xdm_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

🎀 xdm_selinux(8) — SELinux Policy xdm 🎀

okay bestie, you opened the xdm_selinux(8) manual page and we are gonna make it make sense. 💖

🌸 NAME 🌸

xdm_selinux — Security Enhanced Linux Policy for the xdm processes.

✨ DESCRIPTION ✨

Security-Enhanced Linux secures the xdm processes via flexible mandatory access control. iconic, honestly.

The xdm processes execute with the xdm_t SELinux type. You can totally check if you have these processes running by executing the ps command with the -Z qualifier.

For example:

ps -eZ | grep xdm_t

🦋 ENTRYPOINTS 🦋

The xdm_t SELinux type can be entered via the user_tmp_t, xdm_exec_t file types.

The default entrypoint paths for the xdm_t domain are literally these:

/run/tlog(/.*)?
/run/user/[^/]+
/dev/shm/mono.*
/tmp/.ICE-unix(/.*)?
/tmp/.X11-unix(/.*)?
/dev/shm/pulse-shm.*
/run/user
/tmp/.X0-lock
/tmp/hsperfdata_root
/var/tmp/hsperfdata_root
/home/[^/]+/tmp
/home/[^/]+/.tmp
/run/user/[0-9]+
/tmp/gconfd-[^/]+
/usr/bin/[mxgkw]dm
/usr/bin/gdm(3)?
/usr/bin/lxdm(-binary)?
/usr/X11R6/bin/[xgkw]dm
/usr/bin/lightdm*
/usr/bin/razor-lightdm-.*
/usr/bin/nodm
/usr/bin/sddm
/usr/bin/slim
/usr/bin/gpe-dm
/usr/bin/greetd
/opt/kde3/bin/kdm
/usr/bin/gdm-binary
/usr/bin/mdm-binary
/usr/bin/sddm-greeter
/usr/lib/sddm/sddm-helper
/etc/rc.d/init.d/x11-common
/usr/lib/X11/display-manager
/usr/libexec/gdm-runtime-config
/usr/libexec/gdm-disable-wayland

💅 PROCESS TYPES 💅

SELinux defines process types (domains) for each process running on the system. periodt.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux xdm policy is very flexible, allowing users to set up their xdm processes in as secure a method as possible.

The following process types are defined for xdm:

  • xdm_t
  • xdm_unconfined_t
Note: semanage permissive -a xdm_t can be used to make the process type xdm_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. iykyk 💀

👑 BOOLEANS 👑

SELinux policy is customizable based on least access required. xdm policy is extremely flexible and has several booleans that allow you to manipulate the policy and run xdm with the tightest access possible. main character policy energy ✨

  • xdm_bind_vnc_tcp_port — if you want to allow xdm_t to bind on vnc_port_t(5910), you must turn on this boolean. Disabled by default. Do it with setsebool -P xdm_bind_vnc_tcp_port 1.
  • xdm_manage_bootloader — if you want to allow the graphical login program to create, read, write, and delete files in the /boot directory and DOS filesystem, you must turn on this boolean. Enabled by default. Do it with setsebool -P xdm_manage_bootloader 1.
  • xdm_sysadm_login — if you want to allow the graphical login program to login directly as sysadm_r:sysadm_t, you must turn on this boolean. Disabled by default. Do it with setsebool -P xdm_sysadm_login 1.
  • deny_execmem — if you want to deny user domains applications to map a memory region as both executable and writable, you must turn on this boolean. This is dangerous and the executable should be reported in bugzilla. Disabled by default. Do it with setsebool -P deny_execmem 1.
  • deny_ptrace — if you want to deny any process from ptracing or debugging any other processes, you must turn on this boolean. Disabled by default. Do it with setsebool -P deny_ptrace 1.
  • fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on this boolean. Enabled by default. Do it with setsebool -P fips_mode 1.
  • kerberos_enabled — if you want to allow confined applications to run with kerberos, you must turn on this boolean. Enabled by default. Do it with setsebool -P kerberos_enabled 1.
  • nis_enabled — if you want to allow system to run with NIS, you must turn on this boolean. Disabled by default. Do it with setsebool -P nis_enabled 1.
  • polyinstantiation_enabled — if you want to enable polyinstantiated directory support, you must turn on this boolean. Disabled by default. Do it with setsebool -P polyinstantiation_enabled 1.
  • selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, you must turn on this boolean. This should never, ever be necessary. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla. Disabled by default. Do it with setsebool -P selinuxuser_execstack 1.
  • use_ecryptfs_home_dirs — if you want to support ecryptfs home directories, you must turn on this boolean. Disabled by default. Do it with setsebool -P use_ecryptfs_home_dirs 1.
  • use_fusefs_home_dirs — if you want to support fusefs home directories, you must turn on this boolean. Disabled by default. Do it with setsebool -P use_fusefs_home_dirs 1.
  • use_nfs_home_dirs — if you want to support NFS home directories, you must turn on this boolean. Enabled by default. Do it with setsebool -P use_nfs_home_dirs 1.
  • use_samba_home_dirs — if you want to support SAMBA home directories, you must turn on this boolean. Disabled by default. Do it with setsebool -P use_samba_home_dirs 1.

