greylist_milter_selinux(8)

1greylist_milter_selinux(8S)ELinux Policy greylist_miltegrreylist_milter_selinux(8)
2
3
4

NAME

6       greylist_milter_selinux  -  Security  Enhanced  Linux  Policy  for  the
7       greylist_milter processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the greylist_milter processes via flex‐
11       ible mandatory access control.
12
13       The   greylist_milter  processes  execute  with  the  greylist_milter_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep greylist_milter_t
20
21
22

ENTRYPOINTS

24       The greylist_milter_t SELinux type can be entered via the greylist_mil‐
25       ter_exec_t file type.
26
27       The default entrypoint paths for the greylist_milter_t domain  are  the
28       following:
29
30       /usr/sbin/sqlgrey, /usr/sbin/milter-greylist
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       greylist_milter  policy  is very flexible allowing users to setup their
40       greylist_milter processes in as secure a method as possible.
41
42       The following process types are defined for greylist_milter:
43
44       greylist_milter_t
45
46       Note: semanage permissive -a greylist_milter_t can be used to make  the
47       process type greylist_milter_t permissive. SELinux does not deny access
48       to permissive process types, but the AVC (SELinux denials) messages are
49       still generated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       greylist_milter policy is extremely flexible and has  several  booleans
55       that  allow  you  to manipulate the policy and run greylist_milter with
56       the tightest access possible.
57
58
59
60       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
61       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
62       Enabled by default.
63
64       setsebool -P daemons_dontaudit_scheduling 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to  allow  system  to run with NIS, you must turn on the
76       nis_enabled boolean. Disabled by default.
77
78       setsebool -P nis_enabled 1
79
80
81

MANAGED FILES

83       The SELinux process type greylist_milter_t  can  manage  files  labeled
84       with  the following file types.  The paths listed are the default paths
85       for these file types.  Note the processes UID still need  to  have  DAC
86       permissions.
87
88       cluster_conf_t
89
90            /etc/cluster(/.*)?
91
92       cluster_var_lib_t
93
94            /var/lib/pcsd(/.*)?
95            /var/lib/cluster(/.*)?
96            /var/lib/openais(/.*)?
97            /var/lib/pengine(/.*)?
98            /var/lib/corosync(/.*)?
99            /usr/lib/heartbeat(/.*)?
100            /var/lib/heartbeat(/.*)?
101            /var/lib/pacemaker(/.*)?
102
103       cluster_var_run_t
104
105            /var/run/crm(/.*)?
106            /var/run/cman_.*
107            /var/run/rsctmp(/.*)?
108            /var/run/aisexec.*
109            /var/run/heartbeat(/.*)?
110            /var/run/pcsd-ruby.socket
111            /var/run/corosync-qnetd(/.*)?
112            /var/run/corosync-qdevice(/.*)?
113            /var/run/corosync.pid
114            /var/run/cpglockd.pid
115            /var/run/rgmanager.pid
116            /var/run/cluster/rgmanager.sk
117
118       greylist_milter_data_t
119
120            /var/lib/sqlgrey(/.*)?
121            /var/lib/milter-greylist(/.*)?
122            /var/run/milter-greylist(/.*)?
123            /var/run/sqlgrey.pid
124            /var/run/milter-greylist.pid
125
126       krb5_host_rcache_t
127
128            /var/tmp/krb5_0.rcache2
129            /var/cache/krb5rcache(/.*)?
130            /var/tmp/nfs_0
131            /var/tmp/DNS_25
132            /var/tmp/host_0
133            /var/tmp/imap_0
134            /var/tmp/HTTP_23
135            /var/tmp/HTTP_48
136            /var/tmp/ldap_55
137            /var/tmp/ldap_487
138            /var/tmp/ldapmap1_0
139
140       root_t
141
142            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
143            /
144            /initrd
145
146

FILE CONTEXTS

148       SELinux requires files to have an extended attribute to define the file
149       type.
150
151       You can see the context of a file using the -Z option to ls
152
153       Policy governs the access  confined  processes  have  to  these  files.
154       SELinux greylist_milter policy is very flexible allowing users to setup
155       their greylist_milter processes in as secure a method as possible.
156
157       EQUIVALENCE DIRECTORIES
158
159
160       greylist_milter policy stores data with multiple different file context
161       types  under the /var/run/milter-greylist directory.  If you would like
162       to store the data in a different directory you  can  use  the  semanage
163       command  to create an equivalence mapping.  If you wanted to store this
164       data under the /srv directory you would execute the following command:
165
166       semanage fcontext -a -e /var/run/milter-greylist /srv/milter-greylist
167       restorecon -R -v /srv/milter-greylist
168
169       STANDARD FILE CONTEXT
170
171       SELinux defines the file context types for the greylist_milter, if  you
172       wanted  to  store files with these types in a different paths, you need
173       to execute the semanage command to specify alternate labeling and  then
174       use restorecon to put the labels on disk.
175
176       semanage  fcontext  -a  -t  greylist_milter_exec_t  '/srv/greylist_mil‐
177       ter/content(/.*)?'
178       restorecon -R -v /srv/mygreylist_milter_content
179
180       Note: SELinux often uses regular expressions  to  specify  labels  that
181       match multiple files.
182
183       The following file types are defined for greylist_milter:
184
185
186
187       greylist_milter_data_t
188
189       -  Set files with the greylist_milter_data_t type, if you want to treat
190       the files as greylist milter content.
191
192
193       Paths:
194            /var/lib/sqlgrey(/.*)?,            /var/lib/milter-greylist(/.*)?,
195            /var/run/milter-greylist(/.*)?,              /var/run/sqlgrey.pid,
196            /var/run/milter-greylist.pid
197
198
199       greylist_milter_exec_t
200
201       - Set files with the greylist_milter_exec_t type, if you want to  tran‐
202       sition an executable to the greylist_milter_t domain.
203
204
205       Paths:
206            /usr/sbin/sqlgrey, /usr/sbin/milter-greylist
207
208
209       Note:  File context can be temporarily modified with the chcon command.
210       If you want to permanently change the file context you need to use  the
211       semanage fcontext command.  This will modify the SELinux labeling data‐
212       base.  You will need to use restorecon to apply the labels.
213
214

COMMANDS

216       semanage fcontext can also be used to manipulate default  file  context
217       mappings.
218
219       semanage  permissive  can  also  be used to manipulate whether or not a
220       process type is permissive.
221
222       semanage module can also be used to enable/disable/install/remove  pol‐
223       icy modules.
224
225       semanage boolean can also be used to manipulate the booleans
226
227
228       system-config-selinux is a GUI tool available to customize SELinux pol‐
229       icy settings.
230
231

AUTHOR

233       This manual page was auto-generated using sepolicy manpage .
234
235