usernetctl_selinux(8)

💅 usernetctl_selinux(8) — the SELinux Policy for usernetctl, bestie

okay so welcome to usernetctl_selinux(8), the page that explains the whole SELinux Policy for usernetctl situation. yes this is the manual page you were looking for, and yes it's giving very "niche but iconic" 💖

✨ NAME ✨

usernetctl_selinux — Security Enhanced Linux Policy for the usernetctl processes. that's it, that's the name, slay 🎀

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the usernetctl processes via flexible mandatory access control. like, it puts them in a little labeled bubble and decides what they're allowed to touch. so valid of it 🫶

The usernetctl processes execute with the usernetctl_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier. fr fr, -Z is the one that shows you the SELinux context.

For example:

ps -eZ | grep usernetctl_t

that's the whole vibe check. run it, see what's up 💅

🦋 ENTRYPOINTS 🦋

The usernetctl_t SELinux type can be entered via the usernetctl_exec_t file type. that's the door, the entrypoint, the main-character entrance ✨

The default entrypoint paths for the usernetctl_t domain are the following:

/usr/bin/usernetctl

just that one path, no cap 💀

👑 PROCESS TYPES 👑

SELinux defines process types (domains) for each process running on the system. yes, every process gets a little label, it's very "everyone gets a name tag at the party" 🎀

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux usernetctl policy is very flexible, allowing users to setup their usernetctl processes in as secure a method as possible. flexible AND secure, we love a multitasking icon 🌈

The following process types are defined for usernetctl:

usernetctl_t

Note: semanage permissive -a usernetctl_t can be used to make the process type usernetctl_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so it's like, chill mode, but the receipts still print 😭 keep that in mind bestie.

⭐ BOOLEANS ⭐

SELinux policy is customizable based on least access required. usernetctl policy is extremely flexible and has several booleans that allow you to manipulate the policy and run usernetctl with the tightest access possible. tightest access possible, periodt 👑

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

that -P is doing the permanent thing btw, don't skip it 🙈

💜 MANAGED FILES 💜

The SELinux process type usernetctl_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. and like, note that the processes UID still need to have DAC permissions. SELinux isn't gonna override your regular permissions, it's just an extra layer, iykyk 💅

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

look at all those little cache files, they're like collectibles at this point 🍓

🧚 FILE CONTEXTS 🧚

SELinux requires files to have an extended attribute to define the file type. yes, the label lives on the file, it's very "name tag stuck to your shirt" energy 🎀

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. SELinux usernetctl policy is very flexible, allowing users to setup their usernetctl processes in as secure a method as possible. again, flexible and secure, we stan 🌸

🌈 STANDARD FILE CONTEXT 🌈

SELinux defines the file context types for the usernetctl. if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. like, first you tell it, then you apply it. two steps, bestie, don't forget the second one 😭

semanage fcontext -a -t usernetctl_exec_t
'/srv/usernetctl/content(/.*)?'
restorecon -R -v /srv/myusernetctl_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. that (/.*)? is regex, she's doing the "and everything under it" thing 💅

The following file types are defined for usernetctl:

usernetctl_exec_t

• Set files with the usernetctl_exec_t type, if you want to transition an executable to the usernetctl_t domain.

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. so chcon = temporary lil makeover, semanage fcontext + restorecon = permanent glow-up 💖 do NOT mix them up, it's giving undefined-behavior-adjacent heartbreak.

🔥 COMMANDS 🔥

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI, for when the terminal is doing too much 🫶

💀 AUTHOR 💀

This manual page was auto-generated using sepolicy manpage. so nobody hand-wrote this, a robot did, and honestly? ate. 🤖✨

👀 SEE ALSO 👀

selinux(8), usernetctl(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

okay that's the whole usernetctl_selinux(8) page, you're officially caught up. this beauty comes to you from usernetctl, dated 26-10-06, filed under usernetctl_selinux(8). go forth and label responsibly, bestie 💜🦋✨