SELinux domainss3
%s
sv %s_selinux(8) - Security Enhanced Linux Policy for the %s SELinux processes
s %s
s %s has been created( R R R} R R Re R R R ( R t htmlR t lettert
rolename_bodyR t rolenamet domainname_bodyt
domainname( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR sL
%
%
c C s@ | j d } t | d } | j d | j d | GHd S( Ns style.cssR sf
html, body {
background-color: #fcfcfc;
font-family: arial, sans-serif;
font-size: 110%;
color: #333;
}
h1, h2, h3, h4, h5, h5 {
color: #2d7c0b;
font-family: arial, sans-serif;
margin-top: 25px;
}
a {
color: #336699;
text-decoration: none;
}
a:visited {
color: #4488bb;
}
a:hover, a:focus, a:active {
color: #07488A;
text-decoration: none;
}
a.func {
color: red;
text-decoration: none;
}
a.file {
color: red;
text-decoration: none;
}
pre.code {
background-color: #f4f0f4;
// font-family: monospace, courier;
font-size: 110%;
margin-left: 0px;
margin-right: 60px;
padding-top: 5px;
padding-bottom: 5px;
padding-left: 8px;
padding-right: 8px;
border: 1px solid #AADDAA;
}
.url {
font-family: serif;
font-style: italic;
color: #440064;
}
s %s has been created( R R R} R ( R t style_cssR ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR * s
7
( t __name__t
__module__t __doc__R R R R R ( ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR s Gc B s^ e Z d Z d' Z d d g Z d d e e d Z d Z d Z d Z
d Z d
Z d Z
d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! d Z" d! Z# d" Z$ d# Z% d$ Z& d% Z' d& Z( RS(( sK
Generate a Manpage on an SELinux domain in the specified path
t Disabledt Enableds /tmpRi c C s | | _ | | _ | | _ t d | _ t | _ t | _ t | _
t | _ t
| _ t | _ t d | _ t d | _ t | _ t | _ t | _ | j r | j d | _ n | j t j | _ t | j | _ t j j! | s t j" | n | | _ | j rB| j d | _# n | j d | _# t$ | j# | _% t& | \ | _' | _( | j' d | _) | j* d | | j' f | _+ t, | j+ d | _- | j' d | j k r | j. | j r&t/ j0 | j+ q&n& | j r t1 j0 | j+ n | j2 | j- j3 xN t4 t5 j6 D]: } | | j' k rFx" t5 | D] } | j7 | qfWqFqFWd S(
Ni i t
file_contextss
policy.xmls# /usr/share/selinux/devel/policy.xmlt _ts %s/%s_selinux.8R t _r(8 R t source_filesR? t
gen_port_dictt portrecsR RW RX t all_domainst get_all_attributest all_attributest
get_all_boolst all_boolst get_all_port_typest all_port_typesRZ t all_rolesRO t all_userst all_users_ranget get_all_file_typest all_file_typest get_all_role_allowst role_allowsRb RQ t fcpatht selinuxt selinux_file_context_patht
get_fcdictt fcdictR R4 t existst makedirst xmlpatht
gen_bool_dictt
booleans_dictt gen_short_nameR t
short_namet typet
_gen_boolst
man_page_pathR R t _ManPage__gen_user_man_pageR RG R t _ManPage__gen_man_pageR R t
equiv_dictt keyst _ManPage__gen_man_page_link( R R R4 R? R R t kt alias( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR q sV
c C s g | _ g | _ | j g } | j t k ro x? t | j D]- } | d | j k r; | j | d q; q; Wn x> | D]6 } t | \ } } | j | 7_ | j | 7_ qv W| j j | j j d S( NR ( t boolst domainboolsR R R R RG t get_boolsRJ ( R RQ t tR R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR s
c C s | j S( N( R ( R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyt get_man_page_path s c C s' | j d | _ | j s. t | j | _ n y | j | j | _ Wn d | j | _ n X| j | j k r t j t j | j
d d | _ | j | j
| j | j | j | j | j | j n | j | j | j | j | j | j d S( NR s %s user rolei R^ ( R R] R* R; R t descR RS RE R_ R R^ t _user_headert _user_attributet _can_sudot _xwindows_logint _networkt _booleanst
_home_exect _transitionst _role_headert _port_typest
_mcs_typest _writest _footer( R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyt __gen_user_man_page s. #
c C s_ d | j | f } t d | j | f d | _ | j j d | j | j j | GHd S( Ns %s/%s_selinux.8R s .so man8/%s_selinux.8( R4 R R R} R R ( R R R4 ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyt __gen_man_page_link s
c C sA g | _ i | _ g | _ | j x | j D] } yW t | r | j } | j } x t | D] } | j | q_ W| | _ | | _ n Wn t k
r q/ n Xt j
t j d | d d | j | } x5 | | D]) \ } } | j j d d
j | q Wq{ Wn | j | j d d } t | d k r' | j j d | j xI | D]> } x5 | | D]) \ } } | j j d d
j | qWqWq' q' Wd S( Ni( t networks
.SH NETWORK
R
R t name_bindi sH
.TP
The SELinux user %s_u is able to listen on the following %s ports.
s
.B %s
R t name_connectsJ
.TP
The SELinux user %s_u is able to connect to the following tcp ports.
