remote_login_selinux(8)

1remote_login_selinux(8)   SELinux Policy remote_login  remote_login_selinux(8)
2
3
4

NAME

6       remote_login_selinux  -  Security  Enhanced  Linux  Policy  for the re‐
7       mote_login processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the remote_login processes via flexible
11       mandatory access control.
12
13       The  remote_login  processes  execute  with  the remote_login_t SELinux
14       type. You can check if you have these processes  running  by  executing
15       the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep remote_login_t
20
21
22

ENTRYPOINTS

24       The  remote_login_t  SELinux  type  can be entered via the login_exec_t
25       file type.
26
27       The default entrypoint paths for the remote_login_t domain are the fol‐
28       lowing:
29
30       /bin/login, /usr/bin/login, /usr/kerberos/sbin/login.krb5
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       remote_login  policy is very flexible allowing users to setup their re‐
40       mote_login processes in as secure a method as possible.
41
42       The following process types are defined for remote_login:
43
44       remote_login_t
45
46       Note: semanage permissive -a remote_login_t can be  used  to  make  the
47       process type remote_login_t permissive. SELinux does not deny access to
48       permissive process types, but the AVC (SELinux  denials)  messages  are
49       still generated.
50
51

BOOLEANS

53       SELinux  policy  is  customizable  based on least access required.  re‐
54       mote_login policy is extremely flexible and has several  booleans  that
55       allow you to manipulate the policy and run remote_login with the tight‐
56       est access possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66
67       If  you  want  to allow confined applications to run with kerberos, you
68       must turn on the kerberos_enabled boolean. Enabled by default.
69
70       setsebool -P kerberos_enabled 1
71
72
73
74       If you want to allow system to run with  NIS,  you  must  turn  on  the
75       nis_enabled boolean. Disabled by default.
76
77       setsebool -P nis_enabled 1
78
79
80
81       If you want to enable polyinstantiated directory support, you must turn
82       on the polyinstantiation_enabled boolean. Disabled by default.
83
84       setsebool -P polyinstantiation_enabled 1
85
86
87

MANAGED FILES

89       The SELinux process type remote_login_t can manage files  labeled  with
90       the  following  file types.  The paths listed are the default paths for
91       these file types.  Note the processes UID still need to have  DAC  per‐
92       missions.
93
94       auth_cache_t
95
96            /var/cache/coolkey(/.*)?
97
98       auth_home_t
99
100            /root/.yubico(/.*)?
101            /root/.config/Yubico(/.*)?
102            /root/.google_authenticator
103            /root/.google_authenticator~
104            /home/[^/]+/.yubico(/.*)?
105            /home/[^/]+/.config/Yubico(/.*)?
106            /home/[^/]+/.google_authenticator
107            /home/[^/]+/.google_authenticator~
108
109       faillog_t
110
111            /var/log/btmp.*
112            /var/log/faillog.*
113            /var/log/tallylog.*
114            /var/run/faillock(/.*)?
115
116       initrc_var_run_t
117
118            /var/run/utmp
119            /var/run/random-seed
120            /var/run/runlevel.dir
121            /var/run/setmixer_flag
122
123       krb5_host_rcache_t
124
125            /var/tmp/krb5_0.rcache2
126            /var/cache/krb5rcache(/.*)?
127            /var/tmp/nfs_0
128            /var/tmp/DNS_25
129            /var/tmp/host_0
130            /var/tmp/imap_0
131            /var/tmp/HTTP_23
132            /var/tmp/HTTP_48
133            /var/tmp/ldap_55
134            /var/tmp/ldap_487
135            /var/tmp/ldapmap1_0
136
137       lastlog_t
138
139            /var/log/lastlog.*
140
141       pam_var_console_t
142
143            /var/run/console(/.*)?
144
145       pam_var_run_t
146
147            /var/(db|adm)/sudo(/.*)?
148            /var/lib/sudo(/.*)?
149            /var/run/sudo(/.*)?
150            /var/run/pam_ssh(/.*)?
151            /var/run/sepermit(/.*)?
152            /var/run/pam_mount(/.*)?
153            /var/run/pam_timestamp(/.*)?
154
155       security_t
156
157            /selinux
158
159       user_tmp_t
160
161            /dev/shm/mono.*
162            /var/run/user(/.*)?
163            /tmp/.ICE-unix(/.*)?
164            /tmp/.X11-unix(/.*)?
165            /dev/shm/pulse-shm.*
166            /tmp/.X0-lock
167            /tmp/hsperfdata_root
168            /var/tmp/hsperfdata_root
169            /home/[^/]+/tmp
170            /home/[^/]+/.tmp
171            /tmp/gconfd-[^/]+
172
173       var_auth_t
174
175            /var/ace(/.*)?
176            /var/rsa(/.*)?
177            /var/lib/abl(/.*)?
178            /var/lib/rsa(/.*)?
179            /var/lib/pam_ssh(/.*)?
180            /var/lib/pam_shield(/.*)?
181            /var/opt/quest/vas/vasd(/.*)?
182            /var/lib/google-authenticator(/.*)?
183
184       wtmp_t
185
186            /var/log/wtmp.*
187
188

COMMANDS

190       semanage  fcontext  can also be used to manipulate default file context
191       mappings.
192
193       semanage permissive can also be used to manipulate  whether  or  not  a
194       process type is permissive.
195
196       semanage  module can also be used to enable/disable/install/remove pol‐
197       icy modules.
198
199       semanage boolean can also be used to manipulate the booleans
200
201
202       system-config-selinux is a GUI tool available to customize SELinux pol‐
203       icy settings.
204
205

AUTHOR

207       This manual page was auto-generated using sepolicy manpage .
208
209