system_cr...b_selinux(8)

💅 system_cr...b_selinux(8) — the glow-up

okay so bestie, welcome to the manual page for system_cr...b_selinux (full title on the tin: system_cr...b_selinux(8), and the section is the SELinux Policy one, so you know it's the real deal). This is the page all about the system_cronjob_selinux policy — aka Security Enhanced Linux Policy for the system_cronjob processes. Buckle up, it's giving lore drop 🎀

---

🌸 NAME 🌸

system_cronjob_selinux — Security Enhanced Linux Policy for the system_cronjob processes. that's the whole vibe. short, sweet, iconic ✨

---

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the system_cronjob processes via flexible mandatory access control. yes bestie, mandatory. not a suggestion, not a soft launch — mandatory 💅

The system_cronjob processes execute with the system_cronjob_t SELinux type. wanna check if you've got these processes running? run the ps command with the -Z qualifier. like this:

ps -eZ | grep system_cronjob_t

literally that easy. no cap 🫶

---

✨ ENTRYPOINTS ✨

the system_cronjob_t SELinux type can be entered via these file types:

• system_cron_spool_t
• usr_t
• anacron_exec_t
• bin_t
• shell_exec_t
• fusefs_t
• nfs_t
• cifs_t

and the default entrypoint paths for the system_cronjob_t domain are... deep breath... the following, and I am listing every single one because we do not skip:

All executables with the default executable label, usually stored in /usr/bin and /usr/sbin. /etc/cron.d(/.*)?, /var/spool/anacron(/.*)?, /etc/crontab, /var/spool/fcron/systab, /var/spool/fcron/new.systab, /var/spool/fcron/systab.orig, /opt/.*, /usr/.*, /hana(/.*)?, /emul/.*, /export(/.*)?, /ostree(/.*)?, /usr/doc(/.*)?/lib(/.*)?, /usr/inclu.e(/.*)?, /usr/share/rpm(/.*)?, /usr/share/doc(/.*)?/README.*, /usr/lib/modules(/.*)/vmlinuz, /usr/lib/modules(/.*)/sysctl.conf, /usr/lib/modules(/.*)/initramfs.img, /usr/lib/sysimage(/.*)?, /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul, /usr/bin/anacron, /usr/bin/d?ash, /usr/bin/ksh.*, /usr/bin/zsh.*, /usr/bin/esh, /usr/bin/bash, /usr/bin/fish, /usr/bin/mksh, /usr/bin/sash, /usr/bin/sesh, /usr/bin/tcsh, /usr/bin/yash, /usr/bin/bash2, /usr/bin/smrsh, /usr/bin/nologin, /usr/bin/scponly, /usr/bin/scponlyc, /usr/libexec/sesh, /usr/bin/git-shell, /usr/libexec/sudo/sesh, /usr/bin/cockpit-bridge, /usr/libexec/cockpit-agent, /usr/libexec/git-core/git-shell, /run/user/[0-9]+/gvfs

the way that list just keeps going 😭 but we got through it together, bestie 🫶

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. yes, every single one gets its own little domain. main character energy for processes 🌈

you can see the context of a process using the -Z option to ps.

policy governs the access confined processes have to files. the SELinux system_cronjob policy is very flexible, allowing users to setup their system_cronjob processes in as secure a method as possible. flexible AND secure? we love a multitasker 💅

these are the process types defined for system_cronjob:

• system_cronjob_t

note: semanage permissive -a system_cronjob_t can be used to make the process type system_cronjob_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's not a free pass, it's just a "we see you but we're not stopping you" situation 🙈

---

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required. the system_cronjob policy is extremely flexible and has several booleans that allow you to manipulate the policy and run system_cronjob with the tightest access possible. tightest access possible is the goal, bestie — we stay locked down 🔥

if you want to allow system cron jobs to relabel filesystem for restoring file contexts, you must turn on the cron_can_relabel boolean. disabled by default.

setsebool -P cron_can_relabel 1

if you want to allow system cronjob to be executed on on NFS, CIFS or FUSE filesystem, you must turn on the cron_system_cronjob_use_shares boolean. disabled by default. (yes the original says "on on", we're keeping it, it's iconic 💀)

setsebool -P cron_system_cronjob_use_shares 1

if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

if you want to deny user domains applications to map a memory region as both executable and writable, this is dangerous and the executable should be reported in bugzilla, you must turn on the deny_execmem boolean. disabled by default. ⚠️ dangerous, fr fr.

setsebool -P deny_execmem 1

if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on the mmap_low_allowed boolean. disabled by default.

setsebool -P mmap_low_allowed 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. disabled by default.

setsebool -P nis_enabled 1

if you want to disable kernel module loading, you must turn on the secure_mode_insmod boolean. disabled by default.

setsebool -P secure_mode_insmod 1

if you want to allow unconfined executables to make their heap memory executable. doing this is a really bad idea. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla, you must turn on the selinuxuser_execheap boolean. disabled by default. 😭 please don't need this one.

setsebool -P selinuxuser_execheap 1

if you want to allow unconfined executables to make their stack executable. this should never, ever be necessary. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla, you must turn on the selinuxuser_execstack boolean. disabled by default. 🚨 like... never ever. we said it twice for emphasis.

setsebool -P selinuxuser_execstack 1

---

💜 MANAGED FILES 💜

the SELinux process type system_cronjob_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions — SELinux is not out here overriding DAC, she's doing her own layer 💅

file_type

all files on the system. that's it. that's the whole thing. all of them. every file. iconic scope honestly 👑

---

🧚 COMMANDS 🧚

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans

system-config-selinux is a GUI tool available to customize SELinux policy settings. a GUI! for the girlies who don't vibe with terminals (no judgement, we love you) 🎀

---

⭐ AUTHOR ⭐

this manual page was auto-generated using sepolicy manpage . shoutout to the robot that wrote my source material 🤖✨

---

🌈 SEE ALSO 🌈

selinux(8), system_cronjob(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those too, bestie, they're all part of the extended universe 🫶

---

and that's the page! 💖 little sign-off moment: this one's from the system_cronjob manual, dated 26-10-06, and it lives under the system_cr...b_selinux(8) title. slay, you made it to the end 🎀✨🦋