1sysadm_screen_selinux(8) SELinux Policy sysadm_screen sysadm_screen_selinux(8)
2
3
4
6 sysadm_screen_selinux - Security Enhanced Linux Policy for the
7 sysadm_screen processes
8
10 Security-Enhanced Linux secures the sysadm_screen processes via flexi‐
11 ble mandatory access control.
12
13 The sysadm_screen processes execute with the sysadm_screen_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep sysadm_screen_t
20
21
22
24 The sysadm_screen_t SELinux type can be entered via the screen_exec_t
25 file type.
26
27 The default entrypoint paths for the sysadm_screen_t domain are the
28 following:
29
30 /usr/bin/tmux, /usr/bin/screen
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 sysadm_screen policy is very flexible allowing users to setup their
40 sysadm_screen processes in as secure a method as possible.
41
42 The following process types are defined for sysadm_screen:
43
44 sysadm_screen_t
45
46 Note: semanage permissive -a sysadm_screen_t can be used to make the
47 process type sysadm_screen_t permissive. SELinux does not deny access
48 to permissive process types, but the AVC (SELinux denials) messages are
49 still generated.
50
51
53 SELinux policy is customizable based on least access required.
54 sysadm_screen policy is extremely flexible and has several booleans
55 that allow you to manipulate the policy and run sysadm_screen with the
56 tightest access possible.
57
58
59
60 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62
63 setsebool -P fips_mode 1
64
65
66
67 If you want to support NFS home directories, you must turn on the
68 use_nfs_home_dirs boolean. Enabled by default.
69
70 setsebool -P use_nfs_home_dirs 1
71
72
73
74 If you want to support SAMBA home directories, you must turn on the
75 use_samba_home_dirs boolean. Disabled by default.
76
77 setsebool -P use_samba_home_dirs 1
78
79
80
82 The SELinux process type sysadm_screen_t can manage files labeled with
83 the following file types. The paths listed are the default paths for
84 these file types. Note the processes UID still need to have DAC per‐
85 missions.
86
87 faillog_t
88
89 /var/log/btmp.*
90 /var/log/faillog.*
91 /var/log/tallylog.*
92 /var/run/faillock(/.*)?
93
94 initrc_var_run_t
95
96 /var/run/utmp
97 /var/run/random-seed
98 /var/run/runlevel.dir
99 /var/run/setmixer_flag
100
101
103 semanage fcontext can also be used to manipulate default file context
104 mappings.
105
106 semanage permissive can also be used to manipulate whether or not a
107 process type is permissive.
108
109 semanage module can also be used to enable/disable/install/remove pol‐
110 icy modules.
111
112 semanage boolean can also be used to manipulate the booleans
113
114
115 system-config-selinux is a GUI tool available to customize SELinux pol‐
116 icy settings.
117
118
120 This manual page was auto-generated using sepolicy manpage .
121
122
124 selinux(8), sysadm_screen(8), semanage(8), restorecon(8), chcon(1),
125 sepolicy(8), setsebool(8)
126
127
128
129sysadm_screen 20-05-05 sysadm_screen_selinux(8)