🌈 PORT TYPES 🌈

SELinux defines port types to represent TCP and UDP ports.

You can see the types associated with a port by using the following command:

semanage port -l

Policy governs the access confined processes have to these ports. SELinux xdm policy is very flexible, allowing users to set up their xdm processes in as secure a method as possible.

The following port types are defined for xdm:

  • xdmcp_port_t

Default Defined Ports:

tcp 177
udp 177

🗂️ MANAGED FILES 🗂️

The SELinux process type xdm_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions. don't forget that part, bestie 🫶

auth_cache_t

/var/cache/coolkey(/.*)?

auth_home_t

/root/.yubico(/.*)?
/root/.config/Yubico(/.*)?
/root/.google_authenticator
/root/.google_authenticator~
/home/[^/]+/.yubico(/.*)?
/home/[^/]+/.config/Yubico(/.*)?
/home/[^/]+/.google_authenticator
/home/[^/]+/.google_authenticator~

cifs_t

(no default paths listed)

dosfs_t

(no default paths listed)

faillog_t

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

fusefs_t

/run/user/[0-9]+/gvfs

gnome_initial_setup_var_lib_t

/var/lib/gnome-initial-setup(/.*)?

gnome_initial_setup_var_run_t

/run/gnome-initial-setup(/.*)?

initrc_var_run_t

/run/sysconfig(/.*)?
/run/utmp
/run/keymap
/run/numlock-on
/run/setleds-on
/run/runlevel.dir
/run/setmixer_flag
/run/bootsplashctl

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

nfs_t

(no default paths listed)

pam_var_console_t

/run/console(/.*)?

pam_var_run_t

/var/(db|adm)/sudo(/.*)?
/run/sudo(/.*)?
/run/pam_ssh(/.*)?
/run/sepermit(/.*)?
/var/lib/sudo(/.*)?
/run/pam_mount(/.*)?
/run/pam_timestamp(/.*)?

security_t

/selinux

sysfs_t

/sys(/.*)?

systemd_passwd_var_run_t

/run/systemd/ask-password(/.*)?
/run/systemd/ask-password-block(/.*)?

tmpfs_t

/dev/shm
/run/shm
/usr/lib/udev/devices/shm

user_tmp_t

/run/tlog(/.*)?
/run/user/[^/]+
/dev/shm/mono.*
/tmp/.ICE-unix(/.*)?
/tmp/.X11-unix(/.*)?
/dev/shm/pulse-shm.*
/run/user
/tmp/.X0-lock
/tmp/hsperfdata_root
/var/tmp/hsperfdata_root
/home/[^/]+/tmp
/home/[^/]+/.tmp
/run/user/[0-9]+
/tmp/gconfd-[^/]+

user_tmp_type

all user tmp files

var_auth_t

/var/ace(/.*)?
/var/rsa(/.*)?
/var/lib/abl(/.*)?
/var/lib/rsa(/.*)?
/var/lib/pam_ssh(/.*)?
/var/lib/pam_shield(/.*)?
/var/opt/quest/vas/vasd(/.*)?
/var/lib/google-authenticator(/.*)?

wtmpdb_journal_t

/var/lib/wtmpdb/wtmp.db-journal

xdm_lock_t

(no default paths listed)

xdm_log_t

/var/log/[mkwx]dm.log.*
/var/log/mdm(/.*)?
/var/log/lxdm.log.*
/var/log/slim.log.*

xdm_spool_t

/var/spool/[mg]dm(/.*)?

