qmail_rspawn_selinux(8)

🌸 qmail_rspawn_selinux — okay bestie, let's talk SELinux policy for qmail_rspawn ✨

So this is the manual page for qmail_rspawn_selinux, which lives under the qmail_rspawn SELinux policy section of your man pages. Yes it's a mouthful, no I will not be shortening it. Let's get into it 💅

---

✨ NAME ✨

qmail_rspawn_selinux — the Security Enhanced Linux Policy for the qmail_rspawn processes, bestie. That's the whole vibe.

---

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the qmail_rspawn processes via flexible mandatory access control. Lowkey iconic of it, honestly.

The qmail_rspawn processes execute with the qmail_rspawn_t SELinux type. Wanna check if you've got these processes running? Run the ps command with the -Z qualifier. Periodt.

For example:

ps -eZ | grep qmail_rspawn_t

That's it. That's the whole check. You're welcome 🫶

---

🎀 ENTRYPOINTS 🎀

The qmail_rspawn_t SELinux type can be entered via the qmail_rspawn_exec_t file type. That's the doorway, no cap.

The default entrypoint paths for the qmail_rspawn_t domain are the following:

/var/qmail/bin/qmail-rspawn

One path. One singular iconic path. Not me being obsessed with how tidy that is 😭

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. Every process gets a lil identity, and honestly? Main character energy.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux qmail_rspawn policy is very flexible, allowing users to setup their qmail_rspawn processes in as secure a method as possible.

The following process types are defined for qmail_rspawn:

• qmail_rspawn_t

Note: semanage permissive -a qmail_rspawn_t can be used to make the process type qmail_rspawn_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like… it stops blocking stuff, but it's still gonna snitch to you in the logs, iykyk 🙈

---

🌈 BOOLEANS 🌈

SELinux policy is customizable based on least access required. The qmail_rspawn policy is extremely flexible and has several booleans that allow you to manipulate the policy and run qmail_rspawn with the tightest access possible. We love a configurable queen 💜

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

Yeah, -P — that's the persistent one, don't forget it or it's giving "why did my setting disappear after reboot" 💀

---

🧚 MANAGED FILES 🧚

The SELinux process type qmail_rspawn_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux isn't out here doing DAC's job for it, fr fr.

• qmail_spool_t
  • /var/qmail/queue(/.*)?

That regex at the end is doing so much heavy lifting and honestly? Slay.

---

⭐ FILE CONTEXTS ⭐

SELinux requires files to have an extended attribute to define the file type. Fancy little labels on everything, we stan 🎀

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. SELinux qmail_rspawn policy is very flexible, allowing users to setup their qmail_rspawn processes in as secure a method as possible.

💖 STANDARD FILE CONTEXT 💖

SELinux defines the file context types for the qmail_rspawn. If you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

semanage fcontext -a -t qmail_rspawn_exec_t '/srv/qmail_rspawn/content(/.*)?'
restorecon -R -v /srv/myqmail_rspawn_content

Look at that. Two lines. One tells SELinux the rule, the other actually stamps it onto the disk. That's the duo, the dynamic pair, the leading ladies 🔥

Note: SELinux often uses regular expressions to specify labels that match multiple files. Regex girlies rise up ✨

The following file types are defined for qmail_rspawn:

• qmail_rspawn_exec_t
  • Set files with the qmail_rspawn_exec_t type if you want to transition an executable to the qmail_rspawn_t domain.

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. So chcon is the temporary tattoo and semanage fcontext + restorecon is the actual commitment, no cap 💅

---

🫶 COMMANDS 🫶

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. A whole GUI, for when the terminal isn't the mood 😌

---

💀 AUTHOR 💀

This manual page was auto-generated using sepolicy manpage.

Not me, not a human, a script. It ate though, ngl.

---

🌸 SEE ALSO 🌸

selinux(8), qmail_rspawn(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

Go read those too, bestie, they're all part of the lore 📚

---

Alright, that's the whole page! This little number is from the qmail_rspawn package, dated 26-10-06, and yes — it's qmail_rspawn_selinux(8), the one and only. Go forth and label your files correctly, queen 👑💖