{"id":4491,"date":"2022-12-20T18:08:48","date_gmt":"2022-12-20T21:08:48","guid":{"rendered":"http:\/\/lode.uno\/linux-man\/index.php\/2022\/12\/20\/selinux_config-man5\/"},"modified":"2022-12-20T18:08:48","modified_gmt":"2022-12-20T21:08:48","slug":"selinux_config-man5","status":"publish","type":"post","link":"https:\/\/lode.uno\/linux-man\/2022\/12\/20\/selinux_config-man5\/","title":{"rendered":"selinux_config (man5)"},"content":{"rendered":"

selinux_config<\/h1>\n

NAME<\/a>
DESCRIPTION<\/a>
FILE FORMAT<\/a>
EXAMPLE<\/a>
SEE ALSO<\/a> <\/p>\n

\n

NAME <\/a> <\/h2>\n

config \u2212 The SELinux sub-system configuration file.<\/p>\n

DESCRIPTION <\/a> <\/h2>\n

The SELinux config<\/i> file controls the state of SELinux regarding:<\/p>\n\n\n\n\n\n
<\/td>\n\n

1.<\/p>\n<\/td>\n

<\/td>\n\n

The policy enforcement status \u2212 enforcing<\/i>, permissive<\/i> or disabled<\/i>.<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

2.<\/p>\n<\/td>\n

<\/td>\n\n

The policy name or type that forms a path to the policy to be loaded and its supporting configuration files.<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

3.<\/p>\n<\/td>\n

<\/td>\n\n

How SELinux-aware login applications should behave if no valid SELinux users are configured.<\/p>\n<\/td>\n<\/tr>\n

<\/td>\n\n

4.<\/p>\n<\/td>\n

<\/td>\n\n

Whether the system is to be relabeled or not.<\/p>\n<\/td>\n<\/tr>\n<\/table>\n

The entries controlling these functions are described in the FILE FORMAT<\/b> section.<\/p>\n

The fully qualified path name of the SELinux configuration file is \/etc\/selinux\/config<\/i>.<\/p>\n

If the config<\/i> file is missing or corrupt, then no SELinux policy is loaded (i.e. SELinux is disabled).<\/p>\n

The sestatus<\/b> (8) command and the libselinux function selinux_path<\/b> (3) will return the location of the config<\/i> file.<\/p>\n

FILE FORMAT <\/a> <\/h2>\n

The config<\/i> file supports the following parameters:<\/p>\n

SELINUX =<\/b> enforcing<\/i> | permissive<\/i> | disabled<\/i>
SELINUXTYPE =<\/b> policy_name<\/i>
REQUIREUSERS =<\/b> 0<\/i> | 1<\/i>
AUTORELABEL =<\/b> 0<\/i> | 1<\/i><\/p>\n

Where:
SELINUX<\/b><\/p>\n

This entry can contain one of three values:<\/p>\n

enforcing<\/i><\/p>\n

SELinux security policy is enforced.<\/p>\n

permissive<\/i><\/p>\n

SELinux security policy is not enforced but logs the warnings (i.e. the action is allowed to proceed).<\/p>\n

disabled<\/i><\/p>\n

No SELinux policy is loaded. This option was used to disable SELinux completely, which is now deprecated. Use the selinux=0<\/b> kernel boot option instead (see selinux<\/b>(8)).<\/p>\n

The entry can be determined using the sestatus<\/b>(8) command or selinux_getenforcemode<\/b>(3).<\/p>\n

SELINUXTYPE<\/b><\/p>\n

The policy_name<\/i> entry is used to identify the policy type, and becomes the directory name of where the policy and its configuration files are located.<\/p>\n

The entry can be determined using the sestatus<\/b>(8) command or selinux_getpolicytype<\/b>(3).<\/p>\n

The policy_name<\/i> is relative to a path that is defined within the SELinux subsystem that can be retrieved by using selinux_path<\/b>(3). An example entry retrieved by selinux_path<\/b>(3) is:<\/p>\n

