init_selinux(8)

1init_selinux(8)               SELinux Policy init              init_selinux(8)
2
3
4

NAME

6       init_selinux - Security Enhanced Linux Policy for the init processes
7

DESCRIPTION

9       Security-Enhanced  Linux secures the init processes via flexible manda‐
10       tory access control.
11
12       The init processes execute with the init_t SELinux type. You can  check
13       if  you  have  these processes running by executing the ps command with
14       the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep init_t
19
20
21

ENTRYPOINTS

23       The  init_t  SELinux  type  can  be  entered  via   the   shell_exec_t,
24       init_exec_t file types.
25
26       The default entrypoint paths for the init_t domain are the following:
27
28       /bin/d?ash,  /bin/ksh.*,  /bin/zsh.*,  /usr/bin/d?ash,  /usr/bin/ksh.*,
29       /usr/bin/zsh.*, /bin/esh, /bin/bash, /bin/fish,  /bin/mksh,  /bin/sash,
30       /bin/tcsh,    /bin/yash,   /bin/bash2,   /usr/bin/esh,   /sbin/nologin,
31       /usr/bin/bash,     /usr/bin/fish,     /usr/bin/mksh,     /usr/bin/sash,
32       /usr/bin/tcsh,     /usr/bin/yash,    /usr/bin/bash2,    /usr/sbin/sesh,
33       /usr/sbin/smrsh, /usr/bin/scponly,  /usr/libexec/sesh,  /usr/sbin/nolo‐
34       gin,  /usr/bin/git-shell,  /usr/sbin/scponlyc,  /usr/libexec/sudo/sesh,
35       /usr/bin/cockpit-bridge, /usr/libexec/cockpit-agent,  /usr/libexec/git-
36       core/git-shell,   /sbin/init(ng)?,  /usr/sbin/init(ng)?,  /usr/lib/sys‐
37       temd/[^/]*,   /usr/lib/systemd/system-generators/[^/]*,   /bin/systemd,
38       /sbin/upstart, /usr/bin/systemd, /usr/sbin/upstart
39

PROCESS TYPES

41       SELinux defines process types (domains) for each process running on the
42       system
43
44       You can see the context of a process using the -Z option to ps
45
46       Policy governs the access confined processes have  to  files.   SELinux
47       init  policy  is  very flexible allowing users to setup their init pro‐
48       cesses in as secure a method as possible.
49
50       The following process types are defined for init:
51
52       init_t, initrc_t
53
54       Note: semanage permissive -a init_t can be used  to  make  the  process
55       type  init_t  permissive.  SELinux  does  not deny access to permissive
56       process types, but the AVC (SELinux denials) messages are still  gener‐
57       ated.
58
59

BOOLEANS

61       SELinux  policy  is  customizable based on least access required.  init
62       policy is extremely flexible and has several booleans that allow you to
63       manipulate the policy and run init with the tightest access possible.
64
65
66
67       If  you  want  to  enable  init  create,  setattr, mounton on non_secu‐
68       rity_file_type, you must turn on the init_create_dirs boolean.  Enabled
69       by default.
70
71       setsebool -P init_create_dirs 1
72
73
74
75       If  you  want to deny all system processes and Linux users to use blue‐
76       tooth wireless technology, you must turn on the deny_bluetooth boolean.
77       Enabled by default.
78
79       setsebool -P deny_bluetooth 1
80
81
82
83       If you want to allow all domains to execute in fips_mode, you must turn
84       on the fips_mode boolean. Enabled by default.
85
86       setsebool -P fips_mode 1
87
88
89
90       If you want to allow nagios/nrpe to call sudo from NRPE utils  scripts,
91       you must turn on the nagios_run_sudo boolean. Disabled by default.
92
93       setsebool -P nagios_run_sudo 1
94
95
96
97       If  you  want  to  disable  kernel module loading, you must turn on the
98       secure_mode_insmod boolean. Enabled by default.
99
100       setsebool -P secure_mode_insmod 1
101
102
103
104       If you want to allow create vbox modules during startup new kernel, you
105       must turn on the use_virtualbox boolean. Disabled by default.
106
107       setsebool -P use_virtualbox 1
108
109
110

