openshif..._selinux(8)

💅 openshif..._selinux(8) — the openshift_script_selinux page, but make it make sense

okay so bestie, you opened openshif..._selinux(8) and it's giving "generated by a script at 3am" energy. don't panic. it's actually a tiny page. let's go 🫶

---

✨ NAME ✨

openshift_script_selinux — the Security Enhanced Linux Policy for the openshift_script processes. that's it. that's the whole name. slay.

---

🌸 DESCRIPTION 🌸

so, Security-Enhanced Linux secures the openshift_script processes via flexible mandatory access control. yes, mandatory. not "if you feel like it" access control. it's mandatory, bestie. it means business 💅

here's the tea: the openshift_script processes execute with the openshift_script_t SELinux type. that's their whole identity, their main character energy, their domain. 👑

and you can literally check if you have these processes running by executing the ps command with the -Z qualifier. like so:

ps -eZ | grep openshift_script_t

no cap, that's the vibe check right there. 🦋

---

🚪 ENTRYPOINTS 🚪

the openshift_script_t SELinux type can be entered via the openshift_script_exec_t file type. that's the doorway, the portal, the little "come in bestie" mat. ✨

the default entrypoint paths for the openshift_script_t domain are the following:

and then... nothing. the list is literally empty on this page. 🙈 i'm not gonna invent paths for you, that would be lying and lying is not cute. so: the list of default entrypoint paths is empty here. moving on! 🎀

---

👑 PROCESS TYPES 👑

okay so, real talk: SELinux defines process types (domains) for each process running on the system. every process gets a little label. an aura, if you will. 🌈

you can see the context of a process using the -Z option to ps. it's the same -Z from before. consistency icon. ⭐

policy governs the access confined processes have to files. and the SELinux openshift_script policy is very flexible — it allows users to set up their openshift_script processes in as secure a method as possible. flexible and secure? we love a multitasker. 💖

the following process types are defined for openshift_script:

• openshift_script_t

note: semanage permissive -a openshift_script_t can be used to make the process type openshift_script_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it won't stop you, but it will be taking notes 📝 and it will be telling on you in the logs. 😭

---

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required. the openshift_script policy is extremely flexible and has several booleans that allow you to manipulate the policy and run openshift_script with the tightest access possible. tightest access = smallest possible vibe, security-wise. iconic. 🔥

so here are the three booleans, no gatekeeping:

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. enabled by default.

setsebool -P fips_mode 1

• httpd_enable_cgi — if you want to allow httpd cgi support, you must turn on the httpd_enable_cgi boolean. enabled by default.

setsebool -P httpd_enable_cgi 1

• nis_enabled — if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. disabled by default. (yes, this one you actually have to turn on. it's the shy one. 🙈)

setsebool -P nis_enabled 1

and that's the whole boolean situation. short list, but honestly? quality over quantity. 🎀

---

📁 MANAGED FILES 📁

the SELinux process type openshift_script_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. 💜

• openshift_rw_content_t

important: note the processes UID still need to have DAC permissions. SELinux being chill about it does not override regular Unix permissions, bestie. both vibes must align. 🤝

---

🧚 COMMANDS 🧚

a few tools you can use alongside this policy — collect them like little Pokémon:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. (a GUI! for when the terminal is doing too much and you just want to click things 🖱️✨)

---

💀 AUTHOR 💀

this manual page was auto-generated using sepolicy manpage . yes, a robot wrote it. no, it did not have main character energy. that's why i'm here. 😌

---

🔍 SEE ALSO 🔍

go read these next, they're the friend group:

selinux(8), openshift_script(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the page, bestie! it's openshift_script, dated 26-10-06, from the openshif..._selinux(8) family — auto-generated, but now with ✨personality✨. go forth and be secure. mwah 💖🎀🦋