user_mail_selinux(8)

💌 user_mail_selinux(8) — the user_mail SELinux glow-up 💌

okay bestie, welcome to the user_mail_selinux(8) manual page. yes that's the manual name and yes we're folding it in right here at the top like a little name tag 🎀 this is the SELinux policy page for everything user_mail-flavored, and it's genuinely iconic.

---

✨ NAME ✨

user_mail_selinux — Security Enhanced Linux Policy for the user_mail processes 🦋

no cap, that's the whole vibe. it's the policy that keeps your mail-ish processes on a leash.

---

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the user_mail processes via flexible mandatory access control. lowkey the whole point. it's giving "boundaries, but make it kernel-enforced" 💅

The user_mail processes execute with the user_mail_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep user_mail_t

run that and see if your fave little processes are wearing their user_mail_t fit. periodt 🔥

---

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. yes, every process gets a whole identity. main character energy fr fr.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux user_mail policy is very flexible allowing users to setup their user_mail processes in as secure a method as possible. and by flexible we mean "you have options, bestie, use them wisely" ✨

The following process types are defined for user_mail:

• user_mail_t 💖

Note: semanage permissive -a user_mail_t can be used to make the process type user_mail_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so it's like, "i'm not gonna stop you, but i am gonna write it down in my journal" 😭📓

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. user_mail policy is extremely flexible and has several booleans that allow you to manipulate the policy and run user_mail with the tightest access possible. tightest access = the it-girl of security configs, ngl 💅

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. slay, it's already on 🏆

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. so if you need it, you gotta flip it yourself, bestie 🙈

setsebool -P nis_enabled 1

If you want to support SAMBA home directories, you must turn on the use_samba_home_dirs boolean. Disabled by default. again, off until you say otherwise 🫶

setsebool -P use_samba_home_dirs 1

---

🦋 MANAGED FILES 🦋

The SELinux process type user_mail_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions. okay so SELinux is not out here overriding DAC, they're a team, iykyk 🤝

cifs_t

no default paths listed for this one, it's mysterious like that 💀

courier_spool_t

/var/spool/courier(/.*)?
/var/spool/authdaemon(/.*)?

etc_aliases_t

/etc/mail/.*.db
/etc/mail/aliases.*
/etc/postfix/aliases.*
/etc/aliases
/etc/aliases.db
/etc/aliases.lmdb

etc_mail_t

/etc/mail(/.*)?

exim_log_t

/var/log/exim[0-9]?(/.*)?

exim_spool_t

/var/spool/exim[0-9]?(/.*)?

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

mail_home_rw_t

/root/Maildir(/.*)?
/root/.esmtp_queue(/.*)?
/var/lib/arpwatch/.esmtp_queue(/.*)?
/var/cache/ddclient/.esmtp_queue(/.*)?
/home/[^/]+/.maildir(/.*)?
/home/[^/]+/Maildir(/.*)?
/home/[^/]+/.esmtp_queue(/.*)?

mail_home_t

/root/.mailrc
/root/.esmtprc
/root/.forward
/root/dead.letter
/home/[^/]+/.forward[^/]*
/home/[^/]+/.mailrc
/home/[^/]+/.esmtprc
/home/[^/]+/dead.letter

mail_spool_t

/var/mail(/.*)?
/var/spool/imap(/.*)?
/var/spool/mail(/.*)?
/var/spool/smtpd(/.*)?

mqueue_spool_t

/var/spool/(client)?mqueue(/.*)?
/var/spool/mqueue.in(/.*)?

nfs_t

no default paths listed here either. it's a whole mystery vibe 🕵️‍♀️

sendmail_log_t

/var/log/mail(/.*)?
/var/log/sendmail.st.*

user_home_t

/home/[^/]+/.+

user_mail_tmp_t

no default paths listed. tiny temp energy, no notes 🧚

uucpd_spool_t

/var/spool/uucp(/.*)?
/var/spool/uucppublic(/.*)?

---

🌈 COMMANDS 🌈

semanage fcontext can also be used to manipulate default file context mappings. very "i organize my digital closet" of it 💅

semanage permissive can also be used to manipulate whether or not a process type is permissive. the "let them cook, but log it" switch 🔥

semanage module can also be used to enable/disable/install/remove policy modules. modular queen behavior 👑

semanage boolean can also be used to manipulate the booleans. yes, the same booleans from up there, bestie, they're all connected 🎀

system-config-selinux is a GUI tool available to customize SELinux policy settings. for when you want the point-and-click experience ✨🖱️

---

💖 AUTHOR 💖

This manual page was auto-generated using sepolicy manpage. the robot did the writing, i just did the vibe check 💀✨

---

🌟 SEE ALSO 🌟

selinux(8), user_mail(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

go read those too, they're all linked in the group chat 🫶

---

and that's the whole page, bestie!! source/version user_mail and date 26-10-06 — signed off with so much love, user_mail_selinux(8) style 💌🎀✨🦋💅