\/etc\/selinux\/<\/i><\/p>\n

The policy_name<\/i> is then appended to this and becomes the \u2019policy root\u2019 location that can be retrieved by selinux_policy_root_path<\/b>(3). An example entry retrieved is:<\/p>\n

\/etc\/selinux\/targeted<\/i><\/p>\n

The actual binary policy is located relative to this directory and also has a policy name pre-allocated. This information can be retrieved using selinux_binary_policy_path<\/b>(3). An example entry retrieved by selinux_binary_policy_path<\/b>(3) is:<\/p>\n

\/etc\/selinux\/targeted\/policy\/policy<\/i><\/p>\n

The binary policy name has by convention the SELinux policy version that it supports appended to it. The maximum policy version supported by the kernel can be determined using the sestatus<\/b>(8) command or security_policyvers<\/b>(3). An example binary policy file with the version is:<\/p>\n

\/etc\/selinux\/targeted\/policy\/policy.24<\/i><\/p>\n

REQUIRESEUSERS<\/b><\/p>\n

This optional entry can be used to fail a login if there is no matching or default entry in the seusers<\/b>(5) file or if the seusers<\/b> file is missing.<\/p>\n

It is checked by getseuserbyname<\/b>(3) that is called by SELinux-aware login applications such as PAM<\/b>(8).<\/p>\n

If set to 0<\/i> or the entry missing:<\/p>\n

getseuserbyname<\/b>(3) will return the GNU \/ Linux user name as the SELinux user.<\/p>\n

If set to 1<\/i>:<\/p>\n

getseuserbyname<\/b>(3) will fail.<\/p>\n

The getseuserbyname<\/b>(3) man page should be consulted for its use. The format of the seusers<\/i> file is shown in seusers<\/b>(5).<\/p>\n

AUTORELABEL<\/b><\/p>\n

This is an optional entry that allows the file system to be relabeled.<\/p>\n

If set to 0<\/i> and there is a file called .autorelabel<\/i> in the root directory, then on a reboot, the loader will drop to a shell where a root login is required. An administrator can then manually relabel the file system.<\/p>\n

If set to 1<\/i> or no entry present (the default) and there is a .autorelabel<\/i> file in the root directory, then the file system will be automatically relabeled using fixfiles \u2212F restore<\/b><\/p>\n

In both cases the \/.autorelabel<\/i> file will be removed so that relabeling is not done again.<\/p>\n

EXAMPLE <\/a> <\/h2>\n

This example config<\/i> file shows the minimum contents for a system to run SELinux in enforcing mode, with a policy_name<\/i> of \u2019targeted\u2019:<\/p>\n

SELINUX = enforcing
SELINUXTYPE = targeted<\/p>\n

SEE ALSO <\/a> <\/h2>\n

selinux<\/b>(8), sestatus<\/b>(8), selinux_path<\/b>(3), selinux_policy_root_path<\/b>(3), selinux_binary_policy_path<\/b>(3), getseuserbyname<\/b>(3), PAM<\/b>(8), fixfiles<\/b>(8), selinux_mkload_policy<\/b>(3), selinux_getpolicytype<\/b>(3), security_policyvers<\/b>(3), selinux_getenforcemode<\/b>(3), seusers<\/b>(5)<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

config \u2212 The SELinux sub-system configuration file. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[959],"tags":[961,1291,1463],"class_list":["post-4491","post","type-post","status-publish","format-standard","hentry","category-5-formatos-de-ficheros","tag-961","tag-man5","tag-selinux_config"],"gutentor_comment":0,"_links":{"self":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/comments?post=4491"}],"version-history":[{"count":0,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/posts\/4491\/revisions"}],"wp:attachment":[{"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/media?parent=4491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/categories?post=4491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lode.uno\/linux-man\/wp-json\/wp\/v2\/tags?post=4491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}