logwatch_selinux(8)

1logwatch_selinux(8)         SELinux Policy logwatch        logwatch_selinux(8)
2
3
4

NAME

6       logwatch_selinux - Security Enhanced Linux Policy for the logwatch pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  logwatch  processes  via  flexible
11       mandatory access control.
12
13       The  logwatch  processes  execute with the logwatch_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep logwatch_t
20
21
22

ENTRYPOINTS

24       The logwatch_t SELinux type can be entered via the logwatch_exec_t file
25       type.
26
27       The default entrypoint paths for the logwatch_t domain are the  follow‐
28       ing:
29
30       /usr/sbin/epylog,  /usr/sbin/logcheck, /usr/share/logwatch/scripts/log‐
31       watch.pl
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       logwatch policy is very flexible allowing users to setup their logwatch
41       processes in as secure a method as possible.
42
43       The following process types are defined for logwatch:
44
45       logwatch_t, logwatch_mail_t
46
47       Note: semanage permissive -a logwatch_t can be used to make the process
48       type logwatch_t permissive. SELinux does not deny access to  permissive
49       process  types, but the AVC (SELinux denials) messages are still gener‐
50       ated.
51
52

BOOLEANS

54       SELinux policy is customizable based on least  access  required.   log‐
55       watch  policy is extremely flexible and has several booleans that allow
56       you to manipulate the policy and run logwatch with the tightest  access
57       possible.
58
59
60
61       If you want to allow all domains to use other domains file descriptors,
62       you must turn on the allow_domain_fd_use boolean. Enabled by default.
63
64       setsebool -P allow_domain_fd_use 1
65
66
67
68       If you want to allow confined applications to run  with  kerberos,  you
69       must turn on the allow_kerberos boolean. Enabled by default.
70
71       setsebool -P allow_kerberos 1
72
73
74
75       If  you want to allow sysadm to debug or ptrace all processes, you must
76       turn on the allow_ptrace boolean. Disabled by default.
77
78       setsebool -P allow_ptrace 1
79
80
81
82       If you want to allow system to run with  NIS,  you  must  turn  on  the
83       allow_ypbind boolean. Disabled by default.
84
85       setsebool -P allow_ypbind 1
86
87
88
89       If  you  want to allow all domains to have the kernel load modules, you
90       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
91       default.
92
93       setsebool -P domain_kernel_load_modules 1
94
95
96
97       If you want to allow all domains to execute in fips_mode, you must turn
98       on the fips_mode boolean. Enabled by default.
99
100       setsebool -P fips_mode 1
101
102
103
104       If you want to enable reading of urandom for all domains, you must turn
105       on the global_ssp boolean. Disabled by default.
106
107       setsebool -P global_ssp 1
108
109
110
111       If  you  want to allow confined applications to use nscd shared memory,
112       you must turn on the nscd_use_shm boolean. Enabled by default.
113
114       setsebool -P nscd_use_shm 1
115
116
117
118       If you want to support NFS home  directories,  you  must  turn  on  the
119       use_nfs_home_dirs boolean. Disabled by default.
120
121       setsebool -P use_nfs_home_dirs 1
122
123
124
125       If  you  want  to  support SAMBA home directories, you must turn on the
126       use_samba_home_dirs boolean. Disabled by default.
127
128       setsebool -P use_samba_home_dirs 1
129
130
131

MANAGED FILES

133       The SELinux process type logwatch_t can manage files labeled  with  the
134       following file types.  The paths listed are the default paths for these
135       file types.  Note the processes UID still need to have DAC permissions.
136
137       initrc_tmp_t
138
139
140       logwatch_cache_t
141
142            /var/lib/epylog(/.*)?
143            /var/lib/logcheck(/.*)?
144            /var/cache/logwatch(/.*)?
145
146       logwatch_lock_t
147
148            /var/log/logcheck/.+
149
150       logwatch_tmp_t
151
152
153       logwatch_var_run_t
154
155            /var/run/epylog.pid
156
157       mnt_t
158
159            /mnt(/[^/]*)
160            /mnt(/[^/]*)?
161            /rhev(/[^/]*)?
162            /media(/[^/]*)
163            /media(/[^/]*)?
164            /etc/rhgb(/.*)?
165            /media/.hal-.*
166            /net
167            /afs
168            /rhev
169            /misc
170
171       tmp_t
172
173            /tmp
174            /usr/tmp
175            /var/tmp
176            /tmp-inst
177            /var/tmp-inst
178            /var/tmp/vi.recover
179
180

FILE CONTEXTS

182       SELinux requires files to have an extended attribute to define the file
183       type.
184
185       You can see the context of a file using the -Z option to ls
186
187       Policy  governs  the  access  confined  processes  have to these files.
188       SELinux logwatch policy is very flexible allowing users to setup  their
189       logwatch processes in as secure a method as possible.
190
191       STANDARD FILE CONTEXT
192
193       SELinux  defines the file context types for the logwatch, if you wanted
194       to store files with these types in