RHEV_AGENTD_CONSOLEHELPER_SELINUX(8)

💖 NAME 💖

rhev_agentd_consolehelper_selinux — Security Enhanced Linux Policy for the rhev_agentd_consolehelper processes. This is the rhev_a...selinux(8) page, bestie, and it's lowkey the SELinux policy manual for rhev_agentd_consolehelper. 🫶

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the rhev_agentd_consolehelper processes via flexible mandatory access control. That's the whole main character energy of this page, no cap. 👑

The rhev_agentd_consolehelper processes execute with the rhev_agentd_consolehelper_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep rhev_agentd_consolehelper_t

🚪 ENTRYPOINTS 🚪

The rhev_agentd_consolehelper_t SELinux type can be entered via the consolehelper_exec_t file type. It's giving one very specific doorway, fr fr. 🚪

The default entrypoint paths for the rhev_agentd_consolehelper_t domain are the following:

/usr/bin/consolehelper

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux rhev_agentd_consolehelper policy is very flexible allowing users to setup their rhev_agentd_consolehelper processes in as secure a method as possible. Obsessed with the flexibility tbh. ✨

The following process types are defined for rhev_agentd_consolehelper:

• rhev_agentd_consolehelper_t

Note: semanage permissive -a rhev_agentd_consolehelper_t can be used to make the process type rhev_agentd_consolehelper_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So it's not a get-out-of-jail-free card — the receipts still show up 😭.

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. rhev_agentd_consolehelper policy is extremely flexible and has several booleans that allow you to manipulate the policy and run rhev_agentd_consolehelper with the tightest access possible. Periodt. 💅

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow confined applications to run with kerberos, you must turn on the kerberos_enabled boolean. Enabled by default.

setsebool -P kerberos_enabled 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

📁 MANAGED FILES 📁

The SELinux process type rhev_agentd_consolehelper_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions.

• faillog_t

/var/log/btmp.*
/var/log/faillog.*
/var/log/tallylog.*
/var/run/faillock(/.*)?

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• lastlog_t

/var/log/lastlog.*

• security_t

/selinux

• systemd_passwd_var_run_t

/var/run/systemd/ask-password(/.*)?
/var/run/systemd/ask-password-block(/.*)?

• user_tmp_type — all user tmp files 🍓

🛠️ COMMANDS 🛠️

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. It's giving handy little GUI moment, iykyk. 🖥️

💌 AUTHOR 💌

This manual page was auto-generated using sepolicy manpage .

👀 SEE ALSO 👀

• selinux(8)
• rhev_agentd_consolehelper(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

That's the whole page, bestie 🫶 — footer vibes: source/version rhev_agentd_consolehelper, date 26-10-23, and manual tag rhev_a...selinux(8). Slay securely and stay iconic. 💅✨