sftpd_selinux(8)

💅 sftpd_selinux — bestie's guide to the SELinux policy for sftpd 🎀

okay so this is sftpd_selinux, section 8 of the manual (the one for admin commands, iykyk), and it's literally the whole rundown of the SELinux policy that wraps the sftpd processes. it's giving "niche but iconic" and honestly? we love her. ✨

---

✨ NAME ✨

sftpd_selinux — the Security Enhanced Linux Policy for the sftpd processes 🦋

---

🌸 DESCRIPTION 🌸

so, Security-Enhanced Linux keeps the sftpd processes safe via flexible mandatory access control. like, mandatory means you can't just sweet-talk your way past it. no cap. 👑

The sftpd processes run with the sftpd_t SELinux type. wanna check if you've got any of these processes running? just run the ps command with the -Z qualifier 🫶

For example:

ps -eZ | grep sftpd_t

that's it, that's the vibe check 🔍

---

🧚 PROCESS TYPES 🧚

SELinux defines process types (also called domains) for each process running on the system 💜

you can see the context of a process using the -Z option to ps 🌈

Policy governs the access confined processes have to files. the SELinux sftpd policy is very flexible — it lets users set up their sftpd processes in as secure a method as possible. highkey the most secure way. 🔥

The following process types are defined for sftpd:

• sftpd_t

💀 heads up bestie: semanage permissive -a sftpd_t can be used to make the process type sftpd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, you're not blocking anything, but the receipts still exist. 🙈

---

⭐ BOOLEANS ⭐

SELinux policy is customizable based on least access required — which is exactly the energy we want. the sftpd policy is extremely flexible and has several booleans that let you manipulate the policy and run sftpd with the tightest access possible 🔒

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. ✅

setsebool -P fips_mode 1

periodt. 🎀

---

👑 COMMANDS 👑

semanage fcontext can also be used to manipulate default file context mappings 🍓

semanage permissive can also be used to manipulate whether or not a process type is permissive 🦋

semanage module can also be used to enable/disable/install/remove policy modules 💅

semanage boolean can also be used to manipulate the booleans ✨

system-config-selinux is a GUI tool available to customize SELinux policy settings 🌸 — yes bestie, an actual GUI, your mouse can come too.

---

💖 AUTHOR 💖

This manual page was auto-generated using sepolicy manpage . 🤖 (not me typing this at 3am, promise)

---

🔗 SEE ALSO 🔗

selinux(8), sftpd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those next, the lore is deep 📚💜

---

mwah 💋 this has been sftpd_selinux(8) from the sftpd manual, dated 26-10-06 — autogenerated, iconic, and now officially in your group chat. slay 🫶