kernel_s..._selinux(8)

💅 kernel_s..._selinux(8) — the SELinux Policy for kernel_systemctl, bestie

okay so real talk: this is the kernel_s..._selinux(8) manual page, and it's literally the owner's manual for the SELinux policy that wraps around kernel_systemctl. if you've ever wondered "who's watching the systemctl processes and what are they even allowed to touch," congrats, you found her 🎀

---

✨ NAME ✨

kernel_systemctl_selinux — Security Enhanced Linux Policy for the kernel_systemctl processes 🫶

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the kernel_systemctl processes via flexible mandatory access control. no cap, that's the whole vibe — SELinux is the bouncer and kernel_systemctl does not get to freestyle.

The kernel_systemctl processes execute with the kernel_systemctl_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep kernel_systemctl_t

like, if she's running, this will absolutely show her 💖

---

🦋 ENTRYPOINTS 🦋

The kernel_systemctl_t SELinux type can be entered via the systemd_systemctl_exec_t file type.

The default entrypoint paths for the kernel_systemctl_t domain are the following:

/usr/bin/systemctl

one path, one icon, that's the door 👑

---

🌈 PROCESS TYPES 🌈

SELinux defines process types (domains) for each process running on the system — think of it like every process gets its own little personality type.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux kernel_systemctl policy is very flexible allowing users to setup their kernel_systemctl processes in as secure a method as possible.

The following process types are defined for kernel_systemctl:

• kernel_systemctl_t

Note: semanage permissive -a kernel_systemctl_t can be used to make the process type kernel_systemctl_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, she won't block you, but she will be live-texting everyone about it 😭

---

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required. kernel_systemctl policy is extremely flexible and has several booleans that allow you to manipulate the policy and run kernel_systemctl with the tightest access possible.

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

main character boolean fr fr 💅

---

💜 MANAGED FILES 💜

The SELinux process type kernel_systemctl_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux is not out here doing DAC's homework, okay?

• systemd_passwd_var_run_t
  • /run/systemd/ask-password(/.*)?
  • /run/systemd/ask-password-block(/.*)?

that's the whole list, she's lowkey a minimalist ✨

---

🔥 COMMANDS 🔥

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

iykyk, these are the tools 💀

---

🧚 AUTHOR 🧚

This manual page was auto-generated using sepolicy manpage.

(so nobody hand-wrote this beauty, the machine did 💀 still iconic tho)

---

⭐ SEE ALSO ⭐

selinux(8), kernel_systemctl(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read the whole friend group, they're all slay 💖

---

and that's the page!! this lil beauty is kernel_systemctl — dated 26-10-06 — living under kernel_s..._selinux(8), auto-generated and absolutely serving. mwah 🫶✨🎀