pcp_plugin_selinux(8)

📦 version 38.1.87, in centos-stream 9

✨ pcp_plugin_selinux ✨

Okay bestie, so this is the manual for pcp_plugin_selinux — it's the SELinux policy page for the pcp_plugin processes, and honestly? It's giving security icon energy. This page lives in the pcp_plugin manual section and it's about to tell you everything you need to know. Let's get into it 💅

🌸 NAME 🌸

pcp_plugin_selinux — Security Enhanced Linux Policy for the pcp_plugin processes 🫶

💖 DESCRIPTION 💖

Security-Enhanced Linux secures the pcp_plugin processes via flexible mandatory access control. No cap, that's the whole vibe — SELinux is here to keep things locked down.

The pcp_plugin processes execute with the pcp_plugin_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep pcp_plugin_t

That's it, that's the move 🎀

🦋 ENTRYPOINTS 🦋

The pcp_plugin_t SELinux type can be entered via the pcp_plugin_exec_t file type. Literally the doorway into the domain.

The default entrypoint paths for the pcp_plugin_t domain are the following:

/var/lib/pcp/pmdas/.*/Remove, /var/lib/pcp/pmdas/.*/Install,
/var/lib/pcp/pmdas/.*/Upgrade

Those three paths are it — Remove, Install, Upgrade. Periodt 🔥

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux pcp_plugin policy is very flexible allowing users to setup their pcp_plugin processes in as secure a method as possible. Like, genuinely flexible, not fake-flexible.

The following process types are defined for pcp_plugin:

  • pcp_plugin_t
💀 Note: semanage permissive -a pcp_plugin_t can be used to make the process type pcp_plugin_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it's ✨ chill ✨ now, but it's still snitching to the logs. iykyk.

🌈 BOOLEANS 🌈

SELinux policy is customizable based on least access required. pcp_plugin policy is extremely flexible and has several booleans that allow you to manipulate the policy and run pcp_plugin with the tightest access possible. This is where you get to customize your whole setup, bestie 🎀

If you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

If you want to deny user domains applications to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla, you must turn on the deny_execmem boolean. Disabled by default.

setsebool -P deny_execmem 1

If you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on the mmap_low_allowed boolean. Disabled by default.

setsebool -P mmap_low_allowed 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

If you want to disable kernel module loading, you must turn on the secure_mode_insmod boolean. Disabled by default.

setsebool -P secure_mode_insmod 1

If you want to allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla, you must turn on the selinuxuser_execheap boolean. Disabled by default.

setsebool -P selinuxuser_execheap 1
🚨 Bestie I'm begging you — execheap is giving red flags, report that executable, do NOT just vibe with it.

If you want to allow unconfined executables to make their stack executable. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla, you must turn on the selinuxuser_execstack boolean. Enabled by default.

setsebool -P selinuxuser_execstack 1
😭 "never, ever be necessary" — the manpage said what it said and honestly? It ate.

🌸 MANAGED FILES 🌸

The SELinux process type pcp_plugin_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux isn't out here overriding DAC, they're a team.

file_type

all files on the system

Yeah. All of them. The audacity, honestly, but okay 💅

💜 FILE CONTEXTS 💜

SELinux requires files to have an extended attribute to define the file type. That's just how it is, fr fr.

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. SELinux pcp_plugin policy is very flexible allowing users to setup their pcp_plugin processes in as secure a method as possible.

The following file types are defined for pcp_plugin:

pcp_plugin_exec_t

  • Set files with the pcp_plugin_exec_t type, if you want to transition an executable to the pcp_plugin_t domain.

Paths:

/var/lib/pcp/pmdas/.*/Remove, /var/lib/pcp/pmdas/.*/Install,
/var/lib/pcp/pmdas/.*/Upgrade

pcp_plugin_initrc_exec_t

  • Set files with the pcp_plugin_initrc_exec_t type, if you want to transition an executable to the pcp_plugin_initrc_t domain.
🦋 Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. Temporary vs permanent — know the difference bestie, it matters 🎀

⭐ COMMANDS ⭐

semanage fcontext can also be used to manipulate default file context mappings. Iconic.

semanage permissive can also be used to manipulate whether or not a process type is permissive. Also iconic.

semanage module can also be used to enable/disable/install/remove policy modules. The multitasker of the group.

semanage boolean can also be used to manipulate the booleans. Slay.

system-config-selinux is a GUI tool available to customize SELinux policy settings. For when you want the whole point-and-click experience, and honestly? Valid.

🎀 AUTHOR 🎀

This manual page was auto-generated using sepolicy manpage . — the robot wrote it, I just gave it the group chat energy ✨

💖 SEE ALSO 💖

selinux(8), pcp_plugin(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

And that's the whole page bestie! 🫶 This was pcp_plugin from 26-10-23, living its best life in pcp_plugin_selinux(8). Go forth, set those booleans wisely, and remember — the manpage said "never, ever" and meant it. Mwah 💋✨

📦 where this page comes from