spamd_selinux(8)

1spamd_selinux(8)             SELinux Policy spamd             spamd_selinux(8)
2
3
4

NAME

6       spamd_selinux - Security Enhanced Linux Policy for the spamd processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the spamd processes via flexible manda‐
10       tory access control.
11
12       The spamd processes execute with the  spamd_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep spamd_t
19
20
21

ENTRYPOINTS

23       The spamd_t SELinux type can be entered via the spamd_exec_t file type.
24
25       The default entrypoint paths for the spamd_t domain are the following:
26
27       /usr/bin/spamd,  /usr/bin/pyzord,  /usr/sbin/spamd,   /usr/sbin/spampd,
28       /usr/bin/mimedefang,                   /usr/bin/mimedefang-multiplexor,
29       /usr/libexec/mimedefang-wrapper
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       spamd policy is very flexible allowing users to setup their spamd  pro‐
39       cesses in as secure a method as possible.
40
41       The following process types are defined for spamd:
42
43       spamd_update_t, spamd_t
44
45       Note:  semanage  permissive  -a spamd_t can be used to make the process
46       type spamd_t permissive. SELinux does not  deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access  required.   spamd
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run spamd with the tightest access possible.
55
56
57
58       If you want to allow spamd to read/write  user  home  directories,  you
59       must turn on the spamd_enable_home_dirs boolean. Enabled by default.
60
61       setsebool -P spamd_enable_home_dirs 1
62
63
64
65       If you want to allow all domains to execute in fips_mode, you must turn
66       on the fips_mode boolean. Enabled by default.
67
68       setsebool -P fips_mode 1
69
70
71

PORT TYPES

73       SELinux defines port types to represent TCP and UDP ports.
74
75       You can see the types associated with a port  by  using  the  following
76       command:
77
78       semanage port -l
79
80
81       Policy  governs  the  access  confined  processes  have to these ports.
82       SELinux spamd policy is very flexible allowing  users  to  setup  their
83       spamd processes in as secure a method as possible.
84
85       The following port types are defined for spamd:
86
87
88       spamd_port_t
89
90
91
92       Default Defined Ports:
93                 tcp 783,10026,10027
94

