KERNEL_GENERIC_HELPER_SELINUX(8)

💅 NAME 💅

okay so this page is the whole vibe on kernel_generic_helper_selinux — which is literally the Security Enhanced Linux Policy for the kernel_generic_helper processes 🫶. it's page kernel_..._selinux(8) btw, and yeah the name got squished, we don't talk about it 💀

---

✨ DESCRIPTION ✨

so Security-Enhanced Linux is the thing that secures your kernel_generic_helper processes through flexible mandatory access control. that's the whole point of it, no cap 👑

the kernel_generic_helper processes execute with the kernel_generic_helper_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier, easy:

ps -eZ | grep kernel_generic_helper_t

that's it, that's the check 🌸

---

🚪 ENTRYPOINTS 🚪

the kernel_generic_helper_t SELinux type can be entered via the bin_t, usr_t file types. those are the doors, bestie 🚪✨

the default entrypoint paths for the kernel_generic_helper_t domain are literally these:

All executables with the default executable label, usually stored in /usr/bin and /usr/sbin. /opt/.*, /usr/.*, /hana(/.*)?, /emul/.*, /export(/.*)?, /ostree(/.*)?, /usr/doc(/.*)?/lib(/.*)?, /usr/inclu.e(/.*)?, /usr/share/rpm(/.*)?, /usr/share/doc(/.*)?/README.*, /usr/lib/modules(/.*)/vmlinuz, /usr/lib/modules(/.*)/sysctl.conf, /usr/lib/modules(/.*)/initramfs.img, /usr/lib/sysimage(/.*)?, /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul

(yes, /usr/inclu.e — that's literally how it's written, i'm not fixing it, i would never 🙈)

---

👑 PROCESS TYPES 👑

so SELinux defines process types (domains) for each process running on the system. main character energy for every single process, honestly 💅

you can see the context of a process using the -Z option to ps

Policy governs the access confined processes have to files. SELinux kernel_generic_helper policy is very flexible, allowing users to setup their kernel_generic_helper processes in as secure a method as possible 🔥

the following process types are defined for kernel_generic_helper:

kernel_generic_helper_t

Note: semanage permissive -a kernel_generic_helper_t can be used to make the process type kernel_generic_helper_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still snitching 😭

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. kernel_generic_helper policy is extremely flexible and has several booleans that allow you to manipulate the policy and run kernel_generic_helper with the tightest access possible 🧚

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default ⭐

setsebool -P fips_mode 1

---

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans
• system-config-selinux is a GUI tool available to customize SELinux policy settings. it's giving gui slay 🖥️✨

---

✍️ AUTHOR ✍️

this manual page was auto-generated using sepolicy manpage . (yes there's a space before the period, we stan a machine that hits spacebar by accident 🫶)

---

🔗 SEE ALSO 🔗

selinux(8), kernel_generic_helper(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those too, iykyk 💜

---

okay bye bestie!! this came from kernel_generic_helper on 26-10-06, and the whole thing lives under kernel_..._selinux(8) — mwah, go forth and be secure 💖🦋🌸