zos_remote_selinux(8)

💅 zos_remote_selinux(8) — like, the whole SELinux vibe for zos_remote (manual page zos_remote_selinux(8), from the SELinux Policy zos_remote fam) 🎀

✨ NAME ✨

zos_remote_selinux — the Security Enhanced Linux Policy for the zos_remote processes, bestie. That's the whole assignment. 💖

---

🌸 DESCRIPTION 🌸

Okay so, Security-Enhanced Linux secures the zos_remote processes via flexible mandatory access control. That's the entire point, no cap. 🫶

Your zos_remote processes run as the zos_remote_t SELinux type. Want to check if you've got these processes running? Just run the ps command with the -Z qualifier. Iconic, easy, slay.

For example:

ps -eZ | grep zos_remote_t

That's it. That's the vibe check. 👑

---

🦋 ENTRYPOINTS 🦋

The zos_remote_t SELinux type can be entered via the zos_remote_exec_t file type. That's the doorway, the main entrance, the front door, iykyk. 🚪✨

The default entrypoint paths for the zos_remote_t domain are literally these:

/usr/bin/audispd-zos-remote

One path. One icon. Periodt. 💅

---

🧚 PROCESS TYPES 🧚

So SELinux defines process types (domains) for each process running on the system — every little process gets its own little label, adorable honestly. 🌈

You can see the context of a process using the -Z option to ps. (Yes, same flex as before. It keeps coming up because it keeps being useful.)

Policy governs the access confined processes have to files. The SELinux zos_remote policy is very flexible, allowing users to set up their zos_remote processes in as secure a method as possible. Maximum safety, maximum glam. 💜

The following process types are defined for zos_remote:

• zos_remote_t

Note: semanage permissive -a zos_remote_t can be used to make the process type zos_remote_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like, it stops blocking stuff but it still tells on you in the logs. 💀

---

🔥 BOOLEANS 🔥

SELinux policy is customizable based on least access required. The zos_remote policy is extremely flexible and has several booleans that allow you to manipulate the policy and run zos_remote with the tightest access possible. Little toggles, huge power. 🎛️✨

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

Two booleans, both iconic, one of them already awake. 🌸

---

🍓 MANAGED FILES 🍓

The SELinux process type zos_remote_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions — SELinux isn't out here overriding DAC, they're a team. 🤝

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

That's the whole list, all eleven paths, copy-paste exact, no skips, no edits, we don't do that here. 💖

---

🎀 FILE CONTEXTS 🎀

SELinux requires files to have an extended attribute to define the file type. Yes, files have vibes and the vibes are stored in attributes. 🦋

You can see the context of a file using the -Z option to ls. (Third time's the charm, -Z is the flag.)

Policy governs the access confined processes have to these files. The SELinux zos_remote policy is very flexible, allowing users to set up their zos_remote processes in as secure a method as possible. Same energy as before, still true, still slay.

STANDARD FILE CONTEXT

SELinux defines the file context types for zos_remote. If you wanted to store files with these types in different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. Two-step glow-up. ✨

semanage fcontext -a -t zos_remote_exec_t '/srv/zos_remote/content(/.*)?'
restorecon -R -v /srv/myzos_remote_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. Regex, we love her. 💅

The following file types are defined for zos_remote:

zos_remote_exec_t

• Set files with the zos_remote_exec_t type if you want to transition an executable to the zos_remote_t domain.

Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. So like — chcon is the temporary tattoo, semanage fcontext + restorecon is the real one. 🫶

---

😭 COMMANDS 😭

The greatest hits, the tools you'll actually be reaching for:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. (A GUI. For when clicking > typing. No judgement. 🙈)

---

💀 AUTHOR 💀

This manual page was auto-generated using sepolicy manpage. A robot wrote it and honestly it ate. 🤖💅

---

⭐ SEE ALSO ⭐

selinux(8), zos_remote(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

Like, go read them. They're linked for a reason, bestie. 🔗

---

🫶 And that's the page!! Signing off from zos_remote, dated 26-10-06, living in manual page zos_remote_selinux(8) forever and ever. Thanks for reading, mwah. 💖✨🎀