setroub...selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💖 setroub...selinux(8) 💖

Hey bestie, welcome to the manual page for setroubleshoot_fixit_selinux — yes, that's the real name, and yes, it's a whole mouthful. It's section 8 of the manual, and it's all about the Security Enhanced Linux Policy for the setroubleshoot_fixit processes. Slay.

🌸 NAME 🌸

setroubleshoot_fixit_selinux — Security Enhanced Linux Policy for the setroubleshoot_fixit processes. That's the whole vibe. Security, but make it mandatory access control. 💅

✨ DESCRIPTION ✨

Okay so, Security-Enhanced Linux secures the setroubleshoot_fixit processes via flexible mandatory access control. That's the whole point.

The setroubleshoot_fixit processes execute with the setroubleshoot_fixit_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. Like this:

ps -eZ | grep setroubleshoot_fixit_t

That command is literally gonna show you if your processes are living their best life under that type. Run it, bestie. 🫶

🎀 ENTRYPOINTS 🎀

The setroubleshoot_fixit_t SELinux type can be entered via the setroubleshoot_fixit_exec_t file type. That's the gateway, the main character entrance.

The default entrypoint paths for the setroubleshoot_fixit_t domain are the following:

/usr/share/setroubleshoot/SetroubleshootFixit.py*

That's where the magic happens. Note the little asterisk at the end — that's regex energy, keep it exactly as is. ⭐

🦋 PROCESS TYPES 🦋

SELinux defines process types (also known as domains) for each process running on the system. Yes, every single one. It's giving organized.

You can see the context of a process using the -Z option to ps. Like I said up top, that's your bestie for checking contexts.

Policy governs the access confined processes have to files. SELinux setroubleshoot_fixit policy is very flexible, allowing users to set up their setroubleshoot_fixit processes in as secure a method as possible. That's the goal, periodt. 🔥

The following process types are defined for setroubleshoot_fixit:

  • setroubleshoot_fixit_t — the one and only. Iconic.
Note: semanage permissive -a setroubleshoot_fixit_t can be used to make the process type setroubleshoot_fixit_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it's not a free pass, you'll still see the receipts. 💀

🧚 BOOLEANS 🧚

SELinux policy is customizable based on least access required. setroubleshoot_fixit policy is extremely flexible and has several booleans that allow you to manipulate the policy and run setroubleshoot_fixit with the tightest access possible. It's giving options, and we love that for us.

  • If you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default. That's the default, no cap.
setsebool -P daemons_dontaudit_scheduling 1
  • If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. Another one that's already on, slay.
setsebool -P fips_mode 1
  • If you want to allow the system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. This one you actually gotta turn on yourself, bestie.
setsebool -P nis_enabled 1

That -P flag makes it persistent, so it sticks around after reboot. You're welcome. 💜

🌈 MANAGED FILES 🌈

The SELinux process type setroubleshoot_fixit_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions. So like, SELinux isn't gonna override regular Unix permissions, okay? Both things matter.

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

setroubleshoot_fixit_tmp_t

No default paths listed. It's giving mystery. 🙈

setroubleshoot_fixit_tmpfs_t

Also no default paths listed. Another icon of ambiguity. ✨

💅 FILE CONTEXTS 💅

SELinux requires files to have an extended attribute to define the file type. That's the whole labeling system, and it's non-negotiable.

You can see the context of a file using the -Z option to ls. Just like with ps, the -Z is your friend here.

Policy governs the access confined processes have to these files. SELinux setroubleshoot_fixit policy is very flexible, allowing users to set up their setroubleshoot_fixit processes in as secure a method as possible. (Yes, it's the same sentence as before, but it's still true, okay?)

🎀 STANDARD FILE CONTEXT 🎀

SELinux defines the file context types for the setroubleshoot_fixit, if you wanted to store files with these types in different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

Like this, bestie:

semanage fcontext -a -t setroubleshoot_fixit_exec_t '/srv/setroubleshoot_fixit/content(/.*)?'
restorecon -R -v /srv/mysetroubleshoot_fixit_content

That's the one-two punch. semanage sets the rule, restorecon applies it. Don't skip the second step or it's not gonna stick. Fr fr.

Note: SELinux often uses regular expressions to specify labels that match multiple files. So those (/.*)? bits are regex — keep them exactly as they are. 🔥

The following file types are defined for setroubleshoot_fixit:

  • setroubleshoot_fixit_exec_t — Set files with the setroubleshoot_fixit_exec_t type, if you want to transition an executable to the setroubleshoot_fixit_t domain. That's the entrypoint type, the one that starts the whole transition.
  • setroubleshoot_fixit_tmp_t — Set files with the setroubleshoot_fixit_tmp_t type, if you want to store setroubleshoot fixit temporary files in the /tmp directories. Temporary files, temporary type. Makes sense.
  • setroubleshoot_fixit_tmpfs_t — Set files with the setroubleshoot_fixit_tmpfs_t type, if you want to store setroubleshoot fixit files on a tmpfs file system. For when you're living in memory, not on disk. Iconic.
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. So like, chcon is the quick fix, semanage fcontext is the forever fix. Choose wisely. 💀

⭐ COMMANDS ⭐

  • semanage fcontext can also be used to manipulate default file context mappings. That's your go-to for permanent labeling rules.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive. You saw this up in the process types section.
  • semanage module can also be used to enable/disable/install/remove policy modules. Module management, periodt.
  • semanage boolean can also be used to manipulate the booleans. For all your boolean-toggling needs.
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. Yes, a GUI. Some people like clicking, and that's valid. 🖱️

🌸 AUTHOR 🌸

This manual page was auto-generated using sepolicy manpage. Not by a human, by a script. Still slayed though.

🫶 SEE ALSO 🫶

selinux(8), setroubleshoot_fixit(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

Go read those if you want the full lore. Iykyk. 📚

💖 And that's the whole page, bestie! This was setroubleshoot_fixit from the SELinux Policy setroubleshoot_fixit manual, dated 26-10-06, and you can find it in section 8 of the manual. Stay secure, stay slay. 💅✨

📦 where this page comes from