rssh_chr..._selinux(8)

💅 rssh_chr..._selinux(8) — the manual, bestie edition

okay so you opened rssh_chr..._selinux(8) and you're like "what is this even" — don't worry, i gotchu. this is the whole thing, vibes included, facts untouched. 🫶

---

✨ NAME ✨

rssh_chroot_helper_selinux — the Security Enhanced Linux Policy for the rssh_chroot_helper processes. like, the ruleset that decides what those processes are allowed to do. no cap.

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the rssh_chroot_helper processes via flexible mandatory access control. yes bestie, that's the whole point — it's not vibes-based security, it's policy-based security.

The rssh_chroot_helper processes execute with the rssh_chroot_helper_t SELinux type. wanna check if you've got these processes running? run the ps command with the -Z qualifier.

for example:

ps -eZ | grep rssh_chroot_helper_t

look at you go, checking contexts like a main character. 👑

---

🚪 ENTRYPOINTS 🚪

The rssh_chroot_helper_t SELinux type can be entered via the rssh_chroot_helper_exec_t file type. that's the door, bestie.

The default entrypoint paths for the rssh_chroot_helper_t domain are the following:

/usr/libexec/rssh_chroot_helper

one door, one path, very exclusive. 💅

---

🧬 PROCESS TYPES 🧬

SELinux defines process types (domains) for each process running on the system. and yes, "domain" here is not a website. 🙈

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. the SELinux rssh_chroot_helper policy is very flexible, allowing users to setup their rssh_chroot_helper processes in as secure a method as possible.

The following process types are defined for rssh_chroot_helper:

• rssh_chroot_helper_t

Note: semanage permissive -a rssh_chroot_helper_t can be used to make the process type rssh_chroot_helper_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated.

so like, permissive = "i see you, i'm just not gonna stop you." the receipts (AVC messages) still get printed though. 📝

---

🎚️ BOOLEANS 🎚️

SELinux policy is customizable based on least access required. the rssh_chroot_helper policy is extremely flexible and has several booleans that allow you to manipulate the policy and run rssh_chroot_helper with the tightest access possible. little switches, big power. ✨

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

that -P is the "make it permanent bestie" flag, iykyk. 💖

---

📂 MANAGED FILES 📂

The SELinux process type rssh_chroot_helper_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux is not out here overriding DAC, it's a whole separate layer. 🧚

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

that regex (/.*)? at the end of one of those? that's SELinux being like "and everything under here too, periodt." 🌈

---

🏷️ FILE CONTEXTS 🏷️

SELinux requires files to have an extended attribute to define the file type. it's literally how files get their little name tags. 🎀

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. the SELinux rssh_chroot_helper policy is very flexible, allowing users to setup their rssh_chroot_helper processes in as secure a method as possible.

📁 STANDARD FILE CONTEXT 📁

SELinux defines the file context types for the rssh_chroot_helper. if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

semanage fcontext -a -t rssh_chroot_helper_exec_t \
'/srv/rssh_chroot_helper/content(/.*)?'
restorecon -R -v /srv/myrssh_chroot_helper_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. regex girlies rise. 🔥

The following file types are defined for rssh_chroot_helper:

• rssh_chroot_helper_exec_t — Set files with the rssh_chroot_helper_exec_t type, if you want to transition an executable to the rssh_chroot_helper_t domain.

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels.

so: chcon = quick lil temporary glow-up. semanage fcontext = the actual database edit. restorecon = the part where it actually lands on disk. don't skip the last step bestie, the label won't apply itself. 😭

---

🛠️ COMMANDS 🛠️

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI. for the clickers among us. 🖱️✨

---

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. the robots wrote it, i just gave it a personality. 💀

---

🔗 SEE ALSO 🔗

selinux(8), rssh_chroot_helper(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those next, bestie, knowledge is a vibe. 📚🦋

---

and that's the whole page!! 💖 this was rssh_chroot_helper, dated 26-10-06, living under the rssh_chr..._selinux(8) header — slay, go label some files responsibly. 🧚‍♀️⭐