cups_pdf_selinux(8)

💅 cups_pdf_selinux (8) — SELinux Policy cups_pdf 🎀

okay bestie, welcome to the cups_pdf_selinux page ✨ — this one's the SELinux policy scoop for the cups_pdf processes, and yeah the whole thing lives in section 8 of the manual (iykyk). let's get into it 💖

---

🌸 NAME 🌸

cups_pdf_selinux — Security Enhanced Linux Policy for the cups_pdf processes. yep. that's the whole vibe. 🫶

---

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the cups_pdf processes via flexible mandatory access control. it's giving "boundaries but make it security" 💅

the cups_pdf processes execute with the cups_pdf_t SELinux type, bestie. and if you're sitting there wondering "do i even have these processes running rn" — literally just run the ps command with the -Z qualifier. so easy. 🌈

for example:

ps -eZ | grep cups_pdf_t

---

🚪 ENTRYPOINTS 🚪

the cups_pdf_t SELinux type can be entered via the cups_pdf_exec_t file type. that's the doorway, the portal, the main character entrance 🔥

the default entrypoint paths for the cups_pdf_t domain are the following:

/usr/lib/cups/backend/cups-pdf

one path. iconic. no cap. 💀

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. so like, every process gets its own little identity, and honestly? relatable ✨

you can see the context of a process using the -Z option to ps.

policy governs the access confined processes have to files. the SELinux cups_pdf policy is very flexible, allowing users to setup their cups_pdf processes in as secure a method as possible. we love a customizable queen 🎀

the following process types are defined for cups_pdf:

cups_pdf_t

Note: semanage permissive -a cups_pdf_t can be used to make the process type cups_pdf_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it won't block anything, but it WILL still be watching and taking notes 😭🙈

---

🦋 BOOLEANS 🦋

SELinux policy is customizable based on least access required. the cups_pdf policy is extremely flexible and has several booleans that allow you to manipulate the policy and run cups_pdf with the tightest access possible. tightest access = bestie behavior fr fr 💜

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

---

📁 MANAGED FILES 📁

the SELinux process type cups_pdf_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. and heads up — the processes UID still need to have DAC permissions, no skipping that step bestie 🙈

• cifs_t — no default paths listed, she's mysterious like that 🧚
• cups_pdf_tmp_t — also no paths listed, just vibes ✨
• ecryptfs_t

/home/[^/]+/.Private(/.*)?
/home/[^/]+/.ecryptfs(/.*)?

• fusefs_t

/run/user/[0-9]+/gvfs

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• nfs_t — no paths, keeping it lowkey 💀
• print_spool_t

/var/spool/lpd(/.*)?
/var/spool/cups(/.*)?
/var/spool/cups-pdf(/.*)?

• user_home_t

/home/[^/]+/.+

---

🎀 FILE CONTEXTS 🎀

SELinux requires files to have an extended attribute to define the file type. like a little name tag but for files, obsessed 🌸

you can see the context of a file using the -Z option to ls.

policy governs the access confined processes have to these files. the SELinux cups_pdf policy is very flexible, allowing users to setup their cups_pdf processes in as secure a method as possible 💖

⭐ STANDARD FILE CONTEXT ⭐

SELinux defines the file context types for the cups_pdf. if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. relabeling arc, honestly 🔥

semanage fcontext -a -t cups_pdf_exec_t '/srv/cups_pdf/content(/.*)?'
restorecon -R -v /srv/mycups_pdf_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. regex girlies rise 🙈

the following file types are defined for cups_pdf:

• cups_pdf_exec_t — Set files with the cups_pdf_exec_t type if you want to transition an executable to the cups_pdf_t domain. it's giving "career change but for executables" 💅
• cups_pdf_tmp_t — Set files with the cups_pdf_tmp_t type if you want to store cups pdf temporary files in the /tmp directories. temp files stay in temp town 🫶

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. so like, chcon is the temporary tattoo and semanage fcontext + restorecon is the real ink, no cap 💀

---

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. GUI besties, this one's for you 🖥️✨

---

🌈 AUTHOR 🌈

This manual page was auto-generated using sepolicy manpage. yes, a robot wrote it. and now a gen z rewrote it. circle of life 🦋

---

👀 SEE ALSO 👀

selinux(8), cups_pdf(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page bestie!! 💖✨🎀 this one's from the cups_pdf manual, dated 26-10-06, and it's page cups_pdf_selinux(8) — go forth and label responsibly, mwah 💅🫶