samba_u...selinux(8)

💅 samba_unconfined_net_selinux(8) — the glow-up

okay so bestie, welcome to the samba_unconfined_net_selinux manual page 💖 it lives in section 8 of the SELinux Policy samba_unconfined_net manual, and we're gonna get you all caught up on what this policy actually does.

---

✨ NAME ✨

samba_unconfined_net_selinux — the whole Security Enhanced Linux policy sitch for the samba_unconfined_net processes 🫶

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux keeps the samba_unconfined_net processes in check via flexible mandatory access control. like, it's not vibes-based security, it's policy-based security ✨

The samba_unconfined_net processes run with the samba_unconfined_net_t SELinux type. Wanna check if you've got any of these running? Just run ps with the -Z qualifier, periodt:

ps -eZ | grep samba_unconfined_net_t

---

🦋 ENTRYPOINTS 🦋

The samba_unconfined_net_t SELinux type can be entered via the samba_net_exec_t file type. that's the door, iykyk 🚪

The default entrypoint paths for the samba_unconfined_net_t domain are literally just:

/usr/bin/net

---

👑 PROCESS TYPES 👑

SELinux defines process types (aka domains) for every process running on the system — yes, every one, main character energy for all of them 💅

You can peep the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. The SELinux samba_unconfined_net policy is very flexible, letting users set up their samba_unconfined_net processes in as secure a method as possible 🔥

So here's the process type defined for samba_unconfined_net:

• samba_unconfined_net_t

Note: semanage permissive -a samba_unconfined_net_t can be used to make the process type samba_unconfined_net_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it won't block you, but it will be watching 👀

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. The samba_unconfined_net policy is extremely flexible and has several booleans that let you manipulate the policy and run samba_unconfined_net with the tightest access possible. tiny little switches, huge consequences 💖

---

the booleans, one by one 🍓

• deny_execmem — turn this on if you want to deny user domains applications the ability to map a memory region as both executable and writable. ngl this is dangerous, and the executable should be reported in bugzilla 😭 Disabled by default.

setsebool -P deny_execmem 1

• mmap_low_allowed — turn this on if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr. Disabled by default.

setsebool -P mmap_low_allowed 1

• secure_mode_insmod — turn this on if you want to disable kernel module loading. Disabled by default.

setsebool -P secure_mode_insmod 1

• selinuxuser_execheap — allows unconfined executables to make their heap memory executable. doing this is a really bad idea 💀 probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execheap 1

• selinuxuser_execstack — allows unconfined executables to make their stack executable. this should never, ever be necessary 🙈 probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execstack 1

---

🌈 MANAGED FILES 🌈

The SELinux process type samba_unconfined_net_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. also heads up: the process's UID still needs to have DAC permissions, so don't get it twisted 🫶

• file_type
  • all files on the system 👀 like, all of them

---

⭐ COMMANDS ⭐

here's your toolbelt, bestie — go off:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI, for the mouse girlies 🖱️✨

---

💜 AUTHOR 💜

This manual page was auto-generated using sepolicy manpage. the robots did this one, not me 🤖💅

---

💀 SEE ALSO 💀

selinux(8), samba_unconfined_net(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page, bestie 🎀

little sign-off from the footer: samba_unconfined_net, dated 26-10-06, living at samba_u...selinux(8). slay, go secure your processes 💖✨