dbadm_sudo_selinux(8)

✨ dbadm_sudo_selinux(8) — the manual page bestie 💅

okay so this is the dbadm_sudo_selinux manual page, and it's literally all about keeping the dbadm_sudo processes safe with SELinux. no cap, it's giving security realness.

---

🎀 NAME 🎀

dbadm_sudo_selinux — the Security Enhanced Linux Policy for the dbadm_sudo processes, periodt.

---

💖 DESCRIPTION 💖

Security-Enhanced Linux secures the dbadm_sudo processes via flexible mandatory access control. like, it's not playing around.

The dbadm_sudo processes execute with the dbadm_sudo_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. lowkey so useful.

For example:

ps -eZ | grep dbadm_sudo_t

---

🦋 ENTRYPOINTS 🦋

The dbadm_sudo_t SELinux type can be entered via the sudo_exec_t file type. that's the vibe. 💫

The default entrypoint paths for the dbadm_sudo_t domain are the following:

/usr/bin/sudo(edit)?

---

🌸 PROCESS TYPES 🌸

SELinux defines process types (domains) for each process running on the system. it's a whole thing.

You can see the context of a process using the -Z option to ps. iconic behavior.

Policy governs the access confined processes have to files. SELinux dbadm_sudo policy is very flexible, allowing users to setup their dbadm_sudo processes in as secure a method as possible. obsessed with the flexibility honestly.

The following process types are defined for dbadm_sudo:

dbadm_sudo_t

Note: semanage permissive -a dbadm_sudo_t can be used to make the process type dbadm_sudo_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still watching you, iykyk. 👀

---

👑 BOOLEANS 👑

SELinux policy is customizable based on least access required. dbadm_sudo policy is extremely flexible and has several booleans that allow you to manipulate the policy and run dbadm_sudo with the tightest access possible. slay.

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow confined applications to run with kerberos, you must turn on the kerberos_enabled boolean. Enabled by default.

setsebool -P kerberos_enabled 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

---

🌈 MANAGED FILES 🌈

The SELinux process type dbadm_sudo_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. note: the process's UID still needs to have DAC permissions. don't forget that bestie.

• cifs_t
• dbadm_sudo_tmp_t
• ecryptfs_t

/home/[^/]+/.Private(/.*)?
/home/[^/]+/.ecryptfs(/.*)?

• faillog_t

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

• fusefs_t

/run/user/[0-9]+/gvfs

• initrc_var_run_t

/run/sysconfig(/.*)?
/run/utmp
/run/keymap
/run/numlock-on
/run/setleds-on
/run/runlevel.dir
/run/setmixer_flag
/run/bootsplashctl

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• lastlog_t

/var/log/lastlog.*
/var/lib/lastlog(/.*)?

• nfs_t
• pam_var_run_t

/var/(db|adm)/sudo(/.*)?
/run/sudo(/.*)?
/run/pam_ssh(/.*)?
/run/sepermit(/.*)?
/var/lib/sudo(/.*)?
/run/pam_mount(/.*)?
/run/pam_timestamp(/.*)?

• security_t

/selinux

• sudo_db_t

/var/db/sudo(/.*)?

• sudo_log_t

/var/log/sudo-io(/.*)?
/var/log/sudo.log

---

💜 COMMANDS 💜

semanage fcontext can also be used to manipulate default file context mappings. handy.

semanage permissive can also be used to manipulate whether or not a process type is permissive. big mood.

semanage module can also be used to enable/disable/install/remove policy modules. the multitasker.

semanage boolean can also be used to manipulate the booleans. yes bestie.

system-config-selinux is a GUI tool available to customize SELinux policy settings. for the visual learners out there. 🎨

---

🌟 AUTHOR 🌟

This manual page was auto-generated using sepolicy manpage. the robots did it, not me. 🤖

---

🔥 SEE ALSO 🔥

selinux(8), dbadm_sudo(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page, bestie! 💖✨ this manual page for dbadm_sudo is from the SELinux Policy dbadm_sudo set, dated 26-10-06, and it's out here being iconic in section 8 of the manual. go off, king. 👑💅