httpd_...selinux(8)

💖 httpd_unconfined_script_selinux(8) — the SELinux vibe check for httpd_unconfined_script 💖

okay so bestie, this is the manual page for httpd_unconfined_script_selinux — it lives in section 8 of the SELinux Policy httpd_unconfined_script manual, and it's literally all about the SELinux policy for the httpd_unconfined_script processes. pull up a chair 🎀

---

✨ NAME ✨

httpd_unconfined_script_selinux — Security Enhanced Linux Policy for the httpd_unconfined_script processes. that's it, that's the whole name section, slay 💅

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the httpd_unconfined_script processes via flexible mandatory access control. yes ma'am, mandatory. not optional. MAC said what it said 🫶

so, the httpd_unconfined_script processes execute with the httpd_unconfined_script_t SELinux type. you can check if you even have these processes running by executing the ps command with the -Z qualifier.

for example:

ps -eZ | grep httpd_unconfined_script_t

that's the vibe check right there 🔍

---

🦋 ENTRYPOINTS 🦋

the httpd_unconfined_script_t SELinux type can be entered via the httpd_unconfined_script_exec_t file type. that's the doorway, iykyk ✨

the default entrypoint paths for the httpd_unconfined_script_t domain are the following:

(and then... there's nothing listed. iconic of it honestly. the list is empty, bestie — that's not me skipping it, that's literally what the page says 🙈)

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. one domain per process, like little apartments 🏠

you can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. the SELinux httpd_unconfined_script policy is very flexible allowing users to setup their httpd_unconfined_script processes in as secure a method as possible.

the following process types are defined for httpd_unconfined_script:

• httpd_unconfined_script_t

Note: semanage permissive -a httpd_unconfined_script_t can be used to make the process type httpd_unconfined_script_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it stops yelling at you with a block but it still logs the receipts 💀

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. the httpd_unconfined_script policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd_unconfined_script with the tightest access possible. booleans are basically the little toggles of the SELinux world, and we love a toggle 🔥

if you want to deny user domains applications to map a memory region as both executable and writable — this is dangerous and the executable should be reported in bugzilla — you must turn on the deny_execmem boolean. Disabled by default.

setsebool -P deny_execmem 1

if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on the mmap_low_allowed boolean. Disabled by default.

setsebool -P mmap_low_allowed 1

if you want to disable kernel module loading, you must turn on the secure_mode_insmod boolean. Disabled by default.

setsebool -P secure_mode_insmod 1

if you want to allow unconfined executables to make their heap memory executable — doing this is a really bad idea. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla — you must turn on the selinuxuser_execheap boolean. Disabled by default. 😭

setsebool -P selinuxuser_execheap 1

if you want to allow unconfined executables to make their stack executable — this should never, ever be necessary. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla — you must turn on the selinuxuser_execstack boolean. Disabled by default. fr fr do not just flip this one for fun 🙈

setsebool -P selinuxuser_execstack 1

---

🌈 MANAGED FILES 🌈

the SELinux process type httpd_unconfined_script_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions. SELinux isn't out here overriding your regular permissions, bestie, it's a whole extra layer 🧚

file_type

• all files on the system

yes. all of them. main character energy 👑

---

⭐ COMMANDS ⭐

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. a whole GUI, for the girlies who don't do terminal 💅

---

💜 AUTHOR 💜

this manual page was auto-generated using sepolicy manpage. a bot wrote it, and honestly? it ate.

---

🍓 SEE ALSO 🍓

• selinux(8)
• httpd_unconfined_script(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

and that's the whole page, bestie 🫶 this was httpd_unconfined_script — page version 26-10-06 — footer said httpd_...selinux(8) too, so like, it's giving full circle. go forth and be permissive (only if you mean it) 💖✨🎀