unconfin..._selinux(8)

🎀 unconfined_cronjob_selinux — the manual page, but make it make sense 🎀

okay bestie, so this is section 8 of the manual, and it's all about unconfined_cronjob_selinux — aka the Security Enhanced Linux Policy for the unconfined_cronjob processes. pull up a chair, we're getting into it 💅

---

✨ NAME ✨

unconfined_cronjob_selinux — Security Enhanced Linux Policy for the unconfined_cronjob processes. that's it, that's the name, slay 🫶

---

🌸 DESCRIPTION 🌸

so here's the vibe: Security-Enhanced Linux secures the unconfined_cronjob processes via flexible mandatory access control. flexible and mandatory?? iconic behavior honestly 👑

your unconfined_cronjob processes execute with the unconfined_cronjob_t SELinux type. want to check if you've got these processes running? just run the ps command with the -Z qualifier. easy peasy 🍓

for example:

ps -eZ | grep unconfined_cronjob_t

that's literally it. no cap. ✨

---

🦋 PROCESS TYPES 🦋

so SELinux defines process types (domains) for each process running on the system. yes, each one. it's giving main character energy for every single process ngl 💀

you can see the context of a process using the -Z option to ps, same as above. lowkey obsessed with how consistent that is.

policy governs the access confined processes have to files. the SELinux unconfined_cronjob policy is very flexible, allowing users to setup their unconfined_cronjob processes in as secure a method as possible. flexible and secure?? we love a balanced icon 🌈

the following process types are defined for unconfined_cronjob:

unconfined_cronjob_t

note: semanage permissive -a unconfined_cronjob_t can be used to make the process type unconfined_cronjob_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like… it's chill about it, but it's still watching 👀

---

💖 BOOLEANS 💖

SELinux policy is customizable based on least access required. the unconfined_cronjob policy is extremely flexible and has several booleans that allow you to manipulate the policy and run unconfined_cronjob with the tightest access possible. tightest access possible, bestie — we're being responsible 🎀

• deny_execmem — if you want to deny user domains applications to map a memory region as both executable and writable, you must turn on this boolean. ⚠️ this is dangerous and the executable should be reported in bugzilla. Disabled by default.

setsebool -P deny_execmem 1

• mmap_low_allowed — if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on this boolean. Disabled by default.

setsebool -P mmap_low_allowed 1

• secure_mode_insmod — if you want to disable kernel module loading, you must turn on this boolean. Disabled by default.

setsebool -P secure_mode_insmod 1

• selinuxuser_execheap — if you want to allow unconfined executables to make their heap memory executable, you must turn on this boolean. 💀 doing this is a really bad idea. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execheap 1

• selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, you must turn on this boolean. 😭 this should never, ever be necessary. probably indicates a badly coded executable, but could indicate an attack. this executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execstack 1

like… five booleans, all off by default. that's the responsible default, periodt 🫶

---

🧚 MANAGED FILES 🧚

the SELinux process type unconfined_cronjob_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. 👇

note: the processes UID still need to have DAC permissions. SELinux isn't out here doing DAC's job for it, okay? 💅

• file_type
  • all files on the system

yeah. all files on the system. it's giving "I have access to everything" energy and honestly? main character. 👑

---

⭐ COMMANDS ⭐

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. (yes, a GUI, for when the terminal is doing too much 🫶)

---

🌈 AUTHOR 🌈

this manual page was auto-generated using sepolicy manpage. so nobody hand-wrote this, it just manifested. slay ✨

---

💜 SEE ALSO 💜

selinux(8), unconfined_cronjob(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those next, bestie, iykyk 📚

---

and that's the whole page, no notes 💖 this cutie came from unconfined_cronjob, dated 26-10-06, living in unconfin..._selinux(8) — mwah, stay secure, drink water, and don't turn on selinuxuser_execstack unless you really have to 😭🎀