nut_upsdrvctl_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💖 nut_upsdrvctl_selinux 💖

okay bestie, so this is the manual page for nut_upsdrvctl_selinux — it's part of the SELinux Policy nut_upsdrvctl manual, and it's literally all about keeping the nut_upsdrvctl processes super safe and secure with mandatory access control. no cap, it's giving security realness 💅✨

✨ NAME ✨

nut_upsdrvctl_selinux — Security Enhanced Linux Policy for the nut_upsdrvctl processes. periodt. 🎀

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the nut_upsdrvctl processes via flexible mandatory access control. it's literally the bodyguard of the process world 🫶

The nut_upsdrvctl processes execute with the nut_upsdrvctl_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. like, it's so easy.

for example:

ps -eZ | grep nut_upsdrvctl_t

slay. that's the vibe check right there 🔥

🦋 ENTRYPOINTS 🦋

The nut_upsdrvctl_t SELinux type can be entered via the nut_upsdrvctl_exec_t file type. it's like the VIP entrance, but for processes 💅

The default entrypoint paths for the nut_upsdrvctl_t domain are the following:

/usr/bin/upsdrvctl, /usr/bin/blazer_usb

iconic paths, honestly 👑

🎀 PROCESS TYPES 🎀

SELinux defines process types (domains) for each process running on the system. it's like every process gets its own little category, and they're all main characters in their own way ✨

You can see the context of a process using the -Z option to ps. super handy for when you wanna know who's who at the party 💃

Policy governs the access confined processes have to files. SELinux nut_upsdrvctl policy is very flexible allowing users to set up their nut_upsdrvctl processes in as secure a method as possible. it's lowkey obsessed with being secure 🛡️

The following process types are defined for nut_upsdrvctl:

  • nut_upsdrvctl_t
Note: semanage permissive -a nut_upsdrvctl_t can be used to make the process type nut_upsdrvctl_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a full free pass, bestie — the receipts still exist 😭📝

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required. nut_upsdrvctl policy is extremely flexible and has several booleans that allow you to manipulate the policy and run nut_upsdrvctl with the tightest access possible. tightest access = the most secure fit, like a perfectly tailored little outfit 👗✨

If you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

🌈 MANAGED FILES 🌈

The SELinux process type nut_upsdrvctl_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note that the processes UID still need to have DAC permissions — like, SELinux isn't doing all the work, your user still needs the right perms, bestie 🤝

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

nut_upsdrvctl_tmp_t

(this one doesn't have any default paths listed, it's mysterious like that 🙈)

nut_var_run_t

/run/nut(/.*)?

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

🧚 FILE CONTEXTS 🧚

SELinux requires files to have an extended attribute to define the file type. it's like every file has a little name tag, and SELinux is the bouncer checking them at the door 🎟️✨

You can see the context of a file using the -Z option to ls. literally so useful, go try it.

Policy governs the access confined processes have to these files. SELinux nut_upsdrvctl policy is very flexible allowing users to set up their nut_upsdrvctl processes in as secure a method as possible. yes, it's giving secure and flexible at the same time, we love range 💅

⭐ STANDARD FILE CONTEXT ⭐

SELinux defines the file context types for the nut_upsdrvctl, if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. it's like relabeling your entire closet, but for files 📦✨

semanage fcontext -a -t nut_upsdrvctl_exec_t '/srv/nut_upsdrvctl/content(/.*)?'
restorecon -R -v /srv/mynut_upsdrvctl_content
Note: SELinux often uses regular expressions to specify labels that match multiple files. regex is everywhere, bestie, get used to it 😭💅

The following file types are defined for nut_upsdrvctl:

nut_upsdrvctl_exec_t

  • Set files with the nut_upsdrvctl_exec_t type, if you want to transition an executable to the nut_upsdrvctl_t domain. it's like giving an executable a backstage pass to the domain of its dreams 🎟️👑

Paths:

/usr/bin/upsdrvctl, /usr/bin/blazer_usb

nut_upsdrvctl_tmp_t

  • Set files with the nut_upsdrvctl_tmp_t type, if you want to store nut upsdrvctl temporary files in the /tmp directories. temporary files need a type too, they're valid and they matter 💖
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. so like, chcon is the quick fix, semanage fcontext is the permanent glow-up, and restorecon is the final reveal. got it? periodt. 💅✨

💜 COMMANDS 💜

semanage fcontext can also be used to manipulate default file context mappings. it's literally the go-to for context stuff.

semanage permissive can also be used to manipulate whether or not a process type is permissive. permissive mode = not strict, but still snitching with those AVC messages 😭

semanage module can also be used to enable/disable/install/remove policy modules. modular realness.

semanage boolean can also be used to manipulate the booleans. booleans are your little on/off switches and semanage boolean is the remote control 🎮

system-config-selinux is a GUI tool available to customize SELinux policy settings. for when you want the full graphical experience, no terminal required (but we love the terminal anyway) 🖥️💖

🌸 AUTHOR 🌸

This manual page was auto-generated using sepolicy manpage. the robots wrote it, we just gave it personality 🤖✨

🫶 SEE ALSO 🫶

selinux(8), nut_upsdrvctl(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

like, read those too if you want the full lore. iykyk 📚💅

okay that's the whole page bestie, you ate that 💖

this has been nut_upsdrvctl_selinux(8) from 26-10-06, part of the nut_upsdrvctl manual — hope you learned something and had a little fun, mwah 😘✨👑

📦 where this page comes from