antivirus_selinux(8)

1antivirus_selinux(8)       SELinux Policy antivirus       antivirus_selinux(8)
2
3
4

NAME

6       antivirus_selinux  -  Security  Enhanced Linux Policy for the antivirus
7       processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the antivirus  processes  via  flexible
11       mandatory access control.
12
13       The  antivirus processes execute with the antivirus_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep antivirus_t
20
21
22

ENTRYPOINTS

24       The  antivirus_t  SELinux  type can be entered via the antivirus_exec_t
25       file type.
26
27       The default entrypoint paths for the antivirus_t domain are the follow‐
28       ing:
29
30       /usr/sbin/amavisd.*,  /usr/sbin/amavi,  /usr/sbin/clamd, /usr/bin/clam‐
31       scan, /usr/bin/clamdscan, /usr/bin/freshclam,  /usr/sbin/clamav-milter,
32       /usr/lib/AntiVir/antivir
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       antivirus  policy  is  very  flexible allowing users to setup their an‐
42       tivirus processes in as secure a method as possible.
43
44       The following process types are defined for antivirus:
45
46       antivirus_t
47
48       Note: semanage permissive -a  antivirus_t  can  be  used  to  make  the
49       process  type  antivirus_t  permissive. SELinux does not deny access to
50       permissive process types, but the AVC (SELinux  denials)  messages  are
51       still generated.
52
53

BOOLEANS

55       SELinux  policy  is  customizable  based on least access required.  an‐
56       tivirus policy is extremely flexible and has several booleans that  al‐
57       low  you  to  manipulate the policy and run antivirus with the tightest
58       access possible.
59
60
61
62       If you want to determine whether antivirus programs can  use  JIT  com‐
63       piler,  you must turn on the antivirus_use_jit boolean. Disabled by de‐
64       fault.
65
66       setsebool -P antivirus_use_jit 1
67
68
69
70       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
71       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
72       Enabled by default.
73
74       setsebool -P daemons_dontaudit_scheduling 1
75
76
77
78       If you want to allow all domains to execute in fips_mode, you must turn
79       on the fips_mode boolean. Enabled by default.
80
81       setsebool -P fips_mode 1
82
83
84
85       If  you  want  to  allow  system  to run with NIS, you must turn on the
86       nis_enabled boolean. Disabled by default.
87
88       setsebool -P nis_enabled 1
89
90
91

NSSWITCH DOMAIN

93       If you want to allow users to resolve user passwd entries directly from
94       ldap rather then using a sssd server for the antivirus_t, you must turn
95       on the authlogin_nsswitch_use_ldap boolean.
96
97       setsebool -P authlogin_nsswitch_use_ldap 1
98
99
100       If you want to allow confined applications to run with kerberos for the
101       antivirus_t, you must turn on the kerberos_enabled boolean.
102
103       setsebool -P kerberos_enabled 1
104
105