xdm_tmpfs_t

(no default paths listed)

xdm_var_lib_t

/var/lib/[mxkwg]dm(/.*)?
/var/cache/[mg]dm(/.*)?
/var/lib/gdm(3)?(/.*)?
/var/lib/lxdm(/.*)?
/var/lib/sddm(/.*)?
/var/lib/greetd(/.*)?
/var/lib/lightdm(/.*)?
/var/cache/lightdm(/.*)?
/var/lib/lightdm-data(/.*)?
/var/lib/cosmic-greeter(/.*)?
/var/lib/pam_devperm/:0

xdm_var_run_t

/run/[kgm]dm(/.*)?
/run/gdm(3)?.pid
/run/gdm(3)?(/.*)?
/etc/kde[34]?/kdm/backgroundrc
/run/slim.*
/run/lxdm(/.*)?
/run/sddm(/.*)?
/run/xauth(/.*)?
/run/xdmctl(/.*)?
/run/greetd[^/]*.sock
/run/lightdm(/.*)?
/usr/lib/qt-.*/etc/settings(/.*)?
/run/systemd/multi-session-x(/.*)?
/run/xdm.pid
/run/lxdm.pid
/run/lxdm.auth
/run/greetd.run
/run/gdm_socket

xkb_var_lib_t

/var/lib/xkb(/.*)?
/usr/X11R6/lib/X11/xkb/.*
/usr/X11R6/lib/X11/xkb

xserver_log_t

/var/[xgkw]dm(/.*)?
/usr/var/[xgkw]dm(/.*)?
/var/log/gdm(3)?(/.*)?
/var/log/Xorg.*
/var/log/XFree86.*
/var/log/lightdm(/.*)?
/var/log/nvidia-installer.log.*

xserver_tmpfs_t

(no default paths listed)

🌈 FILE CONTEXTS 🌈

okay so real talk — SELinux needs every file to have an extended attribute that says what type of file it is. That's just how it works, no cap.

You can peep the context of any file with the -Z option to ls ✨

Policy is what governs how confined processes are allowed to touch these files. And the SELinux xdm policy is genuinely super flexible — it lets users set up their xdm processes in as secure a method as possible. Periodt. 👑

🎀 EQUIVALENCE DIRECTORIES 🎀

So the xdm policy stores data with multiple different file context types under the /var/lib/lightdm directory. If you'd rather store that data somewhere else, you use the semanage command to create an equivalence mapping. Say you wanted to keep this data under the /srv directory — you'd run:

semanage fcontext -a -e /var/lib/lightdm /srv/lightdm
restorecon -R -v /srv/lightdm

slay, that's it 💅

🌸 STANDARD FILE CONTEXT 🌸

SELinux defines the file context types for xdm, so if you want to store files with these types in different paths, you gotta run the semanage command to specify the alternate labeling and then use restorecon to actually put the labels on disk, bestie.

semanage fcontext -a -t xdm_unconfined_exec_t '/srv/xdm/content(/.*)?'
restorecon -R -v /srv/myxdm_content
💡 Note: SELinux often uses regular expressions to specify labels that match multiple files. So like, regex is doing a lot of heavy lifting here, iykyk.

The following file types are defined for xdm:

🦋 xdm_etc_t

  • Set files with the xdm_etc_t type if you want to store xdm files in the /etc directories.

Paths:

/etc/[mg]dm(/.*)?, /etc/sysconfig/displaymanager

🦋 xdm_exec_t

  • Set files with the xdm_exec_t type if you want to transition an executable to the xdm_t domain.

Paths:

/usr/bin/[mxgkw]dm, /usr/bin/gdm(3)?, /usr/bin/lxdm(-binary)?,
/usr/X11R6/bin/[xgkw]dm, /usr/bin/lightdm*, /usr/bin/razor-lightdm-.*,
/usr/bin/nodm, /usr/bin/sddm, /usr/bin/slim, /usr/bin/gpe-dm,
/usr/bin/greetd, /opt/kde3/bin/kdm, /usr/bin/gdm-binary,
/usr/bin/mdm-binary, /usr/bin/sddm-greeter, /usr/lib/sddm/sddm-helper,
/etc/rc.d/init.d/x11-common, /usr/lib/X11/display-manager,
/usr/libexec/gdm-runtime-config, /usr/libexec/gdm-disable-wayland

🦋 xdm_home_t

  • Set files with the xdm_home_t type if you want to store xdm files in the users home directory.

