dbadm_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 4 versions
, in opensuse-leap 16.0

💅 dbadm_selinux(8) — the dbadm SELinux Policy doc, but make it make sense

okay bestie, welcome to the dbadm_selinux(8) manual page 🎀 this is the glow-up version of the dbadm SELinux Policy documentation, and we're gonna get through it together, no cap.

✨ NAME ✨

dbadm_r — the Database administrator role. — Security Enhanced Linux Policy 🗄️👑

🌸 DESCRIPTION 🌸

so SELinux supports Roles Based Access Control (that's RBAC, iykyk), and some Linux roles are login roles while other roles need to be transitioned into. it's giving VIP section energy 🎟️

Note: every example in this man page uses the staff_u SELinux user. just so you know who we're stanning 💖

Non login roles are usually for administrative tasks — think stuff that needs root privileges. Roles control which types a user can run processes with, and roles often have default types assigned to them. main character behavior, honestly.

The default type for the dbadm_r role is dbadm_t. 🫶

The newrole program transitions directly to this role:

newrole -r dbadm_r -t dbadm_t

sudo is the preferred method to transition from one role to another. you set up sudo to transition to dbadm_r by adding a similar line to the /etc/sudoers file:

USERNAME ALL=(ALL) ROLE=dbadm_r TYPE=dbadm_t COMMAND

then sudo will run COMMAND as staff_u:dbadm_r:dbadm_t:LEVEL ✨

When you're using a non login role, you need to set up SELinux so your SELinux user can reach the dbadm_r role.

Run this to see all of the assigned SELinux roles:

semanage user -l

You need to add dbadm_r to the staff_u user. You could set up the staff_u user to be able to use the dbadm_r role with a command like:

$ semanage user -m -R 'staff_r system_r dbadm_r' staff_u

slay, now you're in 💅

✨ BOOLEANS ✨

SELinux policy is customizable based on least access required — like, give them the absolute minimum and nothing more, boundaries are hot 🔥. The dbadm policy is extremely flexible and has several booleans that let you manipulate the policy and run dbadm with the tightest access possible.

  • dbadm_manage_user_files — if you want to determine whether dbadm can manage generic user files, turn this on. Disabled by default.
setsebool -P dbadm_manage_user_files 1
  • dbadm_read_user_files — if you want to determine whether dbadm can read generic user files, turn this on. Disabled by default.
setsebool -P dbadm_read_user_files 1
  • deny_execmem — if you want to deny user domains applications from mapping a memory region as both executable and writable, turn this on. ⚠️ this is dangerous, and the executable should be reported in bugzilla. Disabled by default.
setsebool -P deny_execmem 1
  • deny_ptrace — if you want to deny any process from ptracing or debugging any other processes, turn this on. Disabled by default.
setsebool -P deny_ptrace 1
  • fips_mode — if you want to allow all domains to execute in fips_mode, turn this on. Enabled by default.
setsebool -P fips_mode 1
  • nis_enabled — if you want to allow system to run with NIS, turn this on. Disabled by default.
setsebool -P nis_enabled 1
  • selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, turn this on. 😭 this should never, ever be necessary. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default.
setsebool -P selinuxuser_execstack 1
  • use_nfs_home_dirs — if you want to support NFS home directories, turn this on. Enabled by default.
setsebool -P use_nfs_home_dirs 1
  • use_samba_home_dirs — if you want to support SAMBA home directories, turn this on. Disabled by default.
setsebool -P use_samba_home_dirs 1

🦋 MANAGED FILES 🦋

The SELinux process type dbadm_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. 👀 note: the process's UID still needs to have DAC permissions — SELinux isn't out here doing your whole job for you, bestie.

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

mysqld_db_t

/var/lib/mysql(-files|-keyring)?(/.*)?
/var/lib/mysql-.*(/.*)?

mysqld_etc_t

/etc/mysql(/.*)?
/etc/my.cnf.d(/.*)?
/etc/my.cnf

mysqld_home_t

/root/.my.cnf
/home/[^/]+/.my.cnf

mysqld_log_t

/var/log/mysql.*
/var/log/mysql(/.*)?
/var/log/mariadb(/.*)?

mysqld_tmp_t

(no default paths listed for this one 🫧)

mysqld_unit_file_t

/usr/lib/systemd/system/mysql.*
/usr/lib/systemd/system/mysqld.*
/usr/lib/systemd/system/mariadb.*

mysqld_var_run_t

/run/mysql(/.*)?
/run/mysqld(/.*)?
/run/mariadb(/.*)?
/var/lib/mysql-.*/mysql(x)?.sock
/var/lib/mysql/mysql(x)?.sock
/var/tmp/mysql-protected.*(/.*)?

postgresql_db_t

/var/lib/pgsql(/.*)?
/var/lib/sepgsql(/.*)?
/var/lib/postgres(ql)?(/.*)?
/usr/share/jonas/pgsql(/.*)?
/usr/lib/pgsql/test/regress(/.*)?

postgresql_etc_t

/etc/postgresql(/.*)?
/etc/sysconfig/pgsql(/.*)?

postgresql_log_t

/var/lib/pgsql/.*.log
/var/log/rhdb/rhdb(/.*)?
/var/log/postgresql(/.*)?
/var/log/postgres.log.*
/var/lib/pgsql/logfile(/.*)?
/var/lib/pgsql/data/log(/.*)?
/var/log/sepostgresql.log.*
/var/lib/pgsql/data/pg_log(/.*)?
/var/lib/sepgsql/pgstartup.log

postgresql_tmp_t

(no default paths listed here either 🍓)

postgresql_var_run_t

/run/postgresql(/.*)?

systemd_passwd_var_run_t

/run/systemd/ask-password(/.*)?
/run/systemd/ask-password-block(/.*)?

user_home_t

/home/[^/]+/.+

🎀 COMMANDS 🎀

  • semanage fcontext — can also be used to manipulate default file context mappings.
  • semanage permissive — can also be used to manipulate whether or not a process type is permissive.
  • semanage module — can also be used to enable/disable/install/remove policy modules.
  • semanage boolean — can also be used to manipulate the booleans.
  • system-config-selinux — a GUI tool available to customize SELinux policy settings. ✨ point and click era ✨

💜 AUTHOR 💜

This manual page was auto-generated using sepolicy manpage. (the robots did the homework, we just added the sparkle 🧚)

🌈 SEE ALSO 🌈

selinux(8), dbadm(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8), dbadm_sudo_selinux(8), dbadm_sudo_selinux(8)

okay that's the whole page bestie, you ate that 🫶 this lil doc came to you from mgrepl@redhat.com, part of the dbadm package, living its best life in section dbadm_selinux(8) — go forth and selinux responsibly 💖✨

📦 where this page comes from