sshd_sandbox_selinux(8)

💖 NAME 💖

okay so this page is sshd_sandbox_selinux(8), and it’s literally all about the sshd_sandbox processes 💅 — aka Security Enhanced Linux Policy for the sshd_sandbox processes. bestie, this is the SELinux glow-up manual for that sandbox vibe 🫶.

---

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the sshd_sandbox processes via flexible mandatory access control. no cap, that’s the whole point 🎀.

The sshd_sandbox processes execute with the sshd_sandbox_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep sshd_sandbox_t

---

🌸 PROCESS TYPES 🌸

SELinux defines process types (domains) for each process running on the system.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux sshd_sandbox policy is very flexible allowing users to setup their sshd_sandbox processes in as secure a method as possible.

The following process types are defined for sshd_sandbox:

sshd_sandbox_t

Note: semanage permissive -a sshd_sandbox_t can be used to make the process type sshd_sandbox_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated.

---

🦋 BOOLEANS 🦋

SELinux policy is customizable based on least access required. sshd_sandbox policy is extremely flexible and has several booleans that allow you to manipulate the policy and run sshd_sandbox with the tightest access possible.

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

---

💜 COMMANDS 💜

• semanage fcontext — can also be used to manipulate default file context mappings.
• semanage permissive — can also be used to manipulate whether or not a process type is permissive.
• semanage module — can also be used to enable/disable/install/remove policy modules.
• semanage boolean — can also be used to manipulate the booleans.
• system-config-selinux — is a GUI tool available to customize SELinux policy settings.

---

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage .

---

🌈 SEE ALSO 🌈

• selinux(8)
• sshd_sandbox(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

xoxo, your SELinux bestie 💅 — source/version sshd_sandbox, date 26-10-06, manual sshd_sandbox_selinux(8) 🎀✨