sysadm_passwd_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💖 sysadm_passwd_selinux(8) — the manual page, but make it make sense 💖

okay bestie, pull up a chair because we're talking about sysadm_passwd_selinux — the Security Enhanced Linux Policy for the sysadm_passwd processes. no cap, this is important stuff and you're gonna understand it. periodt. ✨

🌸 NAME 🌸

okay so sysadm_passwd_selinux is literally the Security Enhanced Linux Policy for the sysadm_passwd processes. that's the whole vibe. 🎀

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the sysadm_passwd processes via flexible mandatory access control. iconic behavior, honestly.

The sysadm_passwd processes execute with the sysadm_passwd_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. iykyk.

for example:

ps -eZ | grep sysadm_passwd_t

slay. run it and see what's up. 👑

✨ ENTRYPOINTS ✨

The sysadm_passwd_t SELinux type can be entered via the admin_passwd_exec_t file type. that's the doorway, bestie. 🚪

the default entrypoint paths for the sysadm_passwd_t domain are the following:

  • /usr/bin/vigr
  • /usr/bin/vipw
  • /usr/bin/pwconv
  • /usr/bin/grpconv
  • /usr/bin/pwunconv
  • /usr/bin/grpunconv

those are the exact vibes. don't lose them. 🫶

🔥 PROCESS TYPES 🔥

SELinux defines process types (domains) for each process running on the system. main character energy for every single process, honestly.

you can see the context of a process using the -Z option to ps. simple as that.

Policy governs the access confined processes have to files. SELinux sysadm_passwd policy is very flexible allowing users to setup their sysadm_passwd processes in as secure a method as possible. so secure. so flexible. we love to see it. 💅

the following process types are defined for sysadm_passwd:

  • sysadm_passwd_t
Note: semanage permissive -a sysadm_passwd_t can be used to make the process type sysadm_passwd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass, it just changes the vibe of the denial. 😭

🧚 BOOLEANS 🧚

SELinux policy is customizable based on least access required. sysadm_passwd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run sysadm_passwd with the tightest access possible. tightest access = bestie behavior. 💖

  • if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. slay, it's already on.
setsebool -P fips_mode 1
  • if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. so like, off by default. turn it on if you need it.
setsebool -P nis_enabled 1

🌈 MANAGED FILES 🌈

The SELinux process type sysadm_passwd_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions. don't forget that part, bestie. 🙈

krb5_host_rcache_t

  • /var/tmp/krb5_0.rcache2
  • /var/cache/krb5rcache(/.*)?
  • /var/tmp/nfs_0
  • /var/tmp/DNS_25
  • /var/tmp/host_0
  • /var/tmp/imap_0
  • /var/tmp/HTTP_23
  • /var/tmp/HTTP_48
  • /var/tmp/ldap_55
  • /var/tmp/ldap_487
  • /var/tmp/ldapmap1_0

security_t

  • /selinux

shadow_t

  • /etc/tcb/.+/shadow.*
  • /etc/shadow.*
  • /etc/gshadow.*
  • /etc/nshadow.*
  • /var/db/shadow.*
  • /etc/security/opasswd
  • /etc/security/opasswd.old

sysadm_passwd_tmp_t

(no default paths listed, but it's still a managed type, okay? it exists. it's valid. periodt. 💅)

🎀 COMMANDS 🎀

semanage fcontext can also be used to manipulate default file context mappings. okay so that's your go-to for file context stuff.

semanage permissive can also be used to manipulate whether or not a process type is permissive. vibe check for permissive modes. 🌸

semanage module can also be used to enable/disable/install/remove policy modules. modular realness.

semanage boolean can also be used to manipulate the booleans. flipping booleans like it's nothing. ✨

system-config-selinux is a GUI tool available to customize SELinux policy settings. for when you want the clicky-clicky experience. 🖱️

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. not me being auto-generated and still serving looks. 💅

🌟 SEE ALSO 🌟

like, go read those too if you want the full picture. bestie homework. 📚

and that's the whole page, bestie. you ate this up and understood every bit of it. no cap. this manual page is from 26-10-06 and it's the sysadm_passwd_selinux(8) version — iconic date, iconic page. now go forth and manage those processes like the main character you are. 💖✨🎀🦋🌸💅🫶😭🔥👑🌈⭐💀🙈🍓🧚💜

📦 where this page comes from