Paths:

/root/.dmrc.*, /root/.wayland-errors.*, /root/.xsession-errors.*,
/home/[^/]+/.dmrc.*, /home/[^/]+/.cache/gdm(/.*)?,
/home/[^/]+/.wayland-errors.*, /home/[^/]+/.xsession-errors.*,
/home/[^/]+/.local/share/xorg(/.*)?

🦋 xdm_lock_t

  • Set files with the xdm_lock_t type if you want to treat the files as xdm lock data, stored under the /var/lock directory

🦋 xdm_log_t

  • Set files with the xdm_log_t type if you want to treat the data as xdm log data, usually stored under the /var/log directory.

Paths:

/var/log/[mkwx]dm.log.*, /var/log/mdm(/.*)?, /var/log/lxdm.log.*,
/var/log/slim.log.*

🦋 xdm_rw_etc_t

  • Set files with the xdm_rw_etc_t type if you want to store xdm rw files in the /etc directories.

Paths:

/etc/X11/wdm(/.*)?, /etc/opt/VirtualGL(/.*)?

🦋 xdm_spool_t

  • Set files with the xdm_spool_t type if you want to store the xdm files under the /var/spool directory.

🦋 xdm_tmpfs_t

  • Set files with the xdm_tmpfs_t type if you want to store xdm files on a tmpfs file system.

🦋 xdm_unconfined_exec_t

  • Set files with the xdm_unconfined_exec_t type if you want to transition an executable to the xdm_unconfined_t domain.

Paths:

/etc/[mg]dm/Init(/.*)?, /etc/[mg]dm/PostLogin(/.*)?,
/etc/[mg]dm/PreSession(/.*)?, /etc/[mg]dm/PostSession(/.*)?

🦋 xdm_unit_file_t

  • Set files with the xdm_unit_file_t type if you want to treat the files as xdm unit content.

Paths:

/usr/lib/systemd/user/.*gnome.*.(service|target),
/usr/lib/systemd/user/plasma-.*.(service|target),
/usr/lib/systemd/user/graphical-session-pre.target

🦋 xdm_var_lib_t

  • Set files with the xdm_var_lib_t type if you want to store the xdm files under the /var/lib directory.

Paths:

/var/lib/[mxkwg]dm(/.*)?, /var/cache/[mg]dm(/.*)?,
/var/lib/gdm(3)?(/.*)?, /var/lib/lxdm(/.*)?, /var/lib/sddm(/.*)?,
/var/lib/greetd(/.*)?, /var/lib/lightdm(/.*)?,
/var/cache/lightdm(/.*)?, /var/lib/lightdm-data(/.*)?,
/var/lib/cosmic-greeter(/.*)?, /var/lib/pam_devperm/:0

🦋 xdm_var_run_t

  • Set files with the xdm_var_run_t type if you want to store the xdm files under the /run or /var/run directory.

Paths:

/run/[kgm]dm(/.*)?, /run/gdm(3)?.pid, /run/gdm(3)?(/.*)?,
/etc/kde[34]?/kdm/backgroundrc, /run/slim.*, /run/lxdm(/.*)?,
/run/sddm(/.*)?, /run/xauth(/.*)?, /run/xdmctl(/.*)?,
/run/greetd[^/]*.sock, /run/lightdm(/.*)?,
/usr/lib/qt-.*/etc/settings(/.*)?, /run/systemd/multi-session-x(/.*)?,
/run/xdm.pid, /run/lxdm.pid, /run/lxdm.auth, /run/greetd.run,
/run/gdm_socket
⚠️ Note: file context can be temporarily modified with the chcon command. But if you want to permanently change the file context, you need to use the semanage fcontext command — that's the one that modifies the SELinux labeling database. And then you'll need restorecon to actually apply the labels. Don't skip that step, bestie, I'm begging 😭

👑 COMMANDS 👑

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage port can also be used to manipulate the port definitions
  • semanage boolean can also be used to manipulate the booleans
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. 🖱️✨

💜 AUTHOR 💜

This manual page was auto-generated using sepolicy manpage. (not me writing it by hand, the robots did it 🤖💅)

🫶 SEE ALSO 🫶

selinux(8), xdm(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8), xdm_unconfined_selinux(8), xdm_unconfined_selinux(8)

(yes, xdm_unconfined_selinux(8) is listed twice — she said it twice because she meant it 💀)

okay that's the whole page, you made it!! so proud of you fr fr 🎀✨

this was xdm from xdm_selinux(8), dated 26-10-06 — go off and configure your display manager, main character 🌈💜

📦 where this page comes from