MANAGED FILES

107       The  SELinux process type antivirus_t can manage files labeled with the
108       following file types.  The paths listed are the default paths for these
109       file types.  Note the processes UID still need to have DAC permissions.
110
111       antivirus_db_t
112
113            /var/amavis(/.*)?
114            /var/clamav(/.*)?
115            /var/lib/clamd.*
116            /var/lib/amavis(/.*)?
117            /var/lib/clamav(/.*)?
118            /var/virusmails(/.*)?
119            /var/opt/f-secure(/.*)?
120            /var/spool/amavisd(/.*)?
121            /var/lib/clamav-unofficial-sigs(/.*)?
122
123       antivirus_home_t
124
125
126       antivirus_log_t
127
128            /var/log/clamd.*
129            /var/log/clamav.*
130            /var/log/freshclam.*
131            /var/log/amavisd.log.*
132            /var/log/clamav/freshclam.*
133
134       antivirus_tmp_t
135
136
137       antivirus_var_run_t
138
139            /var/run/clamd.*
140            /var/run/clamav.*
141            /var/run/amavis(d)?(/.*)?
142            /var/run/amavis(d)?/clamd.pid
143            /var/run/amavisd-snmp-subagent.pid
144
145       cluster_conf_t
146
147            /etc/cluster(/.*)?
148
149       cluster_var_lib_t
150
151            /var/lib/pcsd(/.*)?
152            /var/lib/cluster(/.*)?
153            /var/lib/openais(/.*)?
154            /var/lib/pengine(/.*)?
155            /var/lib/corosync(/.*)?
156            /usr/lib/heartbeat(/.*)?
157            /var/lib/heartbeat(/.*)?
158            /var/lib/pacemaker(/.*)?
159
160       cluster_var_run_t
161
162            /var/run/crm(/.*)?
163            /var/run/cman_.*
164            /var/run/rsctmp(/.*)?
165            /var/run/aisexec.*
166            /var/run/heartbeat(/.*)?
167            /var/run/pcsd-ruby.socket
168            /var/run/corosync-qnetd(/.*)?
169            /var/run/corosync-qdevice(/.*)?
170            /var/run/corosync.pid
171            /var/run/cpglockd.pid
172            /var/run/rgmanager.pid
173            /var/run/cluster/rgmanager.sk
174
175       krb5_host_rcache_t
176
177            /var/tmp/krb5_0.rcache2
178            /var/cache/krb5rcache(/.*)?
179            /var/tmp/nfs_0
180            /var/tmp/DNS_25
181            /var/tmp/host_0
182            /var/tmp/imap_0
183            /var/tmp/HTTP_23
184            /var/tmp/HTTP_48
185            /var/tmp/ldap_55
186            /var/tmp/ldap_487
187            /var/tmp/ldapmap1_0
188
189       root_t
190
191            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
192            /
193            /initrd
194
195       snmpd_var_lib_t
196
197            /var/agentx(/.*)?
198            /var/net-snmp(/.*)
199            /var/lib/snmp(/.*)?
200            /var/net-snmp(/.*)?
201            /var/lib/net-snmp(/.*)?
202            /var/spool/snmptt(/.*)?
203            /usr/share/snmp/mibs/.index
204
205       systemd_passwd_var_run_t
206
207            /var/run/systemd/ask-password(/.*)?
208            /var/run/systemd/ask-password-block(/.*)?
209
210