( s tcps udp( RS RD R R} t get_network_connectR Re R Rd ( R RD t nett portdictR
R R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR e s(
c C s t j t j g i | j d 6d d 6d d 6d d d d d
d g d 6 } | j j d
| d k r | j j d | j n | j j d | j d S( NR% t user_home_typeR* R( R) t ioctlt readt getattrt executet execute_no_transR R' s
.SH HOME_EXEC
s;
The SELinux user %s_u is able execute home content files.
s?
The SELinux user %s_u is not able execute home content files.
( RS R, R- R R R} R6 R ( R R' ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR s I c C s, | j j d i | j d 6| j d 6 d S( Ns
.SH TRANSITIONS
Three things can happen when %(type)s attempts to execute a program.
\fB1.\fP SELinux Policy can deny %(type)s from executing the program.
.TP
\fB2.\fP SELinux Policy can allow %(type)s to execute the program in the current user type.
Execute the following to see the types that the SELinux user %(type)s can execute without transitioning:
.B sesearch -A -s %(type)s -c file -p execute_no_trans
.TP
\fB3.\fP SELinux can allow %(type)s to execute the program and transition to a new type.
Execute the following to see the types that the SELinux user %(type)s can execute and transition:
.B $ sesearch -A -s %(type)s -c process -p transition
R% R ( R R} R R ( R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR s c C s | j j d i | j d 6 | j j d i | j d 6| j d 6 g } x; | j D]0 } | j d | j | k rV | j | qV qV Wt | d k r d } t | d k r d } | j j d
d j | | | j f q n d S( Nsd .TH "%(user)s_selinux" "8" "%(user)s" "mgrepl@redhat.com" "%(user)s SELinux Policy documentation"R% s]
.SH "NAME"
%(user)s_r \- \fB%(desc)s\fP - Security Enhanced Linux Policy
.SH DESCRIPTION
SELinux supports Roles Based Access Control (RBAC), some Linux roles are login roles, while other roles need to be transition into.
.I Note:
Examples in this man page will use the
.B staff_u
SELinux user.
Non login roles are usually used for administrative tasks. For example, tasks that require root privileges. Roles control which types a user can run processes with. Roles often have default types assigned to them.
The default type for the %(user)s_r role is %(user)s_t.
The
.B newrole
program to transition directly to this role.
.B newrole -r %(user)s_r -t %(user)s_t
.B sudo
is the preferred method to do transition from one role to another. You setup sudo to transition to %(user)s_r by adding a similar line to the /etc/sudoers file.
USERNAME ALL=(ALL) ROLE=%(user)s_r TYPE=%(user)s_t COMMAND
.br
sudo will run COMMAND as staff_u:%(user)s_r:%(user)s_t:LEVEL
When using a a non login role, you need to setup SELinux so that your SELinux user can reach %(user)s_r role.
Execute the following to see all of the assigned SELinux roles:
.B semanage user -l
You need to add %(user)s_r to the staff_u user. You could setup the staff_u user to be able to use the %(user)s_r role with a command like:
.B $ semanage user -m -R 'staff_r system_r %(user)s_r' staff_u
R R i RB i R s
SELinux policy also controls which roles can transition to a different role.
You can list these rules using the following command.
.B sesearch --role_allow
SELinux policy allows the %s role%s can transition to the %s_r role.
s , ( R R} R R R RG Re Rd ( R t trolesRp R ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR s ) N() R R R R6 R* R RY R R R R R R R R R R R R R R R R R R! R R R$ R R R R9 R R R R RC R R R R ( ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyR j sJ 8 ! + o " + ( - ) ( R R R R
( R R
R R ( ( (" t __all__Rl t argparseR RS t sepolgenR Rw R| R t reR R R R R6 R* R; RC RD RO RR RU RW R RQ Rb Rh R R Rs R R R ( ( ( s6 /usr/lib64/python2.7/site-packages/sepolicy/manpage.pyt sH
E
|