logrotate...l_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

✨ logrotate_mail_selinux(8) ✨

okay so bestie, let me tell you about logrotate_mail_selinux — it's the Security Enhanced Linux Policy for the logrotate_mail processes, and honestly it's giving main character energy in the SELinux world 💅

🎀 NAME 🎀

logrotate_mail_selinux — Security Enhanced Linux Policy for the logrotate_mail processes, no cap.

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the logrotate_mail processes via flexible mandatory access control — think of it like a VIP velvet rope for your mail log rotation, and SELinux is the bouncer checking everyone's ID 💖

The logrotate_mail processes execute with the logrotate_mail_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep logrotate_mail_t

like literally just run that and see what's up 🫶

🦋 PROCESS TYPES 🦋

SELinux defines process types (domains) for each process running on the system — every process gets its own little label, it's iconic honestly.

You can see the context of a process using the -Z option to ps

Policy governs the access confined processes have to files. SELinux logrotate_mail policy is very flexible allowing users to setup their logrotate_mail processes in as secure a method as possible.

The following process types are defined for logrotate_mail:

  • logrotate_mail_t — the one and only, the moment, the process type
Note: semanage permissive -a logrotate_mail_t can be used to make the process type logrotate_mail_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass, you'll still get receipts in the logs bestie 😭

🧚 BOOLEANS 🧚

SELinux policy is customizable based on least access required. logrotate_mail policy is extremely flexible and has several booleans that allow you to manipulate the policy and run logrotate_mail with the tightest access possible — the way that least privilege ate, fr fr 🔥

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. slay, it's already on ✨

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. so you gotta flip it if you need it 💅

setsebool -P nis_enabled 1

🍓 MANAGED FILES 🍓

The SELinux process type logrotate_mail_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — like SELinux is one lock, but you still need the regular Unix key too, iykyk 🔑

  • cifs_t — the network filesystem vibe
  • courier_spool_t
    • /var/spool/courier(/.*)?
    • /var/spool/authdaemon(/.*)?
  • etc_aliases_t
    • /etc/mail/.*.db
    • /etc/mail/aliases.*
    • /etc/postfix/aliases.*
    • /etc/aliases
    • /etc/aliases.db
    • /etc/aliases.lmdb
  • etc_mail_t
    • /etc/mail(/.*)?
  • exim_log_t
    • /var/log/exim[0-9]?(/.*)?
  • exim_spool_t
    • /var/spool/exim[0-9]?(/.*)?
  • krb5_host_rcache_t — the Kerberos cache files, living their best life in multiple locations 💜
    • /var/tmp/krb5_0.rcache2
    • /var/cache/krb5rcache(/.*)?
    • /var/tmp/nfs_0
    • /var/tmp/DNS_25
    • /var/tmp/host_0
    • /var/tmp/imap_0
    • /var/tmp/HTTP_23
    • /var/tmp/HTTP_48
    • /var/tmp/ldap_55
    • /var/tmp/ldap_487
    • /var/tmp/ldapmap1_0
  • logrotate_mail_tmp_t — temporary files doing temporary things
  • logrotate_tmp_t — more temp files, different label, same energy
  • mail_home_rw_t
    • /root/Maildir(/.*)?
    • /root/.esmtp_queue(/.*)?
    • /var/lib/arpwatch/.esmtp_queue(/.*)?
    • /var/cache/ddclient/.esmtp_queue(/.*)?
    • /home/[^/]+/.maildir(/.*)?
    • /home/[^/]+/Maildir(/.*)?
    • /home/[^/]+/.esmtp_queue(/.*)?
  • mail_home_t
    • /root/.mailrc
    • /root/.esmtprc
    • /root/.forward
    • /root/dead.letter
    • /home/[^/]+/.forward[^/]*
    • /home/[^/]+/.mailrc
    • /home/[^/]+/.esmtprc
    • /home/[^/]+/dead.letter
  • mail_spool_t
    • /var/mail(/.*)?
    • /var/spool/imap(/.*)?
    • /var/spool/mail(/.*)?
    • /var/spool/smtpd(/.*)?
  • mqueue_spool_t
    • /var/spool/(client)?mqueue(/.*)?
    • /var/spool/mqueue.in(/.*)?
  • nfs_t — network filesystem files, we love a cross-system moment 🌈
  • sendmail_log_t
    • /var/log/mail(/.*)?
    • /var/log/sendmail.st.*
  • uucpd_spool_t
    • /var/spool/uucp(/.*)?
    • /var/spool/uucppublic(/.*)?

🏆 COMMANDS 🏆

semanage fcontext can also be used to manipulate default file context mappings — like literally the go-to for telling files what label they should have ✨

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans — yes queen, flip those switches 💅

system-config-selinux is a GUI tool available to customize SELinux policy settings. for when you want to point and click instead of typing, valid honestly 🖱️

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage.

like it wrote itself, which is kind of iconic ngl 💀

🌟 SEE ALSO 🌟

selinux(8), logrotate_mail(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

the whole squad is here, go read them if you want the full lore 🫶

that's the whole tea bestie — sign-off from the logrotate_mail manual, dated 26-10-06, no cap. go forth and configure your SELinux policy with confidence, you've got this 💖✨🎀

📦 where this page comes from