1cupsd_config_selinux(8) SELinux Policy cupsd_config cupsd_config_selinux(8)
2
6 cupsd_config_selinux - Security Enhanced Linux Policy for the
7 cupsd_config processes
8
10 Security-Enhanced Linux secures the cupsd_config processes via flexible
11 mandatory access control.
12 The cupsd_config processes execute with the cupsd_config_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep cupsd_config_t
20
24 The cupsd_config_t SELinux type can be entered via the cupsd_con‐
25 fig_exec_t file type.
26 The default entrypoint paths for the cupsd_config_t domain are the fol‐
28 lowing:
29 /usr/sbin/hal_lpadmin, /usr/libexec/hal_lpadmin, /usr/bin/cups-config-
31 daemon, /usr/sbin/printconf-backend, /usr/lib/udev/udev-configure-
32 printer, /usr/libexec/cups-pk-helper-mechanism
33
35 SELinux defines process types (domains) for each process running on the
36 system
37 You can see the context of a process using the -Z option to ps
39 Policy governs the access confined processes have to files. SELinux
41 cupsd_config policy is very flexible allowing users to setup their
42 cupsd_config processes in as secure a method as possible.
43 The following process types are defined for cupsd_config:
45 cupsd_config_t
47 Note: semanage permissive -a cupsd_config_t can be used to make the
49 process type cupsd_config_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
55 SELinux policy is customizable based on least access required.
56 cupsd_config policy is extremely flexible and has several booleans that
57 allow you to manipulate the policy and run cupsd_config with the tight‐
58 est access possible.
59 If you want to allow cups execmem/execstack, you must turn on the
63 cups_execmem boolean. Disabled by default.
64 setsebool -P cups_execmem 1
66 If you want to dontaudit all daemons scheduling requests (setsched,
70 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
71 Enabled by default.
72 setsebool -P daemons_dontaudit_scheduling 1
74 If you want to allow all domains to execute in fips_mode, you must turn
78 on the fips_mode boolean. Enabled by default.
79 setsebool -P fips_mode 1
81 If you want to allow system to run with NIS, you must turn on the
85 nis_enabled boolean. Disabled by default.
86 setsebool -P nis_enabled 1
88
92 The SELinux process type cupsd_config_t can manage files labeled with
93 the following file types. The paths listed are the default paths for
94 these file types. Note the processes UID still need to have DAC per‐
95 missions.
96 cluster_conf_t
98 /etc/cluster(/.*)?
100 cluster_var_lib_t
102 /var/lib/pcsd(/.*)?
104 /var/lib/cluster(/.*)?
105 /var/lib/openais(/.*)?
106 /var/lib/pengine(/.*)?
107 /var/lib/corosync(/.*)?
108 /usr/lib/heartbeat(/.*)?
109 /var/lib/heartbeat(/.*)?
110 /var/lib/pacemaker(/.*)?
111 cluster_var_run_t
113 /var/run/crm(/.*)?
115 /var/run/cman_.*
116 /var/run/rsctmp(/.*)?
117 /var/run/aisexec.*
118 /var/run/heartbeat(/.*)?
119 /var/run/pcsd-ruby.socket
120 /var/run/corosync-qnetd(/.*)?
121 /var/run/corosync-qdevice(/.*)?
122 /var/run/corosync.pid
123 /var/run/cpglockd.pid
124 /var/run/rgmanager.pid
125 /var/run/cluster/rgmanager.sk
126 cupsd_config_var_run_t
128 /var/run/udev-configure-printer(/.*)?
130 cupsd_etc_t
132 /etc/hp(/.*)?
134 /etc/cups(/.*)?
135 /usr/share/cups(/.*)?
136 cupsd_rw_etc_t
138 /etc/printcap.*
140 /etc/cups/ppd(/.*)?
141 /usr/Brother/(.*/)?inf(/.*)?
142 /usr/Printer/(.*/)?inf(/.*)?
143 /usr/lib/bjlib(/.*)?
144 /var/lib/iscan(/.*)?
145 /var/cache/cups(/.*)?
146 /etc/cups/certs/.*
147 /etc/opt/Brother/(.*/)?inf(/.*)?
148 /etc/cups/lpoptions.*
149 /var/cache/foomatic(/.*)?
150 /usr/local/Brother/(.*/)?inf(/.*)?
151 /usr/local/Printer/(.*/)?inf(/.*)?
152 /etc/cups/cupsd.conf.*
153 /var/lib/cups/certs/.*
154 /opt/gutenprint/ppds(/.*)?
155 /opt/brother/Printers(.*/)?inf(/.*)?
156 /etc/cups/classes.conf.*
157 /etc/cups/printers.conf.*
158 /etc/cups/subscriptions.*
159 /etc/opt/brother/Printers/(.*/)?inf(/.*)?
160 /usr/local/linuxprinter/ppd(/.*)?
161 /var/cache/alchemist/printconf.*
162 /etc/alchemist/namespace/printconf(/.*)?
163 /etc/cups/certs
164 /etc/cups/ppds.dat
165 /var/lib/cups/certs
166 /usr/share/foomatic/db/oldprinterids
167 cupsd_tmp_t
169 krb5_host_rcache_t
172 /var/tmp/krb5_0.rcache2
174 /var/cache/krb5rcache(/.*)?
175 /var/tmp/nfs_0
176 /var/tmp/DNS_25
177 /var/tmp/host_0
178 /var/tmp/imap_0
179 /var/tmp/HTTP_23
180 /var/tmp/HTTP_48
181 /var/tmp/ldap_55
182 /var/tmp/ldap_487
183 /var/tmp/ldapmap1_0
184 print_spool_t
186 /var/spool/lpd(/.*)?
188 /var/spool/cups(/.*)?
189 /var/spool/cups-pdf(/.*)?
190 root_t
192 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
194 /
195 /initrd
196
199 SELinux requires files to have an extended attribute to define the file
200 type.
201 You can see the context of a file using the -Z option to ls
203 Policy governs the access confined processes have to these files.
205 SELinux cupsd_config policy is very flexible allowing users to setup
206 their cupsd_config processes in as secure a method as possible.
207 STANDARD FILE CONTEXT
209 SELinux defines the file context types for the cupsd_config, if you
211 wanted to store files with these types in a different paths, you need
212 to execute the semanage command to specify alternate labeling and then
213 use restorecon to put the labels on disk.
214 semanage fcontext -a -t cupsd_config_exec_t '/srv/cupsd_config/con‐
216 tent(/.*)?'
217 restorecon -R -v /srv/mycupsd_config_content
218 Note: SELinux often uses regular expressions to specify labels that
220 match multiple files.
221 The following file types are defined for cupsd_config:
223 cupsd_config_exec_t
227 - Set files with the cupsd_config_exec_t type, if you want to transi‐
229 tion an executable to the cupsd_config_t domain.
230 Paths:
233 /usr/sbin/hal_lpadmin, /usr/libexec/hal_lpadmin, /usr/bin/cups-
234 config-daemon, /usr/sbin/printconf-backend, /usr/lib/udev/udev-
235 configure-printer, /usr/libexec/cups-pk-helper-mechanism
236 cupsd_config_var_run_t
239 - Set files with the cupsd_config_var_run_t type, if you want to store
241 the cupsd config files under the /run or /var/run directory.
242 Note: File context can be temporarily modified with the chcon command.
246 If you want to permanently change the file context you need to use the
247 semanage fcontext command. This will modify the SELinux labeling data‐
248 base. You will need to use restorecon to apply the labels.
249
252 semanage fcontext can also be used to manipulate default file context
253 mappings.
254 semanage permissive can also be used to manipulate whether or not a
256 process type is permissive.
257 semanage module can also be used to enable/disable/install/remove pol‐
259 icy modules.
260 semanage boolean can also be used to manipulate the booleans
262 system-config-selinux is a GUI tool available to customize SELinux pol‐
265 icy settings.
266
269 This manual page was auto-generated using sepolicy manpage .
270
273 selinux(8), cupsd_config(8), semanage(8), restorecon(8), chcon(1), se‐
274 policy(8), setsebool(8)
275cupsd_config 23-10-20 cupsd_config_selinux(8)