MANAGED FILES

96       The SELinux process type spamd_t can manage files labeled with the fol‐
97       lowing file types.  The paths listed are the default  paths  for  these
98       file types.  Note the processes UID still need to have DAC permissions.
99
100       antivirus_db_t
101
102            /var/amavis(/.*)?
103            /var/clamav(/.*)?
104            /var/lib/clamd.*
105            /var/lib/amavis(/.*)?
106            /var/lib/clamav(/.*)?
107            /var/virusmails(/.*)?
108            /var/opt/f-secure(/.*)?
109            /var/spool/amavisd(/.*)?
110            /var/lib/clamav-unofficial-sigs(/.*)?
111
112       cifs_t
113
114
115       cluster_conf_t
116
117            /etc/cluster(/.*)?
118
119       cluster_var_lib_t
120
121            /var/lib/pcsd(/.*)?
122            /var/lib/cluster(/.*)?
123            /var/lib/openais(/.*)?
124            /var/lib/pengine(/.*)?
125            /var/lib/corosync(/.*)?
126            /usr/lib/heartbeat(/.*)?
127            /var/lib/heartbeat(/.*)?
128            /var/lib/pacemaker(/.*)?
129
130       cluster_var_run_t
131
132            /var/run/crm(/.*)?
133            /var/run/cman_.*
134            /var/run/rsctmp(/.*)?
135            /var/run/aisexec.*
136            /var/run/heartbeat(/.*)?
137            /var/run/pcsd-ruby.socket
138            /var/run/corosync-qnetd(/.*)?
139            /var/run/corosync-qdevice(/.*)?
140            /var/run/corosync.pid
141            /var/run/cpglockd.pid
142            /var/run/rgmanager.pid
143            /var/run/cluster/rgmanager.sk
144
145       ecryptfs_t
146
147            /home/[^/]+/.Private(/.*)?
148            /home/[^/]+/.ecryptfs(/.*)?
149
150       exim_spool_t
151
152            /var/spool/exim[0-9]?(/.*)?
153
154       fusefs_t
155
156            /var/run/user/[0-9]+/gvfs
157
158       krb5_host_rcache_t
159
160            /var/tmp/krb5_0.rcache2
161            /var/cache/krb5rcache(/.*)?
162            /var/tmp/nfs_0
163            /var/tmp/DNS_25
164            /var/tmp/host_0
165            /var/tmp/imap_0
166            /var/tmp/HTTP_23
167            /var/tmp/HTTP_48
168            /var/tmp/ldap_55
169            /var/tmp/ldap_487
170            /var/tmp/ldapmap1_0
171
172       logwatch_cache_t
173
174            /var/lib/epylog(/.*)?
175            /var/lib/logcheck(/.*)?
176            /var/cache/logwatch(/.*)?
177
178       mail_spool_t
179
180            /var/mail(/.*)?
181            /var/spool/imap(/.*)?
182            /var/spool/mail(/.*)?
183            /var/spool/smtpd(/.*)?
184
185       nfs_t
186
187
188       root_t
189
190            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
191            /
192            /initrd
193
194       spamass_milter_state_t
195
196            /var/lib/spamass-milter(/.*)?
197
198       spamc_home_t
199
200            /root/.pyzor(/.*)?
201            /root/.razor(/.*)?
202            /root/.spamd(/.*)?
203            /root/.spamassassin(/.*)?
204            /home/[^/]+/.pyzor(/.*)?
205            /home/[^/]+/.razor(/.*)?
206            /home/[^/]+/.spamd(/.*)?
207            /home/[^/]+/.spamassassin(/.*)?
208
209       spamd_compiled_t
210
211            /var/lib/spamassassin/compiled(/.*)?
212
213       spamd_etc_t
214
215            /etc/pyzor(/.*)?
216            /etc/razor(/.*)?
217
218       spamd_log_t
219
220            /var/log/spamd.log.*
221            /var/log/mimedefang.*
222            /var/log/pyzord.log.*
223            /var/log/sa-update.log.*
224            /var/log/razor-agent.log.*
225
226       spamd_spool_t
227
228            /var/spool/spamd(/.*)?
229            /var/spool/spampd(/.*)?
230            /var/spool/spamassassin(/.*)?
231
232       spamd_tmp_t
233
234
235       spamd_var_lib_t
236
237            /var/lib/razor(/.*)?
238            /var/lib/pyzord(/.*)?
239            /var/lib/spamassassin(/.*)?
240
241       spamd_var_run_t
242
243            /var/run/spamassassin(/.*)?
244            /var/spool/MIMEDefang(/.*)?
245            /var/spool/MD-Quarantine(/.*)?
246
247       user_home_t
248
249            /home/[^/]+/.+
250
251

