One Hat Cyber Team

Your IP : 216.73.216.115

Server IP : 194.44.31.54

Server : Linux zen.imath.kiev.ua 4.18.0-553.77.1.el8_10.x86_64 #1 SMP Fri Oct 3 14:30:23 UTC 2025 x86_64

Server Software : Apache/2.4.37 (Rocky Linux) OpenSSL/1.1.1k

PHP Version : 5.6.40

Buat File | Buat Folder

Dir : ~/backup/oldserver/2/usr/share/selinux/devel/html/

Edit File: svirt_socket.html

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta name="generator" content="groff -Thtml, see www.gnu.org">
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<meta name="Content-Style" content="text/css">
<style type="text/css">
 p { margin-top: 0; margin-bottom: 0; vertical-align: top }
 pre { margin-top: 0; margin-bottom: 0; vertical-align: top }
 table { margin-top: 0; margin-bottom: 0; vertical-align: top }
 h1 { text-align: center }
</style>
<title>svirt_socket_selinux</title>

</head>
<body>

<h1 align="center">svirt_socket_selinux</h1>

<a href="#NAME">NAME</a> 
<a href="#DESCRIPTION">DESCRIPTION</a> 
<a href="#PROCESS TYPES">PROCESS TYPES</a> 
<a href="#BOOLEANS">BOOLEANS</a> 
<a href="#COMMANDS">COMMANDS</a> 
<a href="#AUTHOR">AUTHOR</a> 
<a href="#SEE ALSO">SEE ALSO</a>

<hr>

svirt_socket_selinux
&minus; Security Enhanced Linux Policy for the svirt_socket
processes

<h2>DESCRIPTION
<a name="DESCRIPTION"></a>
</h2>

Security-Enhanced
Linux secures the svirt_socket processes via flexible
mandatory access control.

The
svirt_socket processes execute with the svirt_socket_t
SELinux type. You can check if you have these processes
running by executing the ps command with the
&minus;Z qualifier.

For
example:

ps -eZ |
grep svirt_socket_t

<h2>PROCESS TYPES
<a name="PROCESS TYPES"></a>
</h2>

SELinux defines
process types (domains) for each process running on the
system

You can see the
context of a process using the &minus;Z option to
ps

Policy governs
the access confined processes have to files. SELinux
svirt_socket policy is very flexible allowing users to setup
their svirt_socket processes in as secure a method as
possible.

The following
process types are defined for svirt_socket:

svirt_socket_t

Note:
semanage permissive -a svirt_socket_t can be used to
make the process type svirt_socket_t permissive. SELinux
does not deny access to permissive process types, but the
AVC (SELinux denials) messages are still generated.

<h2>BOOLEANS
<a name="BOOLEANS"></a>
</h2>

SELinux policy
is customizable based on least access required. svirt_socket
policy is extremely flexible and has several booleans that
allow you to manipulate the policy and run svirt_socket with
the tightest access possible.

If you want to
deny any process from ptracing or debugging any other
processes, you must turn on the deny_ptrace boolean. Enabled
by default.

setsebool -P
deny_ptrace 1

If you want to
allow all domains to use other domains file descriptors, you
must turn on the domain_fd_use boolean. Enabled by
default.

setsebool -P
domain_fd_use 1

If you want to
allow all domains to have the kernel load modules, you must
turn on the domain_kernel_load_modules boolean. Disabled by
default.

setsebool -P
domain_kernel_load_modules 1

If you want to
allow all domains to execute in fips_mode, you must turn on
the fips_mode boolean. Enabled by default.

setsebool -P
fips_mode 1

If you want to
enable reading of urandom for all domains, you must turn on
the global_ssp boolean. Disabled by default.

setsebool -P
global_ssp 1

<h2>COMMANDS
<a name="COMMANDS"></a>
</h2>

semanage
fcontext can also be used to manipulate default file
context mappings.

semanage
permissive can also be used to manipulate whether or not
a process type is permissive.

semanage
module can also be used to enable/disable/install/remove
policy modules.

semanage
boolean can also be used to manipulate the booleans

system-config-selinux
is a GUI tool available to customize SELinux policy
settings.

<h2>AUTHOR
<a name="AUTHOR"></a>
</h2>

This manual
page was auto-generated using sepolicy manpage .

selinux(8),
svirt_socket(8), semanage(8), restorecon(8), chcon(1),
sepolicy(8) , setsebool(8)
<hr>
</body>
</html>