1spamass_milter_selinux(8)SELinux Policy spamass_milterspamass_milter_selinux(8)
2
3
4
6 spamass_milter_selinux - Security Enhanced Linux Policy for the spa‐
7 mass_milter processes
8
10 Security-Enhanced Linux secures the spamass_milter processes via flexi‐
11 ble mandatory access control.
12
13 The spamass_milter processes execute with the spamass_milter_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep spamass_milter_t
20
21
22
24 The spamass_milter_t SELinux type can be entered via the spamass_mil‐
25 ter_exec_t file type.
26
27 The default entrypoint paths for the spamass_milter_t domain are the
28 following:
29
30 /usr/sbin/spamass-milter
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 spamass_milter policy is very flexible allowing users to setup their
40 spamass_milter processes in as secure a method as possible.
41
42 The following process types are defined for spamass_milter:
43
44 spamass_milter_t
45
46 Note: semanage permissive -a spamass_milter_t can be used to make the
47 process type spamass_milter_t permissive. SELinux does not deny access
48 to permissive process types, but the AVC (SELinux denials) messages are
49 still generated.
50
51
53 SELinux policy is customizable based on least access required. spa‐
54 mass_milter policy is extremely flexible and has several booleans that
55 allow you to manipulate the policy and run spamass_milter with the
56 tightest access possible.
57
58
59
60 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62
63 setsebool -P fips_mode 1
64
65
66
68 The SELinux process type spamass_milter_t can manage files labeled with
69 the following file types. The paths listed are the default paths for
70 these file types. Note the processes UID still need to have DAC per‐
71 missions.
72
73 cluster_conf_t
74
75 /etc/cluster(/.*)?
76
77 cluster_var_lib_t
78
79 /var/lib/pcsd(/.*)?
80 /var/lib/cluster(/.*)?
81 /var/lib/openais(/.*)?
82 /var/lib/pengine(/.*)?
83 /var/lib/corosync(/.*)?
84 /usr/lib/heartbeat(/.*)?
85 /var/lib/heartbeat(/.*)?
86 /var/lib/pacemaker(/.*)?
87
88 cluster_var_run_t
89
90 /var/run/crm(/.*)?
91 /var/run/cman_.*
92 /var/run/rsctmp(/.*)?
93 /var/run/aisexec.*
94 /var/run/heartbeat(/.*)?
95 /var/run/pcsd-ruby.socket
96 /var/run/corosync-qnetd(/.*)?
97 /var/run/corosync-qdevice(/.*)?
98 /var/run/corosync.pid
99 /var/run/cpglockd.pid
100 /var/run/rgmanager.pid
101 /var/run/cluster/rgmanager.sk
102
103 krb5_host_rcache_t
104
105 /var/tmp/krb5_0.rcache2
106 /var/cache/krb5rcache(/.*)?
107 /var/tmp/nfs_0
108 /var/tmp/DNS_25
109 /var/tmp/host_0
110 /var/tmp/imap_0
111 /var/tmp/HTTP_23
112 /var/tmp/HTTP_48
113 /var/tmp/ldap_55
114 /var/tmp/ldap_487
115 /var/tmp/ldapmap1_0
116
117 root_t
118
119 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
120 /
121 /initrd
122
123 spamass_milter_data_t
124
125 /var/run/spamass(/.*)?
126 /var/run/spamass-milter(/.*)?
127 /var/spool/postfix/spamass(/.*)?
128 /var/run/spamass-milter.pid
129
130
132 SELinux requires files to have an extended attribute to define the file
133 type.
134
135 You can see the context of a file using the -Z option to ls
136
137 Policy governs the access confined processes have to these files.
138 SELinux spamass_milter policy is very flexible allowing users to setup
139 their spamass_milter processes in as secure a method as possible.
140
141 EQUIVALENCE DIRECTORIES
142
143
144 spamass_milter policy stores data with multiple different file context
145 types under the /var/run/spamass directory. If you would like to store
146 the data in a different directory you can use the semanage command to
147 create an equivalence mapping. If you wanted to store this data under
148 the /srv directory you would execute the following command:
149
150 semanage fcontext -a -e /var/run/spamass /srv/spamass
151 restorecon -R -v /srv/spamass
152
153 STANDARD FILE CONTEXT
154
155 SELinux defines the file context types for the spamass_milter, if you
156 wanted to store files with these types in a diffent paths, you need to
157 execute the semanage command to sepecify alternate labeling and then
158 use restorecon to put the labels on disk.
159
160 semanage fcontext -a -t spamass_milter_state_t '/srv/myspamass_mil‐
161 ter_content(/.*)?'
162 restorecon -R -v /srv/myspamass_milter_content
163
164 Note: SELinux often uses regular expressions to specify labels that
165 match multiple files.
166
167 The following file types are defined for spamass_milter:
168
169
170
171 spamass_milter_data_t
172
173 - Set files with the spamass_milter_data_t type, if you want to treat
174 the files as spamass milter content.
175
176
177 Paths:
178 /var/run/spamass(/.*)?, /var/run/spamass-milter(/.*)?,
179 /var/spool/postfix/spamass(/.*)?, /var/run/spamass-milter.pid
180
181
182 spamass_milter_exec_t
183
184 - Set files with the spamass_milter_exec_t type, if you want to transi‐
185 tion an executable to the spamass_milter_t domain.
186
187
188
189 spamass_milter_state_t
190
191 - Set files with the spamass_milter_state_t type, if you want to treat
192 the files as spamass milter state data.
193
194
195
196 Note: File context can be temporarily modified with the chcon command.
197 If you want to permanently change the file context you need to use the
198 semanage fcontext command. This will modify the SELinux labeling data‐
199 base. You will need to use restorecon to apply the labels.
200
201
203 semanage fcontext can also be used to manipulate default file context
204 mappings.
205
206 semanage permissive can also be used to manipulate whether or not a
207 process type is permissive.
208
209 semanage module can also be used to enable/disable/install/remove pol‐
210 icy modules.
211
212 semanage boolean can also be used to manipulate the booleans
213
214
215 system-config-selinux is a GUI tool available to customize SELinux pol‐
216 icy settings.
217
218
220 This manual page was auto-generated using sepolicy manpage .
221
222
224 selinux(8), spamass_milter(8), semanage(8), restorecon(8), chcon(1),
225 sepolicy(8), setsebool(8)
226
227
228
229spamass_milter 21-06-09 spamass_milter_selinux(8)