nx_server_ssh_selinux(8)

💅 nx_server_ssh_selinux(8) — the SELinux policy for nx_server_ssh processes ✨

okay so bestie, welcome to the manual page for nx_server_ssh_selinux, aka the SELinux policy hangout spot for your nx_server_ssh processes. yes this is the nx_server_ssh_selinux(8) page, and yes we're gonna get through it together 🫶

---

🌸 NAME 🌸

nx_server_ssh_selinux — the Security Enhanced Linux Policy for the nx_server_ssh processes. that's it, that's the whole name section, luv u 💖

---

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the nx_server_ssh processes via flexible mandatory access control. very demure, very mindful, very mandatory 💅

The nx_server_ssh processes execute with the nx_server_ssh_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier, easy peasy 🍓

for example:

ps -eZ | grep nx_server_ssh_t

---

🦋 ENTRYPOINTS 🦋

The nx_server_ssh_t SELinux type can be entered via the ssh_exec_t file type. that's the doorway, the entrypoint, the main character entrance 👑

the default entrypoint paths for the nx_server_ssh_t domain are literally these:

/usr/bin/ssh, /usr/libexec/nm-ssh-service

---

🎀 PROCESS TYPES 🎀

SELinux defines process types (domains) for each process running on the system. so every process gets its own little vibe check 🧚

you can see the context of a process using the -Z option to ps.

policy governs the access confined processes have to files. the SELinux nx_server_ssh policy is very flexible, allowing users to setup their nx_server_ssh processes in as secure a method as possible. flexible AND secure, we love a multitasker 💜

the following process types are defined for nx_server_ssh:

• nx_server_ssh_t

note: semanage permissive -a nx_server_ssh_t can be used to make the process type nx_server_ssh_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill about it but it's still taking notes 📝😭

---

🌈 BOOLEANS 🌈

SELinux policy is customizable based on least access required. nx_server_ssh policy is extremely flexible and has several booleans that allow you to manipulate the policy and run nx_server_ssh with the tightest access possible. tighten it up, slay 🔥

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. ✨

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

---

🗂️ MANAGED FILES 🗂️

The SELinux process type nx_server_ssh_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note that the process's UID still needs to have DAC permissions — SELinux is not out here doing DAC's job for it, okay? 🙈

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

ssh_home_t

/var/lib/[^/]+/.ssh(/.*)?
/root/.ssh(/.*)?
/var/lib/one/.ssh(/.*)?
/srv/gitolite/.ssh(/.*)?
/srv/gitolite3/.ssh(/.*)?
/var/lib/pgsql/.ssh(/.*)?
/var/lib/openshift/[^/]+/.ssh(/.*)?
/var/lib/amanda/.ssh(/.*)?
/var/lib/stickshift/[^/]+/.ssh(/.*)?
/var/lib/nocpulse/.ssh(/.*)?
/var/lib/openshift/gear/[^/]+/.ssh(/.*)?
/root/.shosts
/home/[^/]+/.ssh(/.*)?
/home/[^/]+/.ansible/cp/.*
/home/[^/]+/.shosts

---

🧰 COMMANDS 🧰

semanage fcontext can also be used to manipulate default file context mappings. (okay the original says semanage fcontext — go off, semanage ✨)

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules. it does it all, icon behaviour honestly 👑

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. GUI girlies, this one's for you 💅

---

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage .

(the robot wrote it, not me, no cap 🤖)

---

🌟 SEE ALSO 🌟

• selinux(8)
• nx_server_ssh(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

and that's the whole page bestie, you ate that 🫶💖 this lil sign-off comes to you from nx_server_ssh, dated 26-10-06 — nx_server_ssh_selinux(8), periodt. 🌸✨