realmd_...selinux(8)

📦 version 38.1.87, in centos-stream 9

💅 realmd_...selinux(8) — SELinux Policy realmd_consolehelper 🎀

okay so bestie, welcome to the manual page for SELinux Policy realmd_consolehelper — yes that's the whole vibe, we're talking about the SELinux policy that keeps an eye on the realmd_consolehelper processes. pull up a chair, this is gonna be good ✨

🌸 NAME 🌸

realmd_consolehelper_selinux — the Security Enhanced Linux Policy for the realmd_consolehelper processes. that's it, that's the whole name section, she's simple and she's iconic 💅

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the realmd_consolehelper processes via flexible mandatory access control. no cap, that's the whole point of her 💖

The realmd_consolehelper processes execute with the realmd_consolehelper_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier. easy peasy 🍓

for example:

ps -eZ | grep realmd_consolehelper_t

look at you go, checking contexts like a main character 👑

🦋 ENTRYPOINTS 🦋

The realmd_consolehelper_t SELinux type can be entered via the consolehelper_exec_t file type. that's the doorway, bestie 🚪✨

The default entrypoint paths for the realmd_consolehelper_t domain are the following:

/usr/bin/consolehelper

one path, one queen, periodt 💅

🔥 PROCESS TYPES 🔥

SELinux defines process types (domains) for each process running on the system — yes, every single one gets a little label, it's giving personalized name tags at a party 🎀

You can see the context of a process using the -Z option to ps. slay, now you can peek at everyone's vibe check 👀

Policy governs the access confined processes have to files. the SELinux realmd_consolehelper policy is very flexible, allowing users to setup their realmd_consolehelper processes in as secure a method as possible. flexible and secure, she's multitasking 💖

The following process types are defined for realmd_consolehelper:

  • realmd_consolehelper_t
Note: semanage permissive -a realmd_consolehelper_t can be used to make the process type realmd_consolehelper_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, she's chill now but she's still taking notes 📝😭

🌈 BOOLEANS 🌈

SELinux policy is customizable based on least access required. the realmd_consolehelper policy is extremely flexible and has several booleans that allow you to manipulate the policy and run realmd_consolehelper with the tightest access possible. toggles on toggles, we love to see it ✨

  • deny_execmem — if you want to deny user domains applications to map a memory region as both executable and writable, you must turn on this boolean. 🚨 heads up bestie: this is dangerous and the executable should be reported in bugzilla. Disabled by default.
setsebool -P deny_execmem 1
  • mmap_low_allowed — if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on this boolean. Disabled by default.
setsebool -P mmap_low_allowed 1
  • nis_enabled — if you want to allow system to run with NIS, you must turn on this boolean. Disabled by default.
setsebool -P nis_enabled 1
  • secure_mode_insmod — if you want to disable kernel module loading, you must turn on this boolean. Disabled by default.
setsebool -P secure_mode_insmod 1
  • selinuxuser_execheap — if you want to allow unconfined executables to make their heap memory executable, you must turn on this boolean. 😭 okay so this is a really bad idea. it probably indicates a badly coded executable, but it could indicate an attack. the executable should be reported in bugzilla. Disabled by default.
setsebool -P selinuxuser_execheap 1
  • selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, you must turn on this boolean. 💀 this should never, ever be necessary. again, probably a badly coded executable, but could indicate an attack — report it in bugzilla. Enabled by default.
setsebool -P selinuxuser_execstack 1

🧚 MANAGED FILES 🧚

The SELinux process type realmd_consolehelper_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. ⚠️ note: the process's UID still needs to have DAC permissions — SELinux isn't doing all the work for you, bestie, you gotta bring your own permissions too.

  • file_type
    • all files on the system 🌍 (yes, all of them, she's ambitious)

👑 COMMANDS 👑

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage boolean can also be used to manipulate the booleans.
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. 🖱️✨ for the girlies who love a clicky interface

🫶 AUTHOR 🫶

This manual page was auto-generated using sepolicy manpage . yes, the robot wrote her, but she still ate 💅

💜 SEE ALSO 💜

selinux(8), realmd_consolehelper(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

and that's the whole page, bestie 🎀 go forth and configure your policy responsibly, ily, mwah 💖

cute little sign-off: this was realmd_consolehelper, rendered on 26-10-23, living under the realmd_...selinux(8) umbrella — see you in the next manpage, bye besties 🌸✨
📦 where this page comes from