
659            /home/[^/]+/.shosts
660
661       systemd_passwd_var_run_t
662
663            /var/run/systemd/ask-password(/.*)?
664            /var/run/systemd/ask-password-block(/.*)?
665
666       systemd_unit_file_type
667
668
669       usbfs_t
670
671
672       user_cron_spool_t
673
674            /var/spool/at(/.*)?
675            /var/spool/cron
676            /var/spool/cron/[^/]+
677
678       user_fonts_cache_t
679
680            /root/.fontconfig(/.*)?
681            /root/.fonts/auto(/.*)?
682            /root/.fonts.cache-.*
683            /root/.cache/fontconfig(/.*)?
684            /home/[^/]+/.fontconfig(/.*)?
685            /home/[^/]+/.fonts/auto(/.*)?
686            /home/[^/]+/.fonts.cache-.*
687            /home/[^/]+/.cache/fontconfig(/.*)?
688
689       user_home_type
690
691            all user home files
692
693       user_tmp_t
694
695            /dev/shm/mono.*
696            /var/run/user(/.*)?
697            /tmp/.ICE-unix(/.*)?
698            /tmp/.X11-unix(/.*)?
699            /dev/shm/pulse-shm.*
700            /tmp/.X0-lock
701            /tmp/hsperfdata_root
702            /var/tmp/hsperfdata_root
703            /home/[^/]+/tmp
704            /home/[^/]+/.tmp
705            /tmp/gconfd-[^/]+
706
707       user_tmp_type
708
709            all user tmp files
710
711       var_auth_t
712
713            /var/ace(/.*)?
714            /var/rsa(/.*)?
715            /var/lib/abl(/.*)?
716            /var/lib/rsa(/.*)?
717            /var/lib/pam_ssh(/.*)?
718            /var/run/pam_ssh(/.*)?
719            /var/lib/pam_shield(/.*)?
720            /var/opt/quest/vas/vasd(/.*)?
721            /var/lib/google-authenticator(/.*)?
722
723       virt_image_type
724
725            all virtual image files
726
727       wireshark_home_t
728
729            /home/[^/]+/.wireshark(/.*)?
730
731       wireshark_tmp_t
732
733
734       wireshark_tmpfs_t
735
736
737       xserver_tmpfs_t
738
739
740

COMMANDS

742       semanage fcontext can also be used to manipulate default  file  context
743       mappings.
744
745       semanage  permissive  can  also  be used to manipulate whether or not a
746       process type is permissive.
747
748       semanage module can also be used to enable/disable/install/remove  pol‐
749       icy modules.
750
751       semanage boolean can also be used to manipulate the booleans
752
753
754       system-config-selinux is a GUI tool available to customize SELinux pol‐
755       icy settings.
756
757

AUTHOR

759       This manual page was auto-generated using sepolicy manpage .
760
761