admin_crontab_selinux(8)

💅 admin_crontab_selinux(8) — the SELinux policy for admin_crontab processes, bestie

okay so real talk, this is the admin_crontab_selinux manual page, and it's literally all about how SELinux keeps the admin_crontab processes on a leash. it's giving "mandatory access control but make it fashion" 🎀

---

✨ NAME ✨

admin_crontab_selinux — the Security Enhanced Linux Policy for the admin_crontab processes. that's it, that's the whole name, and honestly? iconic.

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the admin_crontab processes via flexible mandatory access control. yes bestie, flexible AND mandatory — she contains multitudes 💜

The admin_crontab processes execute with the admin_crontab_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier, easy peasy.

for example:

ps -eZ | grep admin_crontab_t

look at that. chef's kiss. 🍓

---

🦋 ENTRYPOINTS 🦋

The admin_crontab_t SELinux type can be entered via the crontab_exec_t file type. that's the doorway, the VIP entrance, the whole vibe.

The default entrypoint paths for the admin_crontab_t domain are the following:

/usr/bin/(f)?crontab, /usr/bin/at, /usr/bin/fcronsighup,
/usr/libexec/fcronsighup

^ memorize these or at least screenshot them, iykyk 📸

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. no cap.

You can see the context of a process using the -Z option to ps. same trick as before, she's consistent.

Policy governs the access confined processes have to files. SELinux admin_crontab policy is very flexible, allowing users to setup their admin_crontab processes in as secure a method as possible. secure AND flexible, the duality of woman 💅

The following process types are defined for admin_crontab:

• admin_crontab_t

Note: semanage permissive -a admin_crontab_t can be used to make the process type admin_crontab_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, she won't block you, but she WILL be taking notes 📝

---

🌈 BOOLEANS 🌈

SELinux policy is customizable based on least access required. admin_crontab policy is extremely flexible and has several booleans that allow you to manipulate the policy and run admin_crontab with the tightest access possible. tightest access possible, we love a secure queen 🔥

• fcron_crond — if you want to enable extra rules in the cron domain to support fcron, you must turn on the fcron_crond boolean. disabled by default.

setsebool -P fcron_crond 1

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. enabled by default.

setsebool -P fips_mode 1

• nis_enabled — if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. disabled by default.

setsebool -P nis_enabled 1

three booleans, three little setsebool commands, all with -P because we're persisting across reboots like responsible adults 🫶

---

🧚 MANAGED FILES 🧚

The SELinux process type admin_crontab_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux isn't out here doing DAC's job for it, bestie. it's a team effort 💀

admin_crontab_tmp_t

(this one's just vibing, no default paths listed)

faillog_t

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

security_t

/selinux

var_auth_t

/var/ace(/.*)?
/var/rsa(/.*)?
/var/lib/abl(/.*)?
/var/lib/rsa(/.*)?
/var/lib/pam_ssh(/.*)?
/var/lib/pam_shield(/.*)?
/var/opt/quest/vas/vasd(/.*)?
/var/lib/google-authenticator(/.*)?

like, that's a LOT of paths, but we don't skip the boring parts in this house. every single one matters. 🌟

---

💖 COMMANDS 💖

semange— sorry, semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. a GUI! for the girlies who prefer clicking to typing 💅✨

---

⭐ AUTHOR ⭐

This manual page was auto-generated using sepolicy manpage. so nobody hand-wrote this one, the machine did it. still ate tho 💀

---

🔥 SEE ALSO 🔥

selinux(8), admin_crontab(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those next, i'm literally begging you 🥺

---

okay that's the whole page, bestie! this one came from admin_crontab, dated 26-10-06, and the manual itself is admin_crontab_selinux(8) — so go forth and configure responsibly, mwah 💋🌸