MANAGED FILES

112       The  SELinux process type init_t can manage files labeled with the fol‐
113       lowing file types.  The paths listed are the default  paths  for  these
114       file types.  Note the processes UID still need to have DAC permissions.
115
116       auditd_etc_t
117
118            /etc/audit(/.*)?
119
120       binfmt_misc_fs_t
121
122
123       boolean_type
124
125
126       bpf_t
127
128            /sys/fs/bpf
129
130       cgroup_t
131
132            /sys/fs/cgroup
133
134       consolekit_log_t
135
136            /var/log/ConsoleKit(/.*)?
137
138       etc_aliases_t
139
140            /etc/mail/.*.db
141            /etc/mail/aliases.*
142            /etc/postfix/aliases.*
143            /etc/aliases
144            /etc/aliases.db
145
146       faillog_t
147
148            /var/log/btmp.*
149            /var/log/faillog.*
150            /var/log/tallylog.*
151            /var/run/faillock(/.*)?
152
153       gnome_home_type
154
155
156       init_var_lib_t
157
158            /var/lib/systemd(/.*)?
159            /var/lib/private/systemd(/.*)?
160
161       initrc_state_t
162
163
164       krb5_keytab_t
165
166            /var/kerberos/krb5(/.*)?
167            /etc/krb5.keytab
168            /etc/krb5kdc/kadm5.keytab
169            /var/kerberos/krb5kdc/kadm5.keytab
170
171       lastlog_t
172
173            /var/log/lastlog.*
174
175       lockfile
176
177
178       mnt_t
179
180            /mnt(/[^/]*)?
181            /mnt(/[^/]*)?
182            /rhev(/[^/]*)?
183            /rhev/[^/]*/.*
184            /media(/[^/]*)?
185            /media(/[^/]*)?
186            /media/.hal-.*
187            /var/run/media(/[^/]*)?
188            /afs
189            /net
190            /misc
191            /rhev
192
193       print_spool_t
194
195            /var/spool/lpd(/.*)?
196            /var/spool/cups(/.*)?
197            /var/spool/cups-pdf(/.*)?
198
199       random_seed_t
200
201            /var/lib/random-seed
202            /usr/var/lib/random-seed
203
204       svirt_file_type
205
206
207       sysctl_type
208
209
210       sysfs_t
211
212            /sys(/.*)?
213
214       systemd_home_t
215
216            /root/.local/share/systemd(/.*)?
217            /home/[^/]+/.local/share/systemd(/.*)?
218
219       systemd_unit_file_type
220
221
222       tmpfs_t
223
224            /dev/shm
225            /var/run/shm
226            /usr/lib/udev/devices/shm
227
228       udev_rules_t
229
230            /etc/udev/rules.d(/.*)?
231
232       var_lib_nfs_t
233
234            /var/lib/nfs(/.*)?
235
236       var_lib_t
237
238            /opt/(.*/)?var/lib(/.*)?
239            /var/lib(/.*)?
240
241       var_log_t
242
243            /var/log/.*
244            /nsr/logs(/.*)?
245            /var/webmin(/.*)?
246            /var/log/secure[^/]*
247            /opt/zimbra/log(/.*)?
248            /var/log/maillog[^/]*
249            /var/log/spooler[^/]*
250            /var/log/messages[^/]*
251            /usr/centreon/log(/.*)?
252            /var/spool/rsyslog(/.*)?
253            /var/axfrdns/log/main(/.*)?
254            /var/spool/bacula/log(/.*)?
255            /var/tinydns/log/main(/.*)?
256            /var/dnscache/log/main(/.*)?
257            /var/stockmaniac/templates_cache(/.*)?
258            /opt/Symantec/scspagent/IDS/system(/.*)?
259            /var/log
260            /var/log/dmesg
261            /var/log/syslog
262            /var/named/chroot/var/log
263
264       wtmp_t
265
266            /var/log/wtmp.*
267
268

