staff_gk...d_selinux(8)

✨ NAME ✨

okay bestie, welcome to the manual page for staff_gkeyringd_selinux — manual name staff_gk...d_selinux(8). It’s giving Security Enhanced Linux Policy for the staff_gkeyringd processes. periodt 💅

💖 DESCRIPTION 💖

Security-Enhanced Linux secures the staff_gkeyringd processes via flexible mandatory access control. no cap 🫶

The staff_gkeyringd processes execute with the staff_gkeyringd_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep staff_gkeyringd_t

🚪 ENTRYPOINTS 🚪

The staff_gkeyringd_t SELinux type can be entered via the gkeyringd_exec_t file type.

The default entrypoint paths for the staff_gkeyringd_t domain are the following:

• /usr/bin/mate-keyring-daemon
• /usr/bin/gnome-keyring-daemon

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. iconic behavior honestly 🌈

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux staff_gkeyringd policy is very flexible allowing users to setup their staff_gkeyringd processes in as secure a method as possible.

The following process types are defined for staff_gkeyringd:

• staff_gkeyringd_t

Note: semanage permissive -a staff_gkeyringd_t can be used to make the process type staff_gkeyringd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. bestie pls don’t forget the AVC messages still show up 💀

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. staff_gkeyringd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run staff_gkeyringd with the tightest access possible. lowkey obsessed with tight access ✨

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

• nis_enabled — if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

🗂️ MANAGED FILES 🗂️

The SELinux process type staff_gkeyringd_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the processes UID still need to have DAC permissions. fr fr, DAC still matters 🫶

• cache_home_t
  • /root/.cache(/.*)?
  • /home/[^/]+/.nv(/.*)?
  • /home/[^/]+/.cache(/.*)?
• cifs_t — no default paths listed here.
• config_home_t
  • /root/.kde(/.*)?
  • /root/.xine(/.*)?
  • /root/.config(/.*)?
  • /root/.Xdefaults
  • /home/[^/]+/.kde(/.*)?
  • /home/[^/]+/.xine(/.*)?
  • /home/[^/]+/.config(/.*)?
  • /home/[^/]+/.cache/dconf(/.*)?
  • /home/[^/]+/.Xdefaults
  • /run/user/[0-9]+/dconf(/.*)?
• ecryptfs_t
  • /home/[^/]+/.Private(/.*)?
  • /home/[^/]+/.ecryptfs(/.*)?
• fusefs_t
  • /run/user/[0-9]+/gvfs
• gkeyringd_gnome_home_t
  • /root/.gnome2/keyrings(/.*)?
  • /home/[^/]+/.gnome2/keyrings(/.*)?
  • /home/[^/]+/.local/share/keyrings(/.*)?
• krb5_host_rcache_t
  • /var/tmp/krb5_0.rcache2
  • /var/cache/krb5rcache(/.*)?
  • /var/tmp/nfs_0
  • /var/tmp/DNS_25
  • /var/tmp/host_0
  • /var/tmp/imap_0
  • /var/tmp/HTTP_23
  • /var/tmp/HTTP_48
  • /var/tmp/ldap_55
  • /var/tmp/ldap_487
  • /var/tmp/ldapmap1_0
• nfs_t — no default paths listed here.

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

🌸 AUTHOR 🌸

This manual page was auto-generated using sepolicy manpage . slay, automation ate 💅

🔗 SEE ALSO 🔗

selinux(8), staff_gkeyringd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

k bye bestie 💖 footer details for the vibe check: source/version staff_gkeyringd, date 26-10-06, manual staff_gk...d_selinux(8). stay iconic ✨🦋