zarafa_ical_selinux(8)

💅 zarafa_ical_selinux(8) — the glow-up edition

Okay bestie, so this is the SELinux policy manpage for the zarafa_ical processes, from the zarafa_ical_selinux manual — yes the manual name is literally the same as this page, iconic naming honestly. Sit down, hydrate, and let's get into it 💖

✨ NAME ✨

zarafa_ical_selinux — the Security Enhanced Linux Policy for zarafa_ical processes. That's it, that's the whole vibe. 💫

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the zarafa_ical processes via flexible mandatory access control. No cap — that's the flex.

The zarafa_ical processes execute with the zarafa_ical_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier. Easy peasy:

ps -eZ | grep zarafa_ical_t

Slay, now you know what's up 🎀

🦋 ENTRYPOINTS 🦋

The zarafa_ical_t SELinux type can be entered via the zarafa_ical_exec_t file type. That's the door, that's the entrance, main character energy all around.

The default entrypoint paths for the zarafa_ical_t domain are literally this one iconic path:

/usr/bin/zarafa-ical

👑 PROCESS TYPES 👑

So SELinux defines process types (domains) for each process running on the system. Every process gets a whole personality, basically.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux zarafa_ical policy is very flexible, allowing users to setup their zarafa_ical processes in as secure a method as possible. Secure and flexible? We love a multitalented icon.

The following process types are defined for zarafa_ical:

• zarafa_ical_t

Note: semanage permissive -a zarafa_ical_t can be used to make the process type zarafa_ical_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like... it stops blocking you, but it's still gonna text everyone about it 💀

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required — like, give them the bare minimum and nothing more, boundaries bestie ✋ zarafa_ical policy is extremely flexible and has several booleans that allow you to manipulate the policy and run zarafa_ical with the tightest access possible. Locked down and gorgeous.

If you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

If you want to allow zarafa domains to setrlimit/sys_resource, you must turn on the zarafa_setrlimit boolean. Disabled by default.

setsebool -P zarafa_setrlimit 1

Obsessed with how tidy that is 🫶

🧚 MANAGED FILES 🧚

The SELinux process type zarafa_ical_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux said "I'll handle my part, you handle yours" 😤

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

zarafa_ical_log_t

/var/log/zarafa/ical.log.*

zarafa_ical_var_run_t

/run/zarafa-ical.pid

That's the whole roster, every single path accounted for, we don't skip a single one 💜

🌈 FILE CONTEXTS 🌈

SELinux requires files to have an extended attribute to define the file type. It's giving "everything needs a label" and honestly, fair.

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. SELinux zarafa_ical policy is very flexible, allowing users to setup their zarafa_ical processes in as secure a method as possible.

⭐ STANDARD FILE CONTEXT ⭐

SELinux defines the file context types for the zarafa_ical, if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

semanage fcontext -a -t zarafa_ical_exec_t
'/srv/zarafa_ical/content(/.*)?'
restorecon -R -v /srv/myzarafa_ical_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. Regex girlies stay winning 🎀

The following file types are defined for zarafa_ical:

• zarafa_ical_exec_t — Set files with the zarafa_ical_exec_t type, if you want to transition an executable to the zarafa_ical_t domain.
• zarafa_ical_log_t — Set files with the zarafa_ical_log_t type, if you want to treat the data as zarafa ical log data, usually stored under the /var/log directory.
• zarafa_ical_var_run_t — Set files with the zarafa_ical_var_run_t type, if you want to store the zarafa ical files under the /run or /var/run directory.

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. So like — chcon is the fleeting vibe, semanage fcontext + restorecon is the committed relationship 😭💍

💀 COMMANDS 💀

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings — for the besties who prefer clicking to typing, no judgment 🫶

---

🦋 AUTHOR 🦋

This manual page was auto-generated using sepolicy manpage . (Yes, the robot wrote it, and yes, it ate.)

🔥 SEE ALSO 🔥

selinux(8), zarafa_ical(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

And that's the whole page bestie, every last path and boolean accounted for ✨ This came from the zarafa_ical source, version/date stamp 26-10-06, filed under zarafa_ical_selinux(8) in section 8 of the manual. Go forth and label your files responsibly, mwah 💖🎀