remote_login_selinux(8)

💅 remote_login_selinux — the SELinux glow-up for your login processes ✨

okay so bestie, this page is literally all about the SELinux policy for remote_login processes — the manual name is remote_login_selinux, and it's giving "security but make it structured." 🎀 We're talking the remote_login_selinux(8) zone, and I'm gonna walk you through it like we're texting at 2am. 🫶

---

✨ NAME ✨

remote_login_selinux — Security Enhanced Linux Policy for the remote_login processes. periodt. 💅

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the remote_login processes via flexible mandatory access control. no cap, it's literally the bouncer at the club for your login daemons. 🔥

The remote_login processes execute with the remote_login_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep remote_login_t

like, go check bestie, it's giving "who's running and what's their vibe check." 👑

---

🦋 ENTRYPOINTS 🦋

The remote_login_t SELinux type can be entered via the login_exec_t file type.

The default entrypoint paths for the remote_login_t domain are the following:

/usr/bin/login, /usr/kerberos/sbin/login.krb5

these are the doors your process walks through to become main character energy. 🚪✨

---

💜 PROCESS TYPES 💜

SELinux defines process types (domains) for each process running on the system. it's like every process gets its own little label and identity. 🏷️

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux remote_login policy is very flexible allowing users to setup their remote_login processes in as secure a method as possible. lowkey obsessed with how customizable this is. 😭

The following process types are defined for remote_login:

remote_login_t

Note: semanage permissive -a remote_login_t can be used to make the process type remote_login_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so it's like "we're not gonna stop you, but we're definitely taking notes." 📝💀

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. remote_login policy is extremely flexible and has several booleans that allow you to manipulate the policy and run remote_login with the tightest access possible. it's giving "choose your own adventure but make it secure." 🧚

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

like yes bestie, flip that switch. ✅

If you want to allow confined applications to run with kerberos, you must turn on the kerberos_enabled boolean. Enabled by default.

setsebool -P kerberos_enabled 1

kerberos stans rise. 🎫

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

only turn this on if you actually need NIS, okay? it's giving legacy vibe. 🕰️

If you want to enable polyinstantiated directory support, you must turn on the polyinstantiation_enabled boolean. Disabled by default.

setsebool -P polyinstantiation_enabled 1

polyinstantiation is that girl with the multiple personalities but make it directories. 🌈

---

💖 MANAGED FILES 💖

The SELinux process type remote_login_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions. like, SELinux isn't doing your regular user permission homework for you, bestie. 🫶

auth_cache_t

/var/cache/coolkey(/.*)?

auth_home_t

/root/.yubico(/.*)?
/root/.config/Yubico(/.*)?
/root/.google_authenticator
/root/.google_authenticator~
/home/[^/]+/.yubico(/.*)?
/home/[^/]+/.config/Yubico(/.*)?
/home/[^/]+/.google_authenticator
/home/[^/]+/.google_authenticator~

the way these are all about auth keys and yubico and google authenticator… 2FA icon behavior. 🔐

faillog_t

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

failed login logs live here, so you can be nosy about who tried to break in. 👀

initrc_var_run_t

/run/sysconfig(/.*)?
/run/utmp
/run/keymap
/run/numlock-on
/run/setleds-on
/run/runlevel.dir
/run/setmixer_flag
/run/bootsplashctl

runtime system files with main character energy. 🖥️

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

kerberos credential cache realness. 🎟️

pam_var_console_t

/run/console(/.*)?

pam_var_run_t

/var/(db|adm)/sudo(/.*)?
/run/sudo(/.*)?
/run/pam_ssh(/.*)?
/run/sepermit(/.*)?
/var/lib/sudo(/.*)?
/run/pam_mount(/.*)?
/run/pam_timestamp(/.*)?

PAM runtime state, aka the "who touched sudo last" files. 💅

security_t

/selinux

the SELinux filesystem itself — iconic. 🛡️

user_tmp_t

/run/tlog(/.*)?
/run/user/[^/]+
/dev/shm/mono.*
/tmp/.ICE-unix(/.*)?
/tmp/.X11-unix(/.*)?
/dev/shm/pulse-shm.*
/run/user
/tmp/.X0-lock
/tmp/hsperfdata_root
/var/tmp/hsperfdata_root
/home/[^/]+/tmp
/home/[^/]+/.tmp
/run/user/[0-9]+
/tmp/gconfd-[^/]+

user temp files — chaotic but necessary. 🗂️

var_auth_t

/var/ace(/.*)?
/var/rsa(/.*)?
/var/lib/abl(/.*)?
/var/lib/rsa(/.*)?
/var/lib/pam_ssh(/.*)?
/var/lib/pam_shield(/.*)?
/var/opt/quest/vas/vasd(/.*)?
/var/lib/google-authenticator(/.*)?

more auth storage, because security loves a sequel. 🍓

wtmpdb_journal_t

/var/lib/wtmpdb/wtmp.db-journal

the journal file for wtmpdb — tiny but important. 📓

---

⭐ COMMANDS ⭐

semanage fcontext can also be used to manipulate default file context mappings. (yes, that's the actual literal command name, bestie, i'm not fixing the spacing.) 🛠️

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. for when you want to click instead of type, and honestly same. 🖱️✨

---

🌈 AUTHOR 🌈

This manual page was auto-generated using sepolicy manpage. so it's not a human author, it's a script doing its little robot thing. 🤖💅

---

👑 SEE ALSO 👑

selinux(8), remote_login(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

like, go read those if you want the full lore. iykyk. 📚🦋

---

and that's the whole vibe check, bestie. this page is from remote_login on 26-10-06 — so go forth, run your remote_login processes, and slay securely. 💖✨🎀