1inetd_selinux(8) SELinux Policy inetd inetd_selinux(8)
2
6 inetd_selinux - Security Enhanced Linux Policy for the inetd processes
7
9 Security-Enhanced Linux secures the inetd processes via flexible manda‐
10 tory access control.
11 The inetd processes execute with the inetd_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15 For example:
17 ps -eZ | grep inetd_t
19
23 The inetd_t SELinux type can be entered via the inetd_exec_t file type.
24 The default entrypoint paths for the inetd_t domain are the following:
26 /usr/sbin/(x)?inetd, /usr/sbin/rlinetd
28
30 SELinux defines process types (domains) for each process running on the
31 system
32 You can see the context of a process using the -Z option to ps
34 Policy governs the access confined processes have to files. SELinux
36 inetd policy is very flexible allowing users to setup their inetd pro‐
37 cesses in as secure a method as possible.
38 The following process types are defined for inetd:
40 inetd_t, inetd_child_t
42 Note: semanage permissive -a inetd_t can be used to make the process
44 type inetd_t permissive. SELinux does not deny access to permissive
45 process types, but the AVC (SELinux denials) messages are still gener‐
46 ated.
47
50 SELinux policy is customizable based on least access required. inetd
51 policy is extremely flexible and has several booleans that allow you to
52 manipulate the policy and run inetd with the tightest access possible.
53 If you want to dontaudit all daemons scheduling requests (setsched,
57 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
58 Enabled by default.
59 setsebool -P daemons_dontaudit_scheduling 1
61 If you want to deny user domains applications to map a memory region as
65 both executable and writable, this is dangerous and the executable
66 should be reported in bugzilla, you must turn on the deny_execmem bool‐
67 ean. Disabled by default.
68 setsebool -P deny_execmem 1
70 If you want to control the ability to mmap a low area of the address
74 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
75 the mmap_low_allowed boolean. Disabled by default.
76 setsebool -P mmap_low_allowed 1
78 If you want to allow system to run with NIS, you must turn on the
82 nis_enabled boolean. Disabled by default.
83 setsebool -P nis_enabled 1
85 If you want to disable kernel module loading, you must turn on the se‐
89 cure_mode_insmod boolean. Disabled by default.
90 setsebool -P secure_mode_insmod 1
92 If you want to allow unconfined executables to make their heap memory
96 executable. Doing this is a really bad idea. Probably indicates a
97 badly coded executable, but could indicate an attack. This executable
98 should be reported in bugzilla, you must turn on the selinuxuser_ex‐
99 echeap boolean. Disabled by default.
100 setsebool -P selinuxuser_execheap 1
102 If you want to allow unconfined executables to make their stack exe‐
106 cutable. This should never, ever be necessary. Probably indicates a
107 badly coded executable, but could indicate an attack. This executable
108 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
109 stack boolean. Enabled by default.
110 setsebool -P selinuxuser_execstack 1
112
116 SELinux defines port types to represent TCP and UDP ports.
117 You can see the types associated with a port by using the following
119 command:
120 semanage port -l
122 Policy governs the access confined processes have to these ports.
125 SELinux inetd policy is very flexible allowing users to setup their in‐
126 etd processes in as secure a method as possible.
127 The following port types are defined for inetd:
129 inetd_child_port_t
132 Default Defined Ports:
136 tcp 1,9,13,19,512,544,891,892,5666
137 udp 1,9,13,19,891,892
138
140 The SELinux process type inetd_t can manage files labeled with the fol‐
141 lowing file types. The paths listed are the default paths for these
142 file types. Note the processes UID still need to have DAC permissions.
143 file_type
145 all files on the system
147
150 SELinux requires files to have an extended attribute to define the file
151 type.
152 You can see the context of a file using the -Z option to ls
154 Policy governs the access confined processes have to these files.
156 SELinux inetd policy is very flexible allowing users to setup their in‐
157 etd processes in as secure a method as possible.
158 STANDARD FILE CONTEXT
160 SELinux defines the file context types for the inetd, if you wanted to
162 store files with these types in a different paths, you need to execute
163 the semanage command to specify alternate labeling and then use re‐
164 storecon to put the labels on disk.
165 semanage fcontext -a -t inetd_exec_t '/srv/inetd/content(/.*)?'
167 restorecon -R -v /srv/myinetd_content
168 Note: SELinux often uses regular expressions to specify labels that
170 match multiple files.
171 The following file types are defined for inetd:
173 inetd_child_exec_t
177 - Set files with the inetd_child_exec_t type, if you want to transition
179 an executable to the inetd_child_t domain.
180 Paths:
183 /usr/sbin/in..*d, /usr/lib/pysieved/pysieved.*.py, /usr/lo‐
184 cal/lib/pysieved/pysieved.*.py, /usr/sbin/identd
185 inetd_child_tmp_t
188 - Set files with the inetd_child_tmp_t type, if you want to store inetd
190 child temporary files in the /tmp directories.
191 inetd_child_var_run_t
195 - Set files with the inetd_child_var_run_t type, if you want to store
197 the inetd child files under the /run or /var/run directory.
198 inetd_exec_t
202 - Set files with the inetd_exec_t type, if you want to transition an
204 executable to the inetd_t domain.
205 Paths:
208 /usr/sbin/(x)?inetd, /usr/sbin/rlinetd
209 inetd_log_t
212 - Set files with the inetd_log_t type, if you want to treat the data as
214 inetd log data, usually stored under the /var/log directory.
215 inetd_tmp_t
219 - Set files with the inetd_tmp_t type, if you want to store inetd tem‐
221 porary files in the /tmp directories.
222 inetd_var_run_t
226 - Set files with the inetd_var_run_t type, if you want to store the in‐
228 etd files under the /run or /var/run directory.
229 Note: File context can be temporarily modified with the chcon command.
233 If you want to permanently change the file context you need to use the
234 semanage fcontext command. This will modify the SELinux labeling data‐
235 base. You will need to use restorecon to apply the labels.
236
239 semanage fcontext can also be used to manipulate default file context
240 mappings.
241 semanage permissive can also be used to manipulate whether or not a
243 process type is permissive.
244 semanage module can also be used to enable/disable/install/remove pol‐
246 icy modules.
247 semanage port can also be used to manipulate the port definitions
249 semanage boolean can also be used to manipulate the booleans
251 system-config-selinux is a GUI tool available to customize SELinux pol‐
254 icy settings.
255
258 This manual page was auto-generated using sepolicy manpage .
259
262 selinux(8), inetd(8), semanage(8), restorecon(8), chcon(1), sepol‐
263 icy(8), setsebool(8), inetd_child_selinux(8)
264inetd 23-12-15 inetd_selinux(8)