1gpg_web_selinux(8)          SELinux Policy gpg_web          gpg_web_selinux(8)
2
3
4

NAME

6       gpg_web_selinux  -  Security Enhanced Linux Policy for the gpg_web pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  gpg_web  processes  via  flexible
11       mandatory access control.
12
13       The  gpg_web processes execute with the gpg_web_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep gpg_web_t
20
21
22

ENTRYPOINTS

24       The gpg_web_t SELinux type can be entered via the gpg_exec_t file type.
25
26       The  default  entrypoint paths for the gpg_web_t domain are the follow‐
27       ing:
28
29       /usr/bin/gpg(2)?, /usr/lib/gnupg/.*, /usr/bin/gpgsm
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       gpg_web policy is very flexible allowing users to setup  their  gpg_web
39       processes in as secure a method as possible.
40
41       The following process types are defined for gpg_web:
42
43       gpg_web_t
44
45       Note:  semanage permissive -a gpg_web_t can be used to make the process
46       type gpg_web_t permissive. SELinux does not deny access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.  gpg_web
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run gpg_web with the tightest  access  possi‐
55       ble.
56
57
58
59       If you want to allow all domains to execute in fips_mode, you must turn
60       on the fips_mode boolean. Enabled by default.
61
62       setsebool -P fips_mode 1
63
64
65
66       If you want to allow httpd cgi support, you must turn on the  httpd_en‐
67       able_cgi boolean. Enabled by default.
68
69       setsebool -P httpd_enable_cgi 1
70
71
72
73       If  you  want  to  allow  httpd  to  run  gpg,  you  must  turn  on the
74       httpd_use_gpg boolean. Disabled by default.
75
76       setsebool -P httpd_use_gpg 1
77
78
79

MANAGED FILES

81       The SELinux process type gpg_web_t can manage files  labeled  with  the
82       following file types.  The paths listed are the default paths for these
83       file types.  Note the processes UID still need to have DAC permissions.
84
85       httpd_sys_rw_content_t
86
87            /etc/rt(/.*)?
88            /etc/glpi(/.*)?
89            /etc/horde(/.*)?
90            /etc/drupal.*
91            /etc/z-push(/.*)?
92            /var/lib/svn(/.*)?
93            /var/www/svn(/.*)?
94            /etc/owncloud(/.*)?
95            /var/www/html(/.*)?/uploads(/.*)?
96            /var/www/html(/.*)?/wp-content(/.*)?
97            /var/www/html(/.*)?/wp_backups(/.*)?
98            /var/www/html(/.*)?/sites/default/files(/.*)?
99            /var/www/html(/.*)?/sites/default/settings.php
100            /etc/mock/koji(/.*)?
101            /etc/nextcloud(/.*)?
102            /var/lib/drupal.*
103            /etc/zabbix/web(/.*)?
104            /var/lib/moodle(/.*)?
105            /var/log/z-push(/.*)?
106            /var/spool/gosa(/.*)?
107            /etc/WebCalendar(/.*)?
108            /usr/share/joomla(/.*)?
109            /var/lib/dokuwiki(/.*)?
110            /var/lib/httpd/md(/.*)?
111            /var/lib/owncloud(/.*)?
112            /var/spool/viewvc(/.*)?
113            /var/lib/nextcloud(/.*)?
114            /var/lib/pootle/po(/.*)?
115            /var/lib/phpMyAdmin(/.*)?
116            /var/www/moodledata(/.*)?
117            /srv/gallery2/smarty(/.*)?
118            /var/www/moodle/data(/.*)?
119            /var/lib/graphite-web(/.*)?
120            /var/log/shibboleth-www(/.*)?
121            /var/www/gallery/albums(/.*)?
122            /var/www/html/owncloud/data(/.*)?
123            /var/www/html/nextcloud/data(/.*)?
124            /usr/share/wordpress-mu/wp-content(/.*)?
125            /usr/share/wordpress/wp-content/upgrade(/.*)?
126            /usr/share/wordpress/wp-content/uploads(/.*)?
127            /var/www/html/configuration.php
128
129       public_content_rw_t
130
131            /var/spool/abrt-upload(/.*)?
132
133

SHARING FILES

135       If you want to share files with multiple domains (Apache,  FTP,  rsync,
136       Samba),  you can set a file context of public_content_t and public_con‐
137       tent_rw_t.  These context allow any of the above domains  to  read  the
138       content.   If  you want a particular domain to write to the public_con‐
139       tent_rw_t domain, you must set the appropriate boolean.
140
141       Allow gpg_web servers to read the /var/gpg_web directory by adding  the
142       public_content_t  file  type to the directory and by restoring the file
143       type.
144
145       semanage fcontext -a -t public_content_t "/var/gpg_web(/.*)?"
146       restorecon -F -R -v /var/gpg_web
147
148       Allow gpg_web servers to read and write /var/gpg_web/incoming by adding
149       the public_content_rw_t type to the directory and by restoring the file
150       type.  You also need to turn on the gpg_web_anon_write boolean.
151
152       semanage  fcontext  -a  -t   public_content_rw_t   "/var/gpg_web/incom‐
153       ing(/.*)?"
154       restorecon -F -R -v /var/gpg_web/incoming
155       setsebool -P gpg_web_anon_write 1
156
157
158       If  you  want  to  allow gpg web domain to modify public files used for
159       public file transfer services., you must turn on the gpg_web_anon_write
160       boolean.
161
162       setsebool -P gpg_web_anon_write 1
163
164

COMMANDS

166       semanage  fcontext  can also be used to manipulate default file context
167       mappings.
168
169       semanage permissive can also be used to manipulate  whether  or  not  a
170       process type is permissive.
171
172       semanage  module can also be used to enable/disable/install/remove pol‐
173       icy modules.
174
175       semanage boolean can also be used to manipulate the booleans
176
177
178       system-config-selinux is a GUI tool available to customize SELinux pol‐
179       icy settings.
180
181

AUTHOR

183       This manual page was auto-generated using sepolicy manpage .
184
185

SEE ALSO

187       selinux(8),  gpg_web(8),  semanage(8),  restorecon(8), chcon(1), sepol‐
188       icy(8), setsebool(8)
189
190
191
192gpg_web                            23-10-20                 gpg_web_selinux(8)
Impressum