FILE CONTEXTS

212       SELinux requires files to have an extended attribute to define the file
213       type.
214
215       You can see the context of a file using the -Z option to ls
216
217       Policy governs the access  confined  processes  have  to  these  files.
218       SELinux antivirus policy is very flexible allowing users to setup their
219       antivirus processes in as secure a method as possible.
220
221       EQUIVALENCE DIRECTORIES
222
223
224       antivirus policy stores data with multiple different file context types
225       under  the  /var/lib/clamav  directory.  If you would like to store the
226       data in a different directory you can use the semanage command to  cre‐
227       ate an equivalence mapping.  If you wanted to store this data under the
228       /srv directory you would execute the following command:
229
230       semanage fcontext -a -e /var/lib/clamav /srv/clamav
231       restorecon -R -v /srv/clamav
232
233       antivirus policy stores data with multiple different file context types
234       under  the  /var/run/amavis(d)?  directory.  If you would like to store
235       the data in a different directory you can use the semanage  command  to
236       create  an equivalence mapping.  If you wanted to store this data under
237       the /srv directory you would execute the following command:
238
239       semanage fcontext -a -e /var/run/amavis(d)? /srv/amavis(d)?
240       restorecon -R -v /srv/amavis(d)?
241
242       STANDARD FILE CONTEXT
243
244       SELinux defines the file context types for the antivirus, if you wanted
245       to  store files with these types in a different paths, you need to exe‐
246       cute the semanage command to specify alternate labeling  and  then  use
247       restorecon to put the labels on disk.
248
249       semanage fcontext -a -t antivirus_exec_t '/srv/antivirus/content(/.*)?'
250       restorecon -R -v /srv/myantivirus_content
251
252       Note:  SELinux  often  uses  regular expressions to specify labels that
253       match multiple files.
254
255       The following file types are defined for antivirus:
256
257
258
259       antivirus_conf_t
260
261       - Set files with the antivirus_conf_t type, if you want  to  treat  the
262       files  as  antivirus  configuration data, usually stored under the /etc
263       directory.
264
265
266       Paths:
267            /etc/amavis(d)?.conf, /etc/amavisd(/.*)?
268
269
270       antivirus_db_t
271
272       - Set files with the antivirus_db_t type, if  you  want  to  treat  the
273       files as antivirus database content.
274
275
276       Paths:
277            /var/amavis(/.*)?,       /var/clamav(/.*)?,      /var/lib/clamd.*,
278            /var/lib/amavis(/.*)?,     /var/lib/clamav(/.*)?,      /var/virus‐
279            mails(/.*)?,   /var/opt/f-secure(/.*)?,  /var/spool/amavisd(/.*)?,
280            /var/lib/clamav-unofficial-sigs(/.*)?
281
282
283       antivirus_exec_t
284
285       - Set files with the antivirus_exec_t type, if you want  to  transition
286       an executable to the antivirus_t domain.
287
288
289       Paths:
290            /usr/sbin/amavisd.*,       /usr/sbin/amavi,       /usr/sbin/clamd,
291            /usr/bin/clamscan,     /usr/bin/clamdscan,     /usr/bin/freshclam,
292            /usr/sbin/clamav-milter, /usr/lib/AntiVir/antivir
293
294
295       antivirus_home_t
296
297       -  Set  files  with the antivirus_home_t type, if you want to store an‐
298       tivirus files in the users home directory.
299
300
301
302       antivirus_initrc_exec_t
303
304       - Set files with the antivirus_initrc_exec_t type, if you want to tran‐
305       sition an executable to the antivirus_initrc_t domain.
306
307
308       Paths:
309            /etc/rc.d/init.d/clamd.*,                 /etc/rc.d/init.d/amavis,
310            /etc/rc.d/init.d/amavisd-snmp
311
312
313       antivirus_log_t
314
315       - Set files with the antivirus_log_t type, if you  want  to  treat  the
316       data  as  antivirus  log data, usually stored under the /var/log direc‐
317       tory.
318
319
320       Paths:
321            /var/log/clamd.*,     /var/log/clamav.*,     /var/log/freshclam.*,
322            /var/log/amavisd.log.*, /var/log/clamav/freshclam.*
323
324
325       antivirus_tmp_t
326
327       -  Set  files  with  the antivirus_tmp_t type, if you want to store an‐
328       tivirus temporary files in the /tmp directories.
329
330
331
332       antivirus_unit_file_t
333
334       - Set files with the antivirus_unit_file_t type, if you want  to  treat
335       the files as antivirus unit content.
336
337
338       Paths:
339            /usr/lib/systemd/system/clamd.*,     /usr/lib/systemd/system/amav‐
340            isd.*, /usr/lib/systemd/system/mimedefang.service
341
342
343       antivirus_var_run_t
344
345       - Set files with the antivirus_var_run_t type, if you want to store the
346       antivirus files under the /run or /var/run directory.
347
348
349       Paths:
350            /var/run/clamd.*,   /var/run/clamav.*,  /var/run/amavis(d)?(/.*)?,
351            /var/run/amavis(d)?/clamd.pid, /var/run/amavisd-snmp-subagent.pid
352
353
354       Note: File context can be temporarily modified with the chcon  command.
355       If  you want to permanently change the file context you need to use the
356       semanage fcontext command.  This will modify the SELinux labeling data‐
357       base.  You will need to use restorecon to apply the labels.
358
359

COMMANDS

361       semanage  fcontext  can also be used to manipulate default file context
362       mappings.
363
364       semanage permissive can also be used to manipulate  whether  or  not  a
365       process type is permissive.
366
367       semanage  module can also be used to enable/disable/install/remove pol‐
368       icy modules.
369
370       semanage boolean can also be used to manipulate the booleans
371
372
373       system-config-selinux is a GUI tool available to customize SELinux pol‐
374       icy settings.
375
376

AUTHOR

378       This manual page was auto-generated using sepolicy manpage .
379
380