gpg_web_selinux(8)

🌸 NAME 🌸

gpg_web_selinux(8) is literally the Security Enhanced Linux Policy page for the gpg_web processes, bestie. That's the whole vibe: SELinux policy, gpg_web, secure little processes. 💖

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the gpg_web processes via flexible mandatory access control. No cap, that's the flex.

The gpg_web processes execute with the gpg_web_t SELinux type. Wanna check if you've got these processes running? Run the ps command with the -Z qualifier, like:

ps -eZ | grep gpg_web_t

🚪 ENTRYPOINTS 🚪

The gpg_web_t SELinux type can be entered via the gpg_exec_t file type. It's giving doorway energy. 🚪✨

The default entrypoint paths for the gpg_web_t domain are:

• /usr/bin/gpg(2)?
• /usr/lib/gnupg/.*
• /usr/bin/gpgsm

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. Periodt.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux gpg_web policy is very flexible, allowing users to setup their gpg_web processes in as secure a method as possible. Slay for secure setups. 🛡️

The following process types are defined for gpg_web:

• gpg_web_t

Note: semanage permissive -a gpg_web_t can be used to make the process type gpg_web_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it's not a free pass — the receipts still show up. 🧾

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. gpg_web policy is extremely flexible and has several booleans that allow you to manipulate the policy and run gpg_web with the tightest access possible. It's giving "customize your own adventure." ✨

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. Run setsebool -P fips_mode 1.
• httpd_enable_cgi — if you want to allow httpd cgi support, you must turn on the httpd_enable_cgi boolean. Enabled by default. Run setsebool -P httpd_enable_cgi 1.
• httpd_use_gpg — if you want to allow httpd to run gpg, you must turn on the httpd_use_gpg boolean. Disabled by default. Run setsebool -P httpd_use_gpg 1.

📂 MANAGED FILES 📂

The SELinux process type gpg_web_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions. No skipping that step, bestie. 💅

httpd_sys_rw_content_t

• /etc/rt(/.*)?
• /etc/glpi(/.*)?
• /etc/horde(/.*)?
• /etc/drupal.*
• /etc/z-push(/.*)?
• /var/lib/svn(/.*)?
• /var/www/svn(/.*)?
• /etc/owncloud(/.*)?
• /var/www/html(/.*)?/uploads(/.*)?
• /var/www/html(/.*)?/wp-content(/.*)?
• /var/www/html(/.*)?/wp_backups(/.*)?
• /var/www/html(/.*)?/sites/default/files(/.*)?
• /var/www/html(/.*)?/sites/default/settings.php
• /etc/mock/koji(/.*)?
• /etc/nextcloud(/.*)?
• /var/lib/drupal.*
• /etc/zabbix/web(/.*)?
• /var/lib/moodle(/.*)?
• /var/log/z-push(/.*)?
• /var/spool/gosa(/.*)?
• /etc/WebCalendar(/.*)?
• /usr/share/joomla(/.*)?
• /var/lib/dokuwiki(/.*)?
• /var/lib/httpd/md(/.*)?
• /var/lib/owncloud(/.*)?
• /var/spool/viewvc(/.*)?
• /var/lib/nextcloud(/.*)?
• /var/lib/pootle/po(/.*)?
• /var/lib/phpMyAdmin(/.*)?
• /var/www/moodledata(/.*)?
• /srv/gallery2/smarty(/.*)?
• /var/www/moodle/data(/.*)?
• /var/lib/graphite-web(/.*)?
• /var/log/shibboleth-www(/.*)?
• /var/www/gallery/albums(/.*)?
• /var/www/html/owncloud/data(/.*)?
• /var/www/html/nextcloud/apps(/.*)?
• /var/www/html/nextcloud/data(/.*)?
• /var/www/html/nextcloud/config(/.*)?
• /usr/share/wordpress-mu/wp-content(/.*)?
• /usr/share/wordpress/wp-content/upgrade(/.*)?
• /usr/share/wordpress/wp-content/uploads(/.*)?
• /var/www/html/configuration.php

public_content_rw_t

• /var/spool/abrt-upload(/.*)?

🌈 SHARING FILES 🌈

If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean. Sharing is caring, but like, securely. 💖

Allow gpg_web servers to read the /var/gpg_web directory by adding the public_content_t file type to the directory and by restoring the file type:

semanage fcontext -a -t public_content_t "/var/gpg_web(/.*)?"
restorecon -F -R -v /var/gpg_web

Allow gpg_web servers to read and write /var/gpg_web/incoming by adding the public_content_rw_t type to the directory and by restoring the file type. You also need to turn on the gpg_web_anon_write boolean:

semanage fcontext -a -t public_content_rw_t "/var/gpg_web/incoming(/.*)?"
restorecon -F -R -v /var/gpg_web/incoming
setsebool -P gpg_web_anon_write 1

If you want to allow gpg web domain to modify public files used for public file transfer services, you must turn on the gpg_web_anon_write boolean:

setsebool -P gpg_web_anon_write 1

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

💌 AUTHOR 💌

This manual page was auto-generated using sepolicy manpage. Cute, right? The robots handled this one. 🤖

🔗 SEE ALSO 🔗

selinux(8), gpg_web(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

source/version: gpg_web · date: 26-10-06 · manual: gpg_web_selinux(8) — mwah, bestie, go secure those gpg_web processes 💖✨