httpd_passwd_selinux(8)

💖 httpd_passwd_selinux — the SELinux glow-up for httpd_passwd 💖

okay bestie, so this is the manual page for httpd_passwd_selinux from the SELinux Policy httpd_passwd manual, and it's literally all about how Security-Enhanced Linux secures the httpd_passwd processes. no cap, it's giving very "mandatory access control but make it fashion." periodt. 🎀

---

✨ NAME ✨

httpd_passwd_selinux — the Security Enhanced Linux Policy for the httpd_passwd processes. that's it, that's the vibe. 💅

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the httpd_passwd processes via flexible mandatory access control. yes, flexible and mandatory, she contains multitudes. 🔥

The httpd_passwd processes execute with the httpd_passwd_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. super easy, barely an inconvenience. 🦋

For example:

ps -eZ | grep httpd_passwd_t

---

👑 ENTRYPOINTS 👑

The httpd_passwd_t SELinux type can be entered via the httpd_passwd_exec_t file type. it's giving VIP entrance only. ✨

The default entrypoint paths for the httpd_passwd_t domain are the following:

/usr/libexec/httpd-ssl-pass-dialog

that's the one path, bestie. iconic. 💖

---

💜 PROCESS TYPES 💜

SELinux defines process types (domains) for each process running on the system. so every process gets its own little domain, main character energy fr fr.

You can see the context of a process using the -Z option to ps. love that for you. 🌈

Policy governs the access confined processes have to files. SELinux httpd_passwd policy is very flexible allowing users to setup their httpd_passwd processes in as secure a method as possible. highkey the most secure method, ngl. 🫶

The following process types are defined for httpd_passwd:

httpd_passwd_t

Note: semanage permissive -a httpd_passwd_t can be used to make the process type httpd_passwd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so it's chill but it still snitches to the logs, iykyk. 💀

---

⭐ BOOLEANS ⭐

SELinux policy is customizable based on least access required. httpd_passwd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd_passwd with the tightest access possible. she's flexible but she's also strict, the duality of woman. 🎀

If you want to allow httpd to use opencryptoki, you must turn on the httpd_use_opencryptoki boolean. Disabled by default.

setsebool -P httpd_use_opencryptoki 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

slay, now you know the booleans. don't forget the -P or it won't persist. 🔥

---

🧚 MANAGED FILES 🧚

The SELinux process type httpd_passwd_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions. yes bestie, SELinux isn't a replacement for regular file permissions, they work together like the ultimate collab. 💅

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

look at all those cache paths, she's got range. ✨

pkcs_slotd_lock_t

/run/lock/opencryptoki(/.*)?

systemd_passwd_var_run_t

/run/systemd/ask-password(/.*)?
/run/systemd/ask-password-block(/.*)?

---

🦋 FILE CONTEXTS 🦋

SELinux requires files to have an extended attribute to define the file type. it's literally the file's whole personality. 💖

You can see the context of a file using the -Z option to ls. go check, bestie. 👑

Policy governs the access confined processes have to these files. SELinux httpd_passwd policy is very flexible allowing users to setup their httpd_passwd processes in as secure a method as possible. same energy as before, we love consistency. 🌸

STANDARD FILE CONTEXT

SELinux defines the file context types for the httpd_passwd, if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. so like, relabeling era. 🎀

semanage fcontext -a -t httpd_passwd_exec_t '/srv/httpd_passwd/content(/.*)?'
restorecon -R -v /srv/myhttpd_passwd_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. regex is that girl fr fr. 🧚

The following file types are defined for httpd_passwd:

httpd_passwd_exec_t

• Set files with the httpd_passwd_exec_t type, if you want to transition an executable to the httpd_passwd_t domain. so you're telling it "you live here now, go be a httpd_passwd_t." 💅

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. temporary vs permanent is the whole plot, don't get it twisted. ⭐

---

💜 COMMANDS 💜

semanage fcontext can also be used to manipulate default file context mappings. she does it all. 👑

semanage permissive can also be used to manipulate whether or not a process type is permissive. chill mode toggle, basically. 🦋

semanage module can also be used to enable/disable/install/remove policy modules. modular queen. 🌈

semanage boolean can also be used to manipulate the booleans. the booleans stay slaying. 🔥

system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI, for when you want to click instead of type. we respect both. 🫶

---

🌸 AUTHOR 🌸

This manual page was auto-generated using sepolicy manpage. the robots did this one, but they ate. 💖

---

🌟 SEE ALSO 🌟

selinux(8), httpd_passwd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read these too, bestie, they're all in the same friend group. ✨

---

okay that's the whole page, no skips, no cap. now go secure those processes. 💅

this page is from the SELinux Policy httpd_passwd manual, httpd_passwd_selinux(8), and the footer says 26-10-06 on the httpd_passwd side and httpd_passwd_selinux(8) on the other. love that for us. mwah. 💖🎀🫶