secadm_selinux(8)

💅 secadm_selinux — like, the whole page, bestie

okay so this is secadm_selinux(8), the secadm SELinux Policy documentation, and I'm literally about to walk you through it. grab a snack 🍓

---

✨ NAME ✨

secadm_r — the Security administrator role, in Security Enhanced Linux Policy. she's the main character of this page, fr fr 👑

---

🌸 DESCRIPTION 🌸

okay so first thing: SELinux supports Roles Based Access Control (RBAC). some Linux roles are login roles, and other roles need to be transitioned into. it's giving two different species of role, honestly.

💡 Note: the examples in this man page will use the staff_u SELinux user. that's our guinea pig for the whole ride.

non-login roles are usually used for administrative tasks — like, stuff that requires root privileges. roles control which types a user can run processes with, and roles often have default types assigned to them.

the default type for the secadm_r role is secadm_t. noted. ✍️

there's the newrole program, which transitions directly to this role:

newrole -r secadm_r -t secadm_t

but sudo is the preferred method to do a transition from one role to another. to set up sudo to transition to secadm_r, you add a similar line to the /etc/sudoers file:

USERNAME ALL=(ALL) ROLE=secadm_r TYPE=secadm_t COMMAND

and then sudo will run COMMAND as staff_u:secadm_r:secadm_t:LEVEL. slay.

when you're using a non-login role, you need to set up SELinux so that your SELinux user can actually reach the secadm_r role. like, she can't come to the party if she's not on the list. 🎀

run this to see all of the assigned SELinux roles:

semanage user -l

then you need to add secadm_r to the staff_u user. you could set up the staff_u user to be able to use the secadm_r role with a command like:

$ semanage user -m -R 'staff_r system_r secadm_r' staff_u

SELinux policy also controls which roles can transition to a different role. you can list these rules using the following command:

search --role_allow

and here's the tea ☕: SELinux policy allows the sysadm_r, staff_r, and auditadm_r roles to transition to the secadm_r role. iconic lineup, honestly.

---

🦋 BOOLEANS 🦋

SELinux policy is customizable based on least access required. the secadm policy is extremely flexible and has several booleans that let you manipulate the policy and run secadm with the tightest access possible. very much "customize your own adventure" energy.

• deny_execmem — if you want to deny user domains applications from mapping a memory region as both executable and writable, you must turn on this boolean. heads up: this is dangerous, and the executable should be reported in bugzilla. disabled by default.

setsebool -P deny_execmem 1

• deny_ptrace — if you want to deny any process from ptrace-ing or debugging any other processes, you must turn on this boolean. disabled by default.

setsebool -P deny_ptrace 1

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on this boolean. enabled by default.

setsebool -P fips_mode 1

• nis_enabled — if you want to allow the system to run with NIS, you must turn on this boolean. disabled by default.

setsebool -P nis_enabled 1

• selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, you must turn on this boolean. and like… this should never, ever be necessary. it probably indicates a badly coded executable, but it could indicate an attack. that executable should be reported in bugzilla. disabled by default. 🚨

setsebool -P selinuxuser_execstack 1

• use_nfs_home_dirs — if you want to support NFS home directories, you must turn on this boolean. enabled by default.

setsebool -P use_nfs_home_dirs 1

• use_samba_home_dirs — if you want to support SAMBA home directories, you must turn on this boolean. disabled by default.

setsebool -P use_samba_home_dirs 1

---

🧚 MANAGED FILES 🧚

the SELinux process type secadm_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. important caveat bestie: the process's UID still needs to have DAC permissions. no cap.

boolean_type

(no default paths listed for this one 💅)

default_context_t

/etc/selinux/([^/]*/)?contexts(/.*)?
/root/.default_contexts

dosfs_t

(no default paths listed for this one either 🫶)

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

screen_home_t

/root/.screen(/.*)?
/root/.screenrc
/root/.tmux.conf
/home/[^/]+/.screen(/.*)?
/home/[^/]+/.screenrc
/home/[^/]+/.tmux.conf

security_t

/selinux

selinux_config_t

/etc/selinux(/.*)?
/etc/selinux/([^/]*/)?seusers
/etc/selinux/([^/]*/)?users(/.*)?
/etc/selinux/([^/]*/)?setrans.conf
/var/lib/sepolgen(/.*)?

selinux_login_config_t

/etc/selinux/([^/]*/)?logins(/.*)?

semanage_store_t

/etc/selinux/([^/]*/)?policy(/.*)?
/etc/selinux/([^/]*/)?modules/(active|tmp|previous)(/.*)?
/etc/selinux/(minimum|mls|targeted)/(active|tmp|previous)(/.*)?
/var/lib/selinux(/.*)?
/etc/share/selinux/mls(/.*)?
/etc/share/selinux/targeted(/.*)?

systemd_passwd_var_run_t

/run/systemd/ask-password(/.*)?
/run/systemd/ask-password-block(/.*)?

user_tmp_type

all user tmp files, bestie. every single one. 🗂️

---

🌈 COMMANDS 🌈

a few little helpers you can call on, because knowing these is highkey a flex:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI. for those of us who like clicking. 🖱️

---

💜 AUTHOR 💜

this manual page was auto-generated using sepolicy manpage. a bot wrote this. and honestly? she ate. 💀

---

⭐ SEE ALSO ⭐

selinux(8), secadm(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8), secadm_screen_selinux(8), secadm_screen_selinux(8), secadm_su_selinux(8), secadm_su_selinux(8), secadm_sudo_selinux(8), secadm_sudo_selinux(8)

(yes, some of those are listed twice. that's how the original rolls, and I'm not about to gatekeep the duplicates. iykyk 🌸)

---

okay that's the whole page!! 🎀 brought to you by mgrepl@redhat.com, for secadm, in the secadm_selinux(8) manual — go forth and secure-admin responsibly. periodt. 💅✨