I recently moved from Ubuntu to Fedora 27, in part due to selinux being enabled by
default.
When I run `ps -alZ` I notice that there are a number of processes running unconfined
(full list included below).
Is it generally considered acceptable to have these processes running unconfined? It
seems like a security vulnerability to me.
If this is a vulnerability, does anyone know if it is safe to disable unconfined on my
Fedora desktop and what would be the best way to go about this?
Thank you,
Nathan Owen
`ps -alZ | grep unconfined` output (plus header line for clarity):
LABEL F S UID PID PPID C PRI NI ADDR SZ WCHAN TTY
TIME CMD
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1444 1439 0 80 0 - 166430
SyS_po tty2 00:00:00 gnome-session-b
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1518 1444 5 80 0 - 1005208
SyS_po tty2 00:02:17 gnome-shell
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1574 1518 0 80 0 - 136312
SyS_ep tty2 00:00:17 Xwayland
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1621 1518 0 80 0 - 136717
SyS_po tty2 00:00:00 ibus-daemon
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1630 1621 0 80 0 - 96892
SyS_po tty2 00:00:00 ibus-dconf
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1632 1 0 80 0 - 128345
SyS_po tty2 00:00:00 ibus-x11
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1703 1444 0 80 0 - 127621
SyS_po tty2 00:00:00 gsd-mouse
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1704 1444 0 80 0 - 172146
SyS_po tty2 00:00:00 gsd-power
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1705 1444 0 80 0 - 139106
SyS_po tty2 00:00:00 gsd-print-notif
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1706 1444 0 80 0 - 163911
SyS_po tty2 00:00:00 gsd-rfkill
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1707 1444 0 80 0 - 127008
SyS_po tty2 00:00:00 gsd-screensaver
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1708 1444 0 80 0 - 141153
SyS_po tty2 00:00:00 gsd-sharing
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1711 1444 0 80 0 - 153280
SyS_po tty2 00:00:00 gsd-smartcard
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1713 1444 0 80 0 - 149563
SyS_po tty2 00:00:00 gsd-wacom
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1716 1444 0 80 0 - 165971
SyS_po tty2 00:00:00 gsd-xsettings
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1724 1444 0 80 0 - 138212
SyS_po tty2 00:00:00 gsd-sound
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1731 1444 0 80 0 - 127619
SyS_po tty2 00:00:00 gsd-a11y-settin
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1735 1444 0 80 0 - 150568
SyS_po tty2 00:00:00 gsd-a11y-keyboa
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1736 1444 0 80 0 - 136716
SyS_po tty2 00:00:00 gsd-datetime
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1738 1444 0 80 0 - 128251
SyS_po tty2 00:00:00 gsd-clipboard
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1739 1444 0 80 0 - 210310
SyS_po tty2 00:00:00 gsd-color
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1742 1444 0 80 0 - 245373
SyS_po tty2 00:00:00 gsd-media-keys
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1743 1444 0 80 0 - 148237
SyS_po tty2 00:00:00 gsd-housekeepin
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1745 1444 0 80 0 - 168438
SyS_po tty2 00:00:00 gsd-keyboard
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1803 1621 0 80 0 - 78439
SyS_po tty2 00:00:00 ibus-engine-sim
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1878 1444 0 80 0 - 298030
SyS_po tty2 00:00:00 evolution-alarm
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1884 1444 0 80 0 - 160994
SyS_po tty2 00:00:00 abrt-applet
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1889 1444 0 99 - - 197079
SyS_po tty2 00:00:00 tracker-miner-a
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1891 1444 0 99 19 - 183615
SyS_po tty2 00:00:00 tracker-miner-f
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1895 1444 0 99 - - 414121
SyS_po tty2 00:00:00 tracker-extract
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1901 1444 0 80 0 - 352568
SyS_po tty2 00:00:10 gnome-software
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1912 1444 0 80 0 - 142411
SyS_po tty2 00:00:00 seapplet
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1919 1444 0 80 0 - 69563
SyS_po tty2 00:00:00 gsd-disk-utilit
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 1937 1 0 80 0 - 154397
SyS_po tty2 00:00:00 gsd-printer
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4 S 1000 2610 1518 4 80 0 - 364264
SyS_po tty2 00:01:33 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 2617 2610 0 80 0 - 28706 -
tty2 00:00:00 cat
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 2618 2610 0 80 0 - 28706 -
tty2 00:00:00 cat
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4 S 1000 2621 2610 0 80 0 - 132436
- tty2 00:00:00 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4 S 1000 2622 2621 0 80 0 - 5996 -
tty2 00:00:00 nacl_helper
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 5 S 1000 2625 2621 0 80 0 - 132436
SyS_pp tty2 00:00:00 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 2707 2610 2 80 0 - 174162
SyS_po tty2 00:00:49 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 2721 2707 0 80 0 - 140547
- tty2 00:00:00 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 2747 2625 0 80 0 - 429151
- tty2 00:00:15 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 2799 2625 0 80 0 - 310051
- tty2 00:00:00 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 2828 2625 0 80 0 - 306781
- tty2 00:00:02 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 3612 1 0 80 0 - 497232
SyS_po tty2 00:00:09 slack
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 3615 3612 0 80 0 - 115362
SyS_pp tty2 00:00:00 slack
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 3646 3612 0 80 0 - 144992
SyS_po tty2 00:00:02 slack
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 3701 3615 0 80 0 - 303569
- tty2 00:00:01 slack
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 3776 2625 2 80 0 - 393635
- tty2 00:00:38 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 3798 2625 0 80 0 - 309618
- tty2 00:00:00 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 3908 3615 0 80 0 - 441636
- tty2 00:00:13 slack
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 1 S 1000 5213 2625 8 80 0 - 325779
- tty2 00:00:46 chrome
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 5326 2146 0 80 0 - 38420
core_s pts/1 00:00:00 vim
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 4 R 1000 5586 2151 0 80 0 - 35760 -
pts/2 00:00:00 ps
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 0 S 1000 5587 2151 0 80 0 - 29882 -
pts/2 00:00:00 grep