FILE CONTEXTS

253       SELinux requires files to have an extended attribute to define the file
254       type.
255
256       You can see the context of a file using the -Z option to ls
257
258       Policy governs the access  confined  processes  have  to  these  files.
259       SELinux  spamd  policy  is  very flexible allowing users to setup their
260       spamd processes in as secure a method as possible.
261
262       EQUIVALENCE DIRECTORIES
263
264
265       spamd policy stores data with multiple different file context types un‐
266       der  the  /var/lib/spamassassin  directory.  If you would like to store
267       the data in a different directory you can use the semanage  command  to
268       create  an equivalence mapping.  If you wanted to store this data under
269       the /srv directory you would execute the following command:
270
271       semanage fcontext -a -e /var/lib/spamassassin /srv/spamassassin
272       restorecon -R -v /srv/spamassassin
273
274       STANDARD FILE CONTEXT
275
276       SELinux defines the file context types for the spamd, if you wanted  to
277       store  files  with  these types in a diffent paths, you need to execute
278       the semanage command to specify alternate labeling  and  then  use  re‐
279       storecon to put the labels on disk.
280
281       semanage fcontext -a -t spamd_etc_t '/srv/myspamd_content(/.*)?'
282       restorecon -R -v /srv/myspamd_content
283
284       Note:  SELinux  often  uses  regular expressions to specify labels that
285       match multiple files.
286
287       The following file types are defined for spamd:
288
289
290
291       spamd_compiled_t
292
293       - Set files with the spamd_compiled_t type, if you want  to  treat  the
294       files as spamd compiled data.
295
296
297
298       spamd_etc_t
299
300       - Set files with the spamd_etc_t type, if you want to store spamd files
301       in the /etc directories.
302
303
304       Paths:
305            /etc/pyzor(/.*)?, /etc/razor(/.*)?
306
307
308       spamd_exec_t
309
310       - Set files with the spamd_exec_t type, if you want  to  transition  an
311       executable to the spamd_t domain.
312
313
314       Paths:
315            /usr/bin/spamd,          /usr/bin/pyzord,         /usr/sbin/spamd,
316            /usr/sbin/spampd, /usr/bin/mimedefang,  /usr/bin/mimedefang-multi‐
317            plexor, /usr/libexec/mimedefang-wrapper
318
319
320       spamd_initrc_exec_t
321
322       -  Set  files with the spamd_initrc_exec_t type, if you want to transi‐
323       tion an executable to the spamd_initrc_t domain.
324
325
326       Paths:
327            /etc/rc.d/init.d/mimedefang.*,             /etc/rc.d/init.d/spamd,
328            /etc/rc.d/init.d/pyzord, /etc/rc.d/init.d/spampd
329
330
331       spamd_log_t
332
333       - Set files with the spamd_log_t type, if you want to treat the data as
334       spamd log data, usually stored under the /var/log directory.
335
336
337       Paths:
338            /var/log/spamd.log.*,     /var/log/mimedefang.*,      /var/log/py‐
339            zord.log.*, /var/log/sa-update.log.*, /var/log/razor-agent.log.*
340
341
342       spamd_spool_t
343
344       - Set files with the spamd_spool_t type, if you want to store the spamd
345       files under the /var/spool directory.
346
347
348       Paths:
349            /var/spool/spamd(/.*)?,  /var/spool/spampd(/.*)?,  /var/spool/spa‐
350            massassin(/.*)?
351
352
353       spamd_tmp_t
354
355       -  Set files with the spamd_tmp_t type, if you want to store spamd tem‐
356       porary files in the /tmp directories.
357
358
359
360       spamd_unit_file_t
361
362       - Set files with the spamd_unit_file_t type, if you want to  treat  the
363       files as spamd unit content.
364
365
366
367       spamd_update_exec_t
368
369       -  Set  files with the spamd_update_exec_t type, if you want to transi‐
370       tion an executable to the spamd_update_t domain.
371
372
373       Paths:
374            /usr/share/spamassassin/sa-update.cron, /usr/bin/sa-update
375
376
377       spamd_update_unit_file_t
378
379       - Set files with the spamd_update_unit_file_t  type,  if  you  want  to
380       treat the files as spamd update unit content.
381
382
383       Paths:
384            /usr/lib/systemd/system/sa-update.timer,     /usr/lib/systemd/sys‐
385            tem/sa-update.service
386
387
388       spamd_var_lib_t
389
390       - Set files with the spamd_var_lib_t type, if you  want  to  store  the
391       spamd files under the /var/lib directory.
392
393
394       Paths:
395            /var/lib/razor(/.*)?,  /var/lib/pyzord(/.*)?,  /var/lib/spamassas‐
396            sin(/.*)?
397
398
399       spamd_var_run_t
400
401       - Set files with the spamd_var_run_t type, if you  want  to  store  the
402       spamd files under the /run or /var/run directory.
403
404
405       Paths:
406            /var/run/spamassassin(/.*)?,          /var/spool/MIMEDefang(/.*)?,
407            /var/spool/MD-Quarantine(/.*)?
408
409
410       Note: File context can be temporarily modified with the chcon  command.
411       If  you want to permanently change the file context you need to use the
412       semanage fcontext command.  This will modify the SELinux labeling data‐
413       base.  You will need to use restorecon to apply the labels.
414
415

COMMANDS

417       semanage  fcontext  can also be used to manipulate default file context
418       mappings.
419
420       semanage permissive can also be used to manipulate  whether  or  not  a
421       process type is permissive.
422
423       semanage  module can also be used to enable/disable/install/remove pol‐
424       icy modules.
425
426       semanage port can also be used to manipulate the port definitions
427
428       semanage boolean can also be used to manipulate the booleans
429
430
431       system-config-selinux is a GUI tool available to customize SELinux pol‐
432       icy settings.
433
434

AUTHOR

436       This manual page was auto-generated using sepolicy manpage .
437
438