staff_dbusd_selinux(8)

💅 staff_dbusd_selinux(8) — the SELinux policy for staff_dbusd tea ☕

okay so bestie, welcome to the staff_dbusd_selinux manual page (that's staff_dbusd_selinux(8) if we're being formal 🎀). this is the whole glow-up guide to how SELinux handles the staff_dbusd processes. buckle up, it's actually not that deep, i promise 🫶

---

✨ NAME ✨

staff_dbusd_selinux — Security Enhanced Linux Policy for the staff_dbusd processes. that's it, that's the tweet 💅

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the staff_dbusd processes via flexible mandatory access control. yes babes, mandatory — not the vibe where you get to opt out 😌

the staff_dbusd processes execute with the staff_dbusd_t SELinux type. wanna check if you've got these processes running rn? just run the ps command with the -Z qualifier. easy.

for example:

ps -eZ | grep staff_dbusd_t

go off, detective 🔍

---

🦋 ENTRYPOINTS 🦋

the staff_dbusd_t SELinux type can be entered via the dbusd_exec_t file type. that's the doorway, the velvet rope, the main character entrance ✨

the default entrypoint paths for the staff_dbusd_t domain are literally these:

/usr/bin/dbus-daemon(-1)?, /usr/bin/dbus-broker, /usr/bin/dbus-broker-launch, /lib/dbus-1/dbus-daemon-launch-helper, /usr/lib/dbus-1/dbus-daemon-launch-helper, /usr/libexec/dbus-1/dbus-daemon-launch-helper

no cap, those are the exact ones 🎀

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. yes, every single one gets a little label, very organized of them 💜

you can see the context of a process using the -Z option to ps. (told you -Z was the moment, it's giving icon)

policy governs the access confined processes have to files. SELinux staff_dbusd policy is very flexible, allowing users to setup their staff_dbusd processes in as secure a method as possible. highkey obsessed with how customizable this is 🔥

the following process types are defined for staff_dbusd:

• staff_dbusd_t

note: semanage permissive -a staff_dbusd_t can be used to make the process type staff_dbusd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass forever — the receipts still get printed, bestie 🧾

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. staff_dbusd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run staff_dbusd with the tightest access possible. tightest access = bestie behaviour, honestly 💅

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. enabled by default.

setsebool -P fips_mode 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. disabled by default.

setsebool -P nis_enabled 1

see? not scary. just two little switches 🌈

---

🧚 MANAGED FILES 🧚

the SELinux process type staff_dbusd_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note the processes UID still need to have DAC permissions — SELinux isn't out here overriding your regular perms, she's just doing her own layer ⭐

cifs_t

(no default paths listed for this one — she's mysterious like that 🙈)

ecryptfs_t

/home/[^/]+/.Private(/.*)?
/home/[^/]+/.ecryptfs(/.*)?

fusefs_t

/run/user/[0-9]+/gvfs

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

nfs_t

(again, no default paths on this one 💀)

security_t

/selinux

session_dbusd_tmp_t

/run/user/[0-9]+/bus
/run/user/[0-9]+/dbus(/.*)?
/run/user/[0-9]+/dbus-1(/.*)?

user_home_t

/home/[^/]+/.+

look at all those paths, she's thorough 💖

---

⚡ COMMANDS ⚡

okay so here's your toolkit, bestie — these are the commands that let you actually do stuff:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. (a GUI!! for the girlies who prefer clicking 💅)

---

🫶 AUTHOR 🫶

this manual page was auto-generated using sepolicy manpage. so like, not me writing it by hand — the machine ate and left no crumbs 🤖✨

---

🌟 SEE ALSO 🌟

go read these next, i promise they're worth it:

selinux(8), staff_dbusd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page, bestie!! 🎉 this was staff_dbusd_selinux(8), from the staff_dbusd gang, dated 26-10-06. periodt, you're now officially educated 💖🦋✨