sysadm_s..._selinux(8)

🎀 NAME 🎀

sysadm_seunshare_selinux — Security Enhanced Linux Policy for the sysadm_seunshare processes. Bestie, this is the sysadm_s..._selinux(8) page, and it's literally all about keeping sysadm_seunshare cute and locked down 💖

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the sysadm_seunshare processes via flexible mandatory access control. No cap, that's the whole vibe.

The sysadm_seunshare processes execute with the sysadm_seunshare_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep sysadm_seunshare_t

🦋 ENTRYPOINTS 🦋

The sysadm_seunshare_t SELinux type can be entered via the seunshare_exec_t file type.

The default entrypoint paths for the sysadm_seunshare_t domain are the following:

/usr/bin/seunshare

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. Iconic behavior, honestly.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux sysadm_seunshare policy is very flexible, allowing users to setup their sysadm_seunshare processes in as secure a method as possible.

The following process types are defined for sysadm_seunshare:

• sysadm_seunshare_t

Note: semanage permissive -a sysadm_seunshare_t can be used to make the process type sysadm_seunshare_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it's permissive, not invisible 👀

🌸 BOOLEANS 🌸

SELinux policy is customizable based on least access required. sysadm_seunshare policy is extremely flexible and has several booleans that allow you to manipulate the policy and run sysadm_seunshare with the tightest access possible. Tightest access possible = the moment fr fr 💅

• fips_mode — If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

• nis_enabled — If you want to allow the system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

🧚 MANAGED FILES 🧚

The SELinux process type sysadm_seunshare_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions, bestie — SELinux isn't out here doing everything for you 💀

• krb5_host_rcache_t
  • /var/tmp/krb5_0.rcache2
  • /var/cache/krb5rcache(/.*)?
  • /var/tmp/nfs_0
  • /var/tmp/DNS_25
  • /var/tmp/host_0
  • /var/tmp/imap_0
  • /var/tmp/HTTP_23
  • /var/tmp/HTTP_48
  • /var/tmp/ldap_55
  • /var/tmp/ldap_487
  • /var/tmp/ldapmap1_0
• sandbox_file_t
• sandbox_tmpfs_type — all sandbox content in tmpfs file systems

🌈 COMMANDS 🌈

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

💜 AUTHOR 💜

This manual page was auto-generated using sepolicy manpage .

⭐ SEE ALSO ⭐

• selinux(8)
• sysadm_seunshare(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

mwah 💋 this little cutie comes from sysadm_seunshare, dated 26-10-06, under the manual name sysadm_s..._selinux(8) — go secure your processes, bestie 🫶✨