spamd_selinux(8)

1spamd_selinux(8)             SELinux Policy spamd             spamd_selinux(8)
2
3
4

NAME

6       spamd_selinux - Security Enhanced Linux Policy for the spamd processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the spamd processes via flexible manda‐
10       tory access control.
11
12       The spamd processes execute with the  spamd_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep spamd_t
19
20
21

ENTRYPOINTS

23       The spamd_t SELinux type can be entered via the spamd_exec_t file type.
24
25       The default entrypoint paths for the spamd_t domain are the following:
26
27       /usr/bin/spamd,  /usr/bin/pyzord,  /usr/sbin/spamd,   /usr/sbin/spampd,
28       /usr/bin/mimedefang,                   /usr/bin/mimedefang-multiplexor,
29       /usr/libexec/mimedefang-wrapper
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       spamd policy is very flexible allowing users to setup their spamd  pro‐
39       cesses in as secure a method as possible.
40
41       The following process types are defined for spamd:
42
43       spamd_update_t, spamd_t
44
45       Note:  semanage  permissive  -a spamd_t can be used to make the process
46       type spamd_t permissive. SELinux does not  deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access  required.   spamd
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run spamd with the tightest access possible.
55
56
57
58       If you want to allow spamd to read/write  user  home  directories,  you
59       must turn on the spamd_enable_home_dirs boolean. Enabled by default.
60
61       setsebool -P spamd_enable_home_dirs 1
62
63
64
65       If you want to allow all domains to execute in fips_mode, you must turn
66       on the fips_mode boolean. Enabled by default.
67
68       setsebool -P fips_mode 1
69
70
71

PORT TYPES

73       SELinux defines port types to represent TCP and UDP ports.
74
75       You can see the types associated with a port  by  using  the  following
76       command:
77
78       semanage port -l
79
80
81       Policy  governs  the  access  confined  processes  have to these ports.
82       SELinux spamd policy is very flexible allowing  users  to  setup  their
83       spamd processes in as secure a method as possible.
84
85       The following port types are defined for spamd:
86
87
88       spamd_port_t
89
90
91
92       Default Defined Ports:
93                 tcp 783,10026,10027
94

