user_wine_selinux(8)

💅 user_wine_selinux — the manual page, but make it make sense

okay so bestie, welcome to the glow-up edition of user_wine_selinux(8), straight out of the SELinux Policy user_wine collection. this is the whole page, nothing skipped, just with actual personality. let's get into it 🫶

---

✨ NAME ✨

user_wine_selinux — the Security Enhanced Linux Policy for all the user_wine processes. yes that's it, that's the whole name section, slay 💅

🌸 DESCRIPTION 🌸

so basically, Security-Enhanced Linux keeps your user_wine processes secure via flexible mandatory access control. it's giving strict parents but make it kernel-level, no cap.

your user_wine processes run with the user_wine_t SELinux type. wanna check if you've got any of these running? just run ps with the -Z qualifier, like this:

ps -eZ | grep user_wine_t

that's literally it. lowkey iconic 🔥

🦋 ENTRYPOINTS 🦋

the user_wine_t SELinux type can be entered via the wine_exec_t, user_home_t file types.

and the default entrypoint paths for the user_wine_t domain are literally these, in all their glory:

/usr/bin/wine.*, /opt/teamviewer(/.*)?/bin/wine.*,
/opt/google/picasa(/.*)?/bin/wdi, /opt/google/picasa(/.*)?/bin/wine.*,
/opt/google/picasa(/.*)?/bin/msiexec,
/opt/google/picasa(/.*)?/bin/notepad,
/opt/google/picasa(/.*)?/bin/progman,
/opt/google/picasa(/.*)?/bin/regedit,
/opt/google/picasa(/.*)?/bin/regsvr32,
/opt/google/picasa(/.*)?/Picasa3/.*exe,
/opt/google/picasa(/.*)?/bin/uninstaller, /opt/cxoffice/bin/wine.*,
/opt/picasa/wine/bin/wine.*, /usr/bin/msiexec, /usr/bin/notepad,
/usr/bin/regedit, /usr/bin/regsvr32, /usr/bin/uninstaller,
/home/[^/]+/cxoffice/bin/wine.+, /home/[^/]+/.+

like yes, that's a lot of paths, but they're all staying, periodt 🎀

👑 PROCESS TYPES 👑

SELinux defines process types (aka domains) for each process running on the system. so every process out here has main character energy, fr fr.

you can see the context of a process using the -Z option to ps.

policy governs the access that confined processes have to files. the SELinux user_wine policy is very flexible, allowing users to set up their user_wine processes in as secure a method as possible. bestie it's literally the "have fun but be safe" of kernel policy 🧚

the following process types are defined for user_wine:

user_wine_t

💀 note: semanage permissive -a user_wine_t can be used to make the process type user_wine_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but the receipts still exist, iykyk.

💖 BOOLEANS 💖

SELinux policy is customizable based on least access required — very "you get the bare minimum and you'll like it" energy. the user_wine policy is extremely flexible and has several booleans that let you manipulate the policy and run user_wine with the tightest access possible. obsessed 💜

• 🍓 want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr? you must turn on the mmap_low_allowed boolean. disabled by default.

setsebool -P mmap_low_allowed 1

• 🌈 want to allow the system to run with NIS? you must turn on the nis_enabled boolean. disabled by default.

setsebool -P nis_enabled 1

• 🦋 want to support NFS home directories? you must turn on the use_nfs_home_dirs boolean. enabled by default.

setsebool -P use_nfs_home_dirs 1

• 🎀 want to support SAMBA home directories? you must turn on the use_samba_home_dirs boolean. disabled by default.

setsebool -P use_samba_home_dirs 1

• ✨ want to determine whether attempts by wine to mmap low regions should be silently blocked? you must turn on the wine_mmap_zero_ignore boolean. disabled by default.

setsebool -P wine_mmap_zero_ignore 1

all of these use setsebool -P, and that -P is doing a lot of heavy lifting (it makes it persistent, bestie). 💅

🌸 MANAGED FILES 🌸

the SELinux process type user_wine_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. heads up though: the process's UID still needs to have DAC permissions. SELinux said "i did my part, the rest is on you" 😭

• alsa_home_t

/home/[^/]+/.asoundrc

• chrome_sandbox_tmpfs_t — no default paths listed, she's mysterious like that 💀
• games_data_t

/var/games(/.*)?
/var/lib/games(/.*)?

• gpg_agent_tmp_t

/home/[^/]+/.gnupg/log-socket

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• mail_spool_t

/var/mail(/.*)?
/var/spool/imap(/.*)?
/var/spool/mail(/.*)?
/var/spool/smtpd(/.*)?

• mqueue_spool_t

/var/spool/(client)?mqueue(/.*)?
/var/spool/mqueue.in(/.*)?

• pulseaudio_tmpfs_t — no paths, just vibes 🎧
• pulseaudio_tmpfsfile — also no paths, she's ✨ethereal✨
• session_dbusd_tmp_t

/run/user/[0-9]+/bus
/run/user/[0-9]+/dbus(/.*)?
/run/user/[0-9]+/dbus-1(/.*)?

• usbfs_t — no default paths listed 🫶
• user_fonts_cache_t

/root/.fontconfig(/.*)?
/root/.fonts/auto(/.*)?
/root/.fonts.cache-.*
/root/.cache/fontconfig(/.*)?
/home/[^/]+/.fontconfig(/.*)?
/home/[^/]+/.fonts/auto(/.*)?
/home/[^/]+/.fonts.cache-.*
/home/[^/]+/.cache/fontconfig(/.*)?

• user_home_type — that's all user home files, bestie. the whole home. the entire house. 🏠
• user_tmp_t

/run/tlog(/.*)?
/run/user/[^/]+
/dev/shm/mono.*
/tmp/.ICE-unix(/.*)?
/tmp/.X11-unix(/.*)?
/dev/shm/pulse-shm.*
/run/user
/tmp/.X0-lock
/tmp/hsperfdata_root
/var/tmp/hsperfdata_root
/home/[^/]+/tmp
/home/[^/]+/.tmp
/run/user/[0-9]+
/tmp/gconfd-[^/]+

• user_tmp_type — that's all user tmp files, the whole tmp situation 💀
• wine_home_t

/home/[^/]+/.wine(/.*)?

• xserver_tmpfs_t — no paths listed, she's out here living her truth 🌈

⭐ COMMANDS ⭐

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. yes bestie, there's a GUI, you don't have to rawdog the terminal if you don't want to 🎀

🧚 AUTHOR 🧚

this manual page was auto-generated using sepolicy manpage. no human wrote this, a script did, and honestly? she ate. 👑

🔥 SEE ALSO 🔥

selinux(8), user_wine(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

okay that's the whole page, nothing left out, you're welcome 💖 this edition of the user_wine manual comes to you from user_wine, dated 26-10-06 — go forth and configure responsibly, bestie, and remember: permissive mode is not a personality trait 💅✨🦋