FILE CONTEXTS

270       SELinux requires files to have an extended attribute to define the file
271       type.
272
273       You can see the context of a file using the -Z option to ls
274
275       Policy governs the access  confined  processes  have  to  these  files.
276       SELinux init policy is very flexible allowing users to setup their init
277       processes in as secure a method as possible.
278
279       EQUIVALENCE DIRECTORIES
280
281
282       init policy stores data with  multiple  different  file  context  types
283       under  the  /var/run/systemd directory.  If you would like to store the
284       data in a different directory you can use the semanage command to  cre‐
285       ate an equivalence mapping.  If you wanted to store this data under the
286       /srv directory you would execute the following command:
287
288       semanage fcontext -a -e /var/run/systemd /srv/systemd
289       restorecon -R -v /srv/systemd
290
291       STANDARD FILE CONTEXT
292
293       SELinux defines the file context types for the init, if you  wanted  to
294       store  files  with  these types in a diffent paths, you need to execute
295       the semanage command  to  sepecify  alternate  labeling  and  then  use
296       restorecon to put the labels on disk.
297
298       semanage fcontext -a -t initrc_var_run_t '/srv/myinit_content(/.*)?'
299       restorecon -R -v /srv/myinit_content
300
301       Note:  SELinux  often  uses  regular expressions to specify labels that
302       match multiple files.
303
304       The following file types are defined for init:
305
306
307
308       init_exec_t
309
310       - Set files with the init_exec_t type, if you  want  to  transition  an
311       executable to the init_t domain.
312
313
314       Paths:
315            /sbin/init(ng)?,    /usr/sbin/init(ng)?,   /usr/lib/systemd/[^/]*,
316            /usr/lib/systemd/system-generators/[^/]*,            /bin/systemd,
317            /sbin/upstart, /usr/bin/systemd, /usr/sbin/upstart
318
319
320       init_tmp_t
321
322       -  Set files with the init_tmp_t type, if you want to store init tempo‐
323       rary files in the /tmp directories.
324
325
326
327       init_var_lib_t
328
329       - Set files with the init_var_lib_t type, if you want to store the init
330       files under the /var/lib directory.
331
332
333       Paths:
334            /var/lib/systemd(/.*)?, /var/lib/private/systemd(/.*)?
335
336
337       init_var_run_t
338
339       - Set files with the init_var_run_t type, if you want to store the init
340       files under the /run or /var/run directory.
341
342
343
344       initctl_t
345
346       - Set files with the initctl_t type, if you want to treat the files  as
347       initctl data.
348
349
350       Paths:
351            /dev/initctl, /var/run/initctl, /var/run/systemd/initctl/fifo
352
353
354       initrc_devpts_t
355
356       -  Set  files  with  the initrc_devpts_t type, if you want to treat the
357       files as initrc devpts data.
358
359
360
361       initrc_exec_t
362
363       - Set files with the initrc_exec_t type, if you want to  transition  an
364       executable to the initrc_t domain.
365
366
367       Paths:
368            /etc/init.d/.*,      /etc/rc.d/rc.[^/]+,      /etc/rc.d/init.d/.*,
369            /opt/nfast/sbin/init.d-ncipher,          /usr/libexec/dcc/stop-.*,
370            /usr/libexec/dcc/start-.*,           /usr/lib/systemd/fedora[^/]*,
371            /opt/nfast/scripts/init.d/(.*),   /etc/rc.d/rc,   /etc/X11/prefdm,
372            /usr/sbin/startx,    /usr/bin/sepg_ctl,    /usr/sbin/start-dirsrv,
373            /usr/sbin/open_init_pty,  /usr/sbin/restart-dirsrv,   /etc/syscon‐
374            fig/network-scripts/ifup-ipsec,      /usr/share/system-config-ser‐
375            vices/system-config-services-mechanism.py
376
377
378       initrc_state_t
379
380       - Set files with the initrc_state_t type, if  you  want  to  treat  the
381       files as initrc state data.
382
383
384
385       initrc_tmp_t
386
387       -  Set  files  with  the initrc_tmp_t type, if you want to store initrc
388       temporary files in the /tmp directories.
389
390
391
392       initrc_var_log_t
393
394       - Set files with the initrc_var_log_t type, if you want  to  treat  the
395       data  as  initrc var log data, usually stored under the /var/log direc‐
396       tory.
397
398
399
400       initrc_var_run_t
401
402       - Set files with the initrc_var_run_t type, if you want  to  store  the
403       initrc files under the /run or /var/run directory.
404
405
406       Paths:
407            /var/run/utmp,     /var/run/random-seed,    /var/run/runlevel.dir,
408            /var/run/setmixer_flag
409
410
411       Note: File context can be temporarily modified with the chcon  command.
412       If  you want to permanently change the file context you need to use the
413       semanage fcontext command.  This will modify the SELinux labeling data‐
414       base.  You will need to use restorecon to apply the labels.
415
416

COMMANDS

418       semanage  fcontext  can also be used to manipulate default file context
419       mappings.
420
421       semanage permissive can also be used to manipulate  whether  or  not  a
422       process type is permissive.
423
424       semanage  module can also be used to enable/disable/install/remove pol‐
425       icy modules.
426
427       semanage boolean can also be used to manipulate the booleans
428
429
430       system-config-selinux is a GUI tool available to customize SELinux pol‐
431       icy settings.
432
433

AUTHOR

435       This manual page was auto-generated using sepolicy manpage .
436
437