polipo_se...n_selinux(8)

💅 polipo_session_selinux(8) — the SELinux policy page for polipo_session, bestie edition

okay so this is the manual page for polipo_session_selinux, which is the SELinux policy situation for the polipo_session processes. yes it's a whole thing, and yes i'm gonna walk you through it. grab a snack 🍓

---

✨ NAME ✨

polipo_session_selinux — Security Enhanced Linux Policy for the polipo_session processes

---

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the polipo_session processes via flexible mandatory access control. that's the whole vibe — SELinux is the friend who checks your outfit before you leave the house, except the outfit is syscalls.

The polipo_session processes execute with the polipo_session_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier, like:

ps -eZ | grep polipo_session_t

slay. that's it. that's the vibe check. 👑

---

🚪 ENTRYPOINTS 🚪

The polipo_session_t SELinux type can be entered via the polipo_exec_t file type. that's the doorway, the portal, the main character entrance.

The default entrypoint paths for the polipo_session_t domain are the following:

/usr/bin/polipo

one path. one icon. we love a minimalist queen. ✨

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. lowkey a whole taxonomy.

You can see the context of a process using the -Z option to ps. (yes, same flex as before, it's a recurring theme 💅)

Policy governs the access confined processes have to files. SELinux polipo_session policy is very flexible, allowing users to setup their polipo_session processes in as secure a method as possible.

The following process types are defined for polipo_session:

• polipo_session_t

Note: semanage permissive -a polipo_session_t can be used to make the process type polipo_session_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it stops saying no, but it still talks about it. messy but valid. 😭

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. polipo_session policy is extremely flexible and has several booleans that allow you to manipulate the policy and run polipo_session with the tightest access possible. booleans are basically little on/off switches and honestly they're iconic.

• polipo_session_bind_all_unreserved_ports — if you want to determine whether Polipo session daemon can bind tcp sockets to all unreserved ports, you must turn on this boolean. Disabled by default.

setsebool -P polipo_session_bind_all_unreserved_ports 1

• polipo_session_users — if you want to determine whether calling user domains can execute Polipo daemon in the polipo_session_t domain, you must turn on this boolean. Disabled by default.

setsebool -P polipo_session_users 1

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on this boolean. Enabled by default. (not me, she's already on 💅)

setsebool -P fips_mode 1

• nis_enabled — if you want to allow system to run with NIS, you must turn on this boolean. Disabled by default.

setsebool -P nis_enabled 1

---

🗂️ MANAGED FILES 🗂️

The SELinux process type polipo_session_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions — SELinux isn't doing everything for you, bestie, you still gotta have the regular perms. 🫶

• cifs_t — no default paths listed, she's mysterious like that.
• ecryptfs_t — with these paths:

/home/[^/]+/.Private(/.*)?
/home/[^/]+/.ecryptfs(/.*)?

• fusefs_t — with this path:

/run/user/[0-9]+/gvfs

• krb5_host_rcache_t — with these paths:

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• nfs_t — again, no default paths listed. she contains multitudes.
• polipo_cache_home_t — with this path:

/home/[^/]+/.polipo-cache(/.*)?

---

🛠️ COMMANDS 🛠️

like, these tools can also be used to do the things. iykyk.

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. a whole GUI, for the girlies who like clicking. 🖱️✨

---

🌸 AUTHOR 🌸

This manual page was auto-generated using sepolicy manpage.

(not me being auto-generated and still having more personality than half the manpages out there 💀)

---

🔥 SEE ALSO 🔥

selinux(8), polipo_session(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those too, they're the supporting cast and honestly they ate. 👑

---

k bye bestie 💖 this was polipo_session, dated 26-10-06, from the polipo_se...n_selinux(8) manual — see you in the group chat, mwah 🎀