staff_screen_selinux(8)

🌸 staff_screen_selinux — the manual page, but make it make sense 🌸

okay so this is staff_screen_selinux(8), from the SELinux Policy staff_screen collection — and bestie, if you've ever wondered what Big Security Energy is actually doing to your screen and tmux sessions, this is the page. let's get into it 💅

---

✨ NAME ✨

staff_screen_selinux — the Security Enhanced Linux Policy for the staff_screen processes. that's it, that's the whole name section, we love a concise queen 🎀

---

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the staff_screen processes via flexible mandatory access control. yes, mandatory. not "if you feel like it" access control. mandatory. 💀

The staff_screen processes execute with the staff_screen_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier.

for example:

ps -eZ | grep staff_screen_t

that's the vibe check for your processes, literally. run it and see who's living in staff_screen_t land 👑

---

🚪 ENTRYPOINTS 🚪

The staff_screen_t SELinux type can be entered via the screen_exec_t file type. that's the door, that's how you get in 🚪✨

the default entrypoint paths for the staff_screen_t domain are the following:

/usr/bin/tmux
/usr/bin/screen

so it's giving "two icons, one domain" energy, no cap 🫶

---

👑 PROCESS TYPES 👑

SELinux defines process types (aka domains) for each process running on the system. every process gets sorted into a little house, that's just how it is 🏠

you can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. the SELinux staff_screen policy is very flexible, allowing users to set up their staff_screen processes in as secure a method as possible. obsessed with the flexibility fr fr ✨

the following process types are defined for staff_screen:

staff_screen_t

💡 note: semanage permissive -a staff_screen_t can be used to make the process type staff_screen_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass, the receipts still exist 😭

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. the staff_screen policy is extremely flexible and has several booleans that allow you to manipulate the policy and run staff_screen with the tightest access possible. toggle responsibly bestie 💖

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

• nis_enabled — if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

• screen_allow_session_sharing — if you want to determine whether screen can use fsetid/setuid/setgid capability, you must turn on the screen_allow_session_sharing boolean. Disabled by default.

setsebool -P screen_allow_session_sharing 1

• use_nfs_home_dirs — if you want to support NFS home directories, you must turn on the use_nfs_home_dirs boolean. Enabled by default.

setsebool -P use_nfs_home_dirs 1

• use_samba_home_dirs — if you want to support SAMBA home directories, you must turn on the use_samba_home_dirs boolean. Disabled by default.

setsebool -P use_samba_home_dirs 1

the way these are just little on/off switches for your entire security situation 😭 flip them with setsebool -P, capital P for persistent, don't forget it 🫶

---

🗂️ MANAGED FILES 🗂️

The SELinux process type staff_screen_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the process's UID still needs to have DAC permissions. SELinux said "i can't fix everything, ask your UID" 💀

• faillog_t

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

• initrc_var_run_t

/run/sysconfig(/.*)?
/run/utmp
/run/keymap
/run/numlock-on
/run/setleds-on
/run/runlevel.dir
/run/setmixer_flag
/run/bootsplashctl

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• user_tmp_type

all user tmp files

look at all those file types, it's giving organized chaos and honestly? iconic 🧚

---

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI. for the girlies who want clicky buttons 🖱️✨

---

💜 AUTHOR 💜

This manual page was auto-generated using sepolicy manpage. a bot wrote this, and honestly it ate 🤖💅

---

🌈 SEE ALSO 🌈

selinux(8), staff_screen(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those next, iykyk 📚

---

🍓 and that's the page!! brought to you by staff_screen, dated 26-10-06, living under the staff_screen_selinux(8) banner. slay, stay confined, and remember: mandatory access control is not a suggestion 💖✨🎀