fdo_ssh_selinux(8)

1fdo_ssh_selinux(8)          SELinux Policy fdo_ssh          fdo_ssh_selinux(8)
2
3
4

NAME

6       fdo_ssh_selinux  -  Security Enhanced Linux Policy for the fdo_ssh pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  fdo_ssh  processes  via  flexible
11       mandatory access control.
12
13       The  fdo_ssh processes execute with the fdo_ssh_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep fdo_ssh_t
20
21
22

ENTRYPOINTS

24       The fdo_ssh_t SELinux type can be entered via the ssh_exec_t file type.
25
26       The  default  entrypoint paths for the fdo_ssh_t domain are the follow‐
27       ing:
28
29       /usr/bin/ssh, /usr/libexec/nm-ssh-service
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       fdo_ssh policy is very flexible allowing users to setup  their  fdo_ssh
39       processes in as secure a method as possible.
40
41       The following process types are defined for fdo_ssh:
42
43       fdo_ssh_t
44
45       Note:  semanage permissive -a fdo_ssh_t can be used to make the process
46       type fdo_ssh_t permissive. SELinux does not deny access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.  fdo_ssh
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run fdo_ssh with the tightest  access  possi‐
55       ble.
56
57
58
59       If you want to allow all domains to execute in fips_mode, you must turn
60       on the fips_mode boolean. Enabled by default.
61
62       setsebool -P fips_mode 1
63
64
65
66       If you want to allow system to run with  NIS,  you  must  turn  on  the
67       nis_enabled boolean. Disabled by default.
68
69       setsebool -P nis_enabled 1
70
71
72

MANAGED FILES

74       The  SELinux  process  type fdo_ssh_t can manage files labeled with the
75       following file types.  The paths listed are the default paths for these
76       file types.  Note the processes UID still need to have DAC permissions.
77
78       krb5_host_rcache_t
79
80            /var/tmp/krb5_0.rcache2
81            /var/cache/krb5rcache(/.*)?
82            /var/tmp/nfs_0
83            /var/tmp/DNS_25
84            /var/tmp/host_0
85            /var/tmp/imap_0
86            /var/tmp/HTTP_23
87            /var/tmp/HTTP_48
88            /var/tmp/ldap_55
89            /var/tmp/ldap_487
90            /var/tmp/ldapmap1_0
91
92       ssh_home_t
93
94            /var/lib/[^/]+/.ssh(/.*)?
95            /root/.ssh(/.*)?
96            /var/lib/one/.ssh(/.*)?
97            /var/lib/pgsql/.ssh(/.*)?
98            /var/lib/openshift/[^/]+/.ssh(/.*)?
99            /var/lib/amanda/.ssh(/.*)?
100            /var/lib/stickshift/[^/]+/.ssh(/.*)?
101            /var/lib/gitolite/.ssh(/.*)?
102            /var/lib/nocpulse/.ssh(/.*)?
103            /var/lib/gitolite3/.ssh(/.*)?
104            /var/lib/openshift/gear/[^/]+/.ssh(/.*)?
105            /root/.shosts
106            /home/[^/]+/.ssh(/.*)?
107            /home/[^/]+/.ansible/cp/.*
108            /home/[^/]+/.shosts
109
110

COMMANDS

112       semanage  fcontext  can also be used to manipulate default file context
113       mappings.
114
115       semanage permissive can also be used to manipulate  whether  or  not  a
116       process type is permissive.
117
118       semanage  module can also be used to enable/disable/install/remove pol‐
119       icy modules.
120
121       semanage boolean can also be used to manipulate the booleans
122
123
124       system-config-selinux is a GUI tool available to customize SELinux pol‐
125       icy settings.
126
127

AUTHOR

129       This manual page was auto-generated using sepolicy manpage .
130
131