staff_sudo_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💅 staff_sudo_selinux(8) — the glow-up 💅

okay so bestie, this is the staff_sudo_selinux manual page (that's the staff_sudo_selinux(8) vibe, iykyk). it's all about the SELinux policy for staff_sudo processes, and honestly? it's a lot, but we're gonna get through it together. periodt. 🫶

✨ NAME ✨

staff_sudo_selinux — Security Enhanced Linux Policy for the staff_sudo processes. no cap, that's the whole name. 💖

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the staff_sudo processes via flexible mandatory access control. it's giving "your fave is protected" energy. 🛡️

the staff_sudo processes execute with the staff_sudo_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. like, literally just:

ps -eZ | grep staff_sudo_t

slay. that's it. that's the check. 👑

🦋 ENTRYPOINTS 🦋

the staff_sudo_t SELinux type can be entered via the sudo_exec_t file type. it's giving "VIP access only" — you gotta come through the right door. 🚪✨

the default entrypoint paths for the staff_sudo_t domain are the following, and yes, it's just one icon:

/usr/bin/sudo(edit)?

no cap, that's the whole list. short and iconic. 💅

🎀 PROCESS TYPES 🎀

okay so SELinux defines process types (domains) for each process running on the system. it's a whole thing. 🌈

you can see the context of a process using the -Z option to ps. try it, it's cute. 😌

policy governs the access confined processes have to files. the SELinux staff_sudo policy is very flexible, allowing users to setup their staff_sudo processes in as secure a method as possible. highkey obsessed with the security. 🔥

the following process types are defined for staff_sudo:

  • staff_sudo_t
note: semanage permissive -a staff_sudo_t can be used to make the process type staff_sudo_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still watching you. 👀💀

💜 BOOLEANS 💜

SELinux policy is customizable based on least access required. the staff_sudo policy is extremely flexible and has several booleans that allow you to manipulate the policy and run staff_sudo with the tightest access possible. it's giving "customize your own adventure". 🎮✨

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. enabled by default. 💚

setsebool -P fips_mode 1

if you want to allow confined applications to run with kerberos, you must turn on the kerberos_enabled boolean. enabled by default. 🔑

setsebool -P kerberos_enabled 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. disabled by default. 🙈

setsebool -P nis_enabled 1

that's the whole boolean situation. you're welcome. 💖

🌟 MANAGED FILES 🌟

the SELinux process type staff_sudo_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions. so like, SELinux isn't doing everything, bestie. you still gotta have the regular perms too. 🤝

🍓 cifs_t

(no default paths listed, it's mysterious like that. main character energy. 💅)

🍓 ecryptfs_t

  • /home/[^/]+/.Private(/.*)?
  • /home/[^/]+/.ecryptfs(/.*)?

🍓 faillog_t

  • /var/log/btmp.*
  • /run/faillock(/.*)?
  • /var/log/faillog.*
  • /var/log/tallylog.*

🍓 fusefs_t

  • /run/user/[0-9]+/gvfs

🍓 initrc_var_run_t

  • /run/sysconfig(/.*)?
  • /run/utmp
  • /run/keymap
  • /run/numlock-on
  • /run/setleds-on
  • /run/runlevel.dir
  • /run/setmixer_flag
  • /run/bootsplashctl

🍓 krb5_host_rcache_t

  • /var/tmp/krb5_0.rcache2
  • /var/cache/krb5rcache(/.*)?
  • /var/tmp/nfs_0
  • /var/tmp/DNS_25
  • /var/tmp/host_0
  • /var/tmp/imap_0
  • /var/tmp/HTTP_23
  • /var/tmp/HTTP_48
  • /var/tmp/ldap_55
  • /var/tmp/ldap_487
  • /var/tmp/ldapmap1_0

🍓 lastlog_t

  • /var/log/lastlog.*
  • /var/lib/lastlog(/.*)?

🍓 nfs_t

(no default paths listed, still iconic. ✨)

🍓 pam_var_run_t

  • /var/(db|adm)/sudo(/.*)?
  • /run/sudo(/.*)?
  • /run/pam_ssh(/.*)?
  • /run/sepermit(/.*)?
  • /var/lib/sudo(/.*)?
  • /run/pam_mount(/.*)?
  • /run/pam_timestamp(/.*)?

🍓 security_t

  • /selinux

🍓 staff_sudo_tmp_t

(no default paths listed, it's a vibe. 🌈)

🍓 sudo_db_t

  • /var/db/sudo(/.*)?

🍓 sudo_log_t

  • /var/log/sudo-io(/.*)?
  • /var/log/sudo.log

and that's the whole list. every single path, preserved. you're welcome. 😘

🧚 COMMANDS 🧚

okay so there are some tools you can use to vibe with this policy:

  • semanage fcontext can also be used to manipulate default file context mappings. 🗂️
  • semanage permissive can also be used to manipulate whether or not a process type is permissive. 😇
  • semanage module can also be used to enable/disable/install/remove policy modules. 📦
  • semanage boolean can also be used to manipulate the booleans. 🎛️
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. it's giving "graphical slay". 🖥️✨

👑 AUTHOR 👑

this manual page was auto-generated using sepolicy manpage. so like, not me writing it by hand, but the vibe is still immaculate. 💖

⭐ SEE ALSO ⭐

go read those if you're hungry for more. iykyk. 📚

and that's the whole page, bestie. this was the staff_sudo manual from 26-10-06 (that's the date, no cap), source staff_sudo, version staff_sudo_selinux(8). literally iconic. slay. 💅✨💖

📦 where this page comes from