MANAGED FILES

96       The SELinux process type spamd_t can manage files labeled with the fol‐
97       lowing file types.  The paths listed are the default  paths  for  these
98       file types.  Note the processes UID still need to have DAC permissions.
99
100       antivirus_db_t
101
102            /var/amavis(/.*)?
103            /var/clamav(/.*)?
104            /var/lib/clamd.*
105            /var/lib/amavis(/.*)?
106            /var/lib/clamav(/.*)?
107            /var/virusmails(/.*)?
108            /var/opt/f-secure(/.*)?
109            /var/spool/amavisd(/.*)?
110            /var/lib/clamav-unofficial-sigs(/.*)?
111
112       cifs_t
113
114
115       cluster_conf_t
116
117            /etc/cluster(/.*)?
118
119       cluster_var_lib_t
120
121            /var/lib/pcsd(/.*)?
122            /var/lib/cluster(/.*)?
123            /var/lib/openais(/.*)?
124            /var/lib/pengine(/.*)?
125            /var/lib/corosync(/.*)?
126            /usr/lib/heartbeat(/.*)?
127            /var/lib/heartbeat(/.*)?
128            /var/lib/pacemaker(/.*)?
129
130       cluster_var_run_t
131
132            /var/run/crm(/.*)?
133            /var/run/cman_.*
134            /var/run/rsctmp(/.*)?
135            /var/run/aisexec.*
136            /var/run/heartbeat(/.*)?
137            /var/run/pcsd-ruby.socket
138            /var/run/corosync-qnetd(/.*)?
139            /var/run/corosync-qdevice(/.*)?
140            /var/run/corosync.pid
141            /var/run/cpglockd.pid
142            /var/run/rgmanager.pid
143            /var/run/cluster/rgmanager.sk
144
145       ecryptfs_t
146
147            /home/[^/]+/.Private(/.*)?
148            /home/[^/]+/.ecryptfs(/.*)?
149
150       exim_spool_t
151
152            /var/spool/exim[0-9]?(/.*)?
153
154       fusefs_t
155
156            /var/run/user/[^/]*/gvfs
157
158       krb5_host_rcache_t
159
160            /var/tmp/krb5_0.rcache2
161            /var/cache/krb5rcache(/.*)?
162            /var/tmp/nfs_0
163            /var/tmp/DNS_25
164            /var/tmp/host_0
165            /var/tmp/imap_0
166            /var/tmp/HTTP_23
167            /var/tmp/HTTP_48
168            /var/tmp/ldap_55
169            /var/tmp/ldap_487
170            /var/tmp/ldapmap1_0
171
172       logwatch_cache_t
173
174            /var/lib/epylog(/.*)?
175            /var/lib/logcheck(/.*)?
176            /var/cache/logwatch(/.*)?
177
178       mail_spool_t
179
180            /var/mail(/.*)?
181            /var/spool/imap(/.*)?
182            /var/spool/mail(/.*)?
183            /var/spool/smtpd(/.*)?
184
185       nfs_t
186
187
188       root_t
189
190            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
191            /
192            /initrd
193
194       spamass_milter_state_t
195
196            /var/lib/spamass-milter(/.*)?
197
198       spamc_home_t
199
200            /root/.pyzor(/.*)?
201            /root/.razor(/.*)?
202            /root/.spamd(/.*)?
203            /root/.spamassassin(/.*)?
204            /home/[^/]+/.pyzor(/.*)?
205            /home/[^/]+/.razor(/.*)?
206            /home/[^/]+/.spamd(/.*)?
207            /home/[^/]+/.spamassassin(/.*)?
208
209       spamd_compiled_t
210
211            /var/lib/spamassassin/compiled(/.*)?
212
213       spamd_etc_t
214
215            /etc/pyzor(/.*)?
216            /etc/razor(/.*)?
217
218       spamd_log_t
219
220            /var/log/spamd.log.*
221            /var/log/mimedefang.*
222            /var/log/pyzord.log.*
223            /var/log/sa-update.log.*
224            /var/log/razor-agent.log.*
225
226       spamd_spool_t
227
228            /var/spool/spamd(/.*)?
229            /var/spool/spampd(/.*)?
230            /var/spool/spamassassin(/.*)?
231
232       spamd_tmp_t
233
234
235       spamd_var_lib_t
236
237            /var/lib/razor(/.*)?
238            /var/lib/pyzord(/.*)?
239            /var/lib/spamassassin(/.*)?
240
241       spamd_var_run_t
242
243            /var/run/spamassassin(/.*)?
244            /var/spool/MIMEDefang(/.*)?
245            /var/spool/MD-Quarantine(/.*)?
246
247       user_home_t
248
249            /home/[^/]+/.+
250
251

FILE CONTEXTS

253       SELinux requires files to have an extended attribute to define the file
254       type.
255
256       You can see the context of a file using the -Z option to ls
257
258       Policy governs the access  confined  processes  have  to  these  files.
259       SELinux  spamd  policy  is  very flexible allowing users to setup their
260       spamd processes in as secure a method as possible.
261
262       EQUIVALENCE DIRECTORIES
263
264
265       spamd policy stores data with multiple different file context types un‐
266       der  the  /var/lib/spamassassin  directory.  If you would like to store
267       the data in a different directory you can use the semanage  command  to
268       create  an equivalence mapping.  If you wanted to store this data under
269       the /srv directory you would execute the following command:
270
271       semanage fcontext -a -e /var/lib/spamassassin /srv/spamassassin
272       restorecon -R -v /srv/spamassassin
273
274       STANDARD FILE CONTEXT
275
276       SELinux defines the file context types for the spamd, if you wanted  to
277       store  files  with  these types in a diffent paths, you need to execute
278       the semanage command to specify alternate labeling  and  then  use  re‐
279       storecon to put the labels on disk.
280
281       semanage fcontext -a -t spamd_etc_t '/srv/myspamd_content(/.*)?'
282       restorecon -R -v /srv/myspamd_content
283
284       Note:  SELinux  often  uses  regular expressions to specify labels that
285       match multiple files.
286
287       The following file types are defined for spamd:
288
289
290
291       spamd_compiled_t
292
293       - Set files with the spamd_compiled_t type, if you want  to  treat  the
294       files as spamd compiled data.
295
296
297
298       spamd_etc_t
299
300       - Set files with the spamd_etc_t type, if you want to store spamd files
301       in the /etc directories.
302
303
304       Paths:
305            /etc/pyzor(/.*)?, /etc/razor(/.*)?
306
307
308       spamd_exec_t
309
310       - Set files with the spamd_exec_t type, if you want  to  transition  an
311       executable to the spamd_t domain.
312
313
314       Paths:
315            /usr/bin/spamd,          /usr/bin/pyzord,         /usr/sbin/spamd,
316            /usr/sbin/spampd, /usr/bin/mimedefang,  /usr/bin/mimedefang-multi‐
317            plexor, /usr/libexec/mimedefang-wrapper
318
319
320       spamd_initrc_exec_t
321
322       -  Set  files with the spamd_initrc_exec_t type, if you want to transi‐
323       tion an executable to the spamd_initrc_t domain.
324
325
326       Paths:
327            /etc/rc.d/init.d/mimedefang.*,             /etc/rc.d/init.d/spamd,
328            /etc/rc.d/init.d/pyzord, /etc/rc.d/init.d/spampd
329
330
331       spamd_log_t
332
333       - Set files with the spamd_log_t type, if you want to treat the data as
334       spamd log data, usually stored under the /var/log directory.
335
336
337       Paths:
338            /var/log/spamd.log.*,     /var/log/mimedefang.*,      /var/log/py‐
339            zord.log.*, /var/log/sa-update.log.*, /var/log/razor-agent.log.*
340
341
342       spamd_spool_t
343
344       - Set files with the spamd_spool_t type, if you want to store the spamd
345       files under the /var/spool directory.
346
347
348       Paths:
349            /var/spool/spamd(/.*)?,  /var/spool/spampd(/.*)?,  /var/spool/spa‐
350            massassin(/.*)?
351
352
353       spamd_tmp_t
354
355       -  Set files with the spamd_tmp_t type, if you want to store spamd tem‐
356       porary files in the /tmp directories.
357
358
359
360       spamd_update_exec_t
361
362       - Set files with the spamd_update_exec_t type, if you want  to  transi‐
363       tion an executable to the spamd_update_t domain.
364
365
366       Paths:
367            /usr/share/spamassassin/sa-update.cron, /usr/bin/sa-update
368
369
370       spamd_var_lib_t
371
372       -  Set  files  with  the spamd_var_lib_t type, if you want to store the
373       spamd files under the /var/lib directory.
374
375
376       Paths:
377            /var/lib/razor(/.*)?,  /var/lib/pyzord(/.*)?,  /var/lib/spamassas‐
378            sin(/.*)?
379
380
381       spamd_var_run_t
382
383       -  Set  files  with  the spamd_var_run_t type, if you want to store the
384       spamd files under the /run or /var/run directory.
385
386
387       Paths:
388            /var/run/spamassassin(/.*)?,          /var/spool/MIMEDefang(/.*)?,
389            /var/spool/MD-Quarantine(/.*)?
390
391
392       Note:  File context can be temporarily modified with the chcon command.
393       If you want to permanently change the file context you need to use  the
394       semanage fcontext command.  This will modify the SELinux labeling data‐
395       base.  You will need to use restorecon to apply the labels.
396
397

COMMANDS

399       semanage fcontext can also be used to manipulate default  file  context
400       mappings.
401
402       semanage  permissive  can  also  be used to manipulate whether or not a
403       process type is permissive.
404
405       semanage module can also be used to enable/disable/install/remove  pol‐
406       icy modules.
407
408       semanage port can also be used to manipulate the port definitions
409
410       semanage boolean can also be used to manipulate the booleans
411
412
413       system-config-selinux is a GUI tool available to customize SELinux pol‐
414       icy settings.
415
416

AUTHOR

418       This manual page was auto-generated using sepolicy manpage .
419
420