1cockpit_session_selinux(8S)ELinux Policy cockpit_sessiocnockpit_session_selinux(8)
2
3
4

NAME

6       cockpit_session_selinux  - Security Enhanced Linux Policy for the cock‐
7       pit_session processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the cockpit_session processes via flex‐
11       ible mandatory access control.
12
13       The   cockpit_session  processes  execute  with  the  cockpit_session_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep cockpit_session_t
20
21
22

ENTRYPOINTS

24       The  cockpit_session_t SELinux type can be entered via the cockpit_ses‐
25       sion_exec_t file type.
26
27       The default entrypoint paths for the cockpit_session_t domain  are  the
28       following:
29
30       /usr/libexec/cockpit-ssh, /usr/libexec/cockpit-session
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       cockpit_session  policy  is very flexible allowing users to setup their
40       cockpit_session processes in as secure a method as possible.
41
42       The following process types are defined for cockpit_session:
43
44       cockpit_session_t
45
46       Note: semanage permissive -a cockpit_session_t can be used to make  the
47       process type cockpit_session_t permissive. SELinux does not deny access
48       to permissive process types, but the AVC (SELinux denials) messages are
49       still generated.
50
51

BOOLEANS

53       SELinux  policy  is customizable based on least access required.  cock‐
54       pit_session policy is extremely flexible and has several booleans  that
55       allow  you  to  manipulate  the policy and run cockpit_session with the
56       tightest access possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66
67       If  you  want  to allow confined applications to run with kerberos, you
68       must turn on the kerberos_enabled boolean. Enabled by default.
69
70       setsebool -P kerberos_enabled 1
71
72
73
74       If you want to allow system to run with  NIS,  you  must  turn  on  the
75       nis_enabled boolean. Disabled by default.
76
77       setsebool -P nis_enabled 1
78
79
80
81       If you want to enable polyinstantiated directory support, you must turn
82       on the polyinstantiation_enabled boolean. Disabled by default.
83
84       setsebool -P polyinstantiation_enabled 1
85
86
87

MANAGED FILES

89       The SELinux process type cockpit_session_t  can  manage  files  labeled
90       with  the following file types.  The paths listed are the default paths
91       for these file types.  Note the processes UID still need  to  have  DAC
92       permissions.
93
94       auth_cache_t
95
96            /var/cache/coolkey(/.*)?
97
98       auth_home_t
99
100            /root/.yubico(/.*)?
101            /root/.config/Yubico(/.*)?
102            /root/.google_authenticator
103            /root/.google_authenticator~
104            /home/[^/]+/.yubico(/.*)?
105            /home/[^/]+/.config/Yubico(/.*)?
106            /home/[^/]+/.google_authenticator
107            /home/[^/]+/.google_authenticator~
108
109       faillog_t
110
111            /var/log/btmp.*
112            /var/log/faillog.*
113            /var/log/tallylog.*
114            /var/run/faillock(/.*)?
115
116       initrc_var_run_t
117
118            /var/run/utmp
119            /var/run/random-seed
120            /var/run/runlevel.dir
121            /var/run/setmixer_flag
122
123       lastlog_t
124
125            /var/log/lastlog.*
126
127       pam_var_run_t
128
129            /var/(db|adm)/sudo(/.*)?
130            /var/lib/sudo(/.*)?
131            /var/run/sudo(/.*)?
132            /var/run/pam_ssh(/.*)?
133            /var/run/sepermit(/.*)?
134            /var/run/pam_mount(/.*)?
135            /var/run/pam_timestamp(/.*)?
136
137       security_t
138
139            /selinux
140
141       shadow_t
142
143            /etc/shadow.*
144            /etc/gshadow.*
145            /etc/nshadow.*
146            /var/db/shadow.*
147            /etc/security/opasswd
148            /etc/security/opasswd.old
149
150       var_auth_t
151
152            /var/ace(/.*)?
153            /var/rsa(/.*)?
154            /var/lib/abl(/.*)?
155            /var/lib/rsa(/.*)?
156            /var/lib/pam_ssh(/.*)?
157            /var/lib/pam_shield(/.*)?
158            /var/opt/quest/vas/vasd(/.*)?
159            /var/lib/google-authenticator(/.*)?
160
161       wtmp_t
162
163            /var/log/wtmp.*
164
165

FILE CONTEXTS

167       SELinux requires files to have an extended attribute to define the file
168       type.
169
170       You can see the context of a file using the -Z option to ls
171
172       Policy governs the access  confined  processes  have  to  these  files.
173       SELinux cockpit_session policy is very flexible allowing users to setup
174       their cockpit_session processes in as secure a method as possible.
175
176       The following file types are defined for cockpit_session:
177
178
179
180       cockpit_session_exec_t
181
182       - Set files with the cockpit_session_exec_t type, if you want to  tran‐
183       sition an executable to the cockpit_session_t domain.
184
185
186       Paths:
187            /usr/libexec/cockpit-ssh, /usr/libexec/cockpit-session
188
189
190       Note:  File context can be temporarily modified with the chcon command.
191       If you want to permanently change the file context you need to use  the
192       semanage fcontext command.  This will modify the SELinux labeling data‐
193       base.  You will need to use restorecon to apply the labels.
194
195

COMMANDS

197       semanage fcontext can also be used to manipulate default  file  context
198       mappings.
199
200       semanage  permissive  can  also  be used to manipulate whether or not a
201       process type is permissive.
202
203       semanage module can also be used to enable/disable/install/remove  pol‐
204       icy modules.
205
206       semanage boolean can also be used to manipulate the booleans
207
208
209       system-config-selinux is a GUI tool available to customize SELinux pol‐
210       icy settings.
211
212

AUTHOR

214       This manual page was auto-generated using sepolicy manpage .
215
216

SEE ALSO

218       selinux(8), cockpit_session(8), semanage(8),  restorecon(8),  chcon(1),
219       sepolicy(8), setsebool(8)
220
221
222
223cockpit_session                    21-04-16         cockpit_session_selinux(8)
Impressum