logwatch_mail_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💖 logwatch_mail_selinux(8) — the SELinux policy for logwatch_mail, explained 🎀

okay bestie, so this is the manual for logwatch_mail_selinux — which lives under the SELinux Policy logwatch_mail umbrella. it's a lot of words but honestly it's giving "niche but iconic" and we're gonna get through it together 💅✨

🌸 NAME 🌸

logwatch_mail_selinux — the Security Enhanced Linux Policy for the logwatch_mail processes. that's it, that's the whole vibe. 🦋

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the logwatch_mail processes via flexible mandatory access control. no cap, that's the whole point of it. 🔥

The logwatch_mail processes execute with the logwatch_mail_t SELinux type. wanna check if you've got these processes running? slay, just run the ps command with the -Z qualifier. 🫶

For example:

ps -eZ | grep logwatch_mail_t

literally that's it. type it, mean it, own it. ⭐

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. every process gets a little label, like a name tag at a party, except the party is mandatory access control 🎀

You can see the context of a process using the -Z option to ps. same -Z as above, it's the moment.

Policy governs the access confined processes have to files. the SELinux logwatch_mail policy is very flexible, allowing users to setup their logwatch_mail processes in as secure a method as possible. flexible AND secure? we love a multihyphenate 💜

The following process types are defined for logwatch_mail:

  • logwatch_mail_t
Note: semanage permissive -a logwatch_mail_t can be used to make the process type logwatch_mail_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass, it's a "we're still watching you, bestie" situation 😭

🦋 BOOLEANS 🦋

SELinux policy is customizable based on least access required. logwatch_mail policy is extremely flexible and has several booleans that allow you to manipulate the policy and run logwatch_mail with the tightest access possible. yes, booleans, the on/off girlies of the SELinux world 🌈

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

note the -P — that's the "make it stick" flag, and honestly, persisting your choices is very main character energy ✨

🎀 MANAGED FILES 🎀

The SELinux process type logwatch_mail_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. also important: the processes UID still need to have DAC permissions. don't forget that, it's not optional, it's the law 🙈

cifs_t

(no default paths listed for this one, it's mysterious like that 💀)

courier_spool_t

/var/spool/courier(/.*)?
/var/spool/authdaemon(/.*)?

etc_aliases_t

/etc/mail/.*.db
/etc/mail/aliases.*
/etc/postfix/aliases.*
/etc/aliases
/etc/aliases.db
/etc/aliases.lmdb

etc_mail_t

/etc/mail(/.*)?

exim_log_t

/var/log/exim[0-9]?(/.*)?

exim_spool_t

/var/spool/exim[0-9]?(/.*)?

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

logwatch_cache_t

/var/lib/epylog(/.*)?
/var/lib/logcheck(/.*)?
/var/cache/logwatch(/.*)?

logwatch_mail_tmp_t

(no default paths listed here either — still a whole icon though 💅)

logwatch_tmp_t

(again, no default paths, she's lowkey private 🍓)

mail_home_rw_t

/root/Maildir(/.*)?
/root/.esmtp_queue(/.*)?
/var/lib/arpwatch/.esmtp_queue(/.*)?
/var/cache/ddclient/.esmtp_queue(/.*)?
/home/[^/]+/.maildir(/.*)?
/home/[^/]+/Maildir(/.*)?
/home/[^/]+/.esmtp_queue(/.*)?

mail_home_t

/root/.mailrc
/root/.esmtprc
/root/.forward
/root/dead.letter
/home/[^/]+/.forward[^/]*
/home/[^/]+/.mailrc
/home/[^/]+/.esmtprc
/home/[^/]+/dead.letter

mail_spool_t

/var/mail(/.*)?
/var/spool/imap(/.*)?
/var/spool/mail(/.*)?
/var/spool/smtpd(/.*)?

mqueue_spool_t

/var/spool/(client)?mqueue(/.*)?
/var/spool/mqueue.in(/.*)?

nfs_t

(no default paths listed — iconic enigma 💀)

sendmail_log_t

/var/log/mail(/.*)?
/var/log/sendmail.st.*

uucpd_spool_t

/var/spool/uucp(/.*)?
/var/spool/uucppublic(/.*)?

💜 COMMANDS 💜

ssemanage — no wait, semanage fcontext can also be used to manipulate default file context mappings. got it. 🫶

semanage permissive can also be used to manipulate whether or not a process type is permissive. turning the vibes permissive, if you will.

semanage module can also be used to enable/disable/install/remove policy modules. install, remove, enable, disable — she does it all 🔥

semanage boolean can also be used to manipulate the booleans. yes, the same booleans from up there ⬆️ they're everywhere.

system-config-selinux is a GUI tool available to customize SELinux policy settings. a GUI! for when you want to point and click at your security policy like it's a mood board 🎀

⭐ AUTHOR ⭐

This manual page was auto-generated using sepolicy manpage. auto-generated, no cap — the robots did this one and honestly they ate 🤖💖

🦋 SEE ALSO 🦋

go read them, they're all part of the extended universe 💅✨

and that's the whole page bestie 🫶 this one's from the logwatch_mail fam, dated 26-10-06, and it's the logwatch_mail_selinux(8) manual — now go forth and be secure, or at least be labeled correctly 🌸💖

📦 where this page comes from