virt_ho...selinux(8)

🎀 NAME 🎀

hiii bestie, welcome to virt_ho...selinux(8) 💖 this is the manual page for virt_hook_unconfined_selinux — aka the Security Enhanced Linux Policy for the virt_hook_unconfined processes. No cap, it’s giving “SELinux but make it specific.” 👑

---

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the virt_hook_unconfined processes via flexible mandatory access control. Slay. 💅

The virt_hook_unconfined processes execute with the virt_hook_unconfined_t SELinux type. You can check if you have these processes running by executing the ps command with the -Z qualifier. For example:

ps -eZ | grep virt_hook_unconfined_t

---

🚪 ENTRYPOINTS 🚪

The virt_hook_unconfined_t SELinux type can be entered via the virt_hook_t file type.

The default entrypoint paths for the virt_hook_unconfined_t domain are the following:

/etc/libvirt/hooks(/.*)?

---

🫶 PROCESS TYPES 🫶

SELinux defines process types (domains) for each process running on the system. You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux virt_hook_unconfined policy is very flexible, allowing users to setup their virt_hook_unconfined processes in as secure a method as possible. Iconic behavior, honestly. 🌟

The following process types are defined for virt_hook_unconfined:

• virt_hook_unconfined_t

Note: semanage permissive -a virt_hook_unconfined_t can be used to make the process type virt_hook_unconfined_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. Important little caveat, bestie. 🫡

---

🎚️ BOOLEANS 🎚️

SELinux policy is customizable based on least access required. virt_hook_unconfined policy is extremely flexible and has several booleans that allow you to manipulate the policy and run virt_hook_unconfined with the tightest access possible. Vibe check: maximum control. ✨

• deny_execmem — If you want to deny user domains applications to map a memory region as both executable and writable, turn this on. This is dangerous, and the executable should be reported in bugzilla. Disabled by default.

setsebool -P deny_execmem 1

• mmap_low_allowed — If you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, turn this on. Disabled by default.

setsebool -P mmap_low_allowed 1

• secure_mode_insmod — If you want to disable kernel module loading, turn this on. Disabled by default.

setsebool -P secure_mode_insmod 1

• selinuxuser_execheap — If you want to allow unconfined executables to make their heap memory executable, turn this on. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execheap 1

• selinuxuser_execstack — If you want to allow unconfined executables to make their stack executable, turn this on. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execstack 1

okay but fr fr: those executable-memory booleans are not a cute lil trend. They’re warnings. 🚨

---

📁 MANAGED FILES 📁

The SELinux process type virt_hook_unconfined_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the processes UID still need to have DAC permissions. 👀

• file_type
  • all files on the system

---

🛠️ COMMANDS 🛠️

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

---

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage .

---

🌈 SEE ALSO 🌈

• selinux(8)
• virt_hook_unconfined(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

mwah 💋 source/version: SELinux Policy virt_hook_unconfined / footer version virt_hook_unconfined · date: 26-10-06 · manual: virt_ho...selinux(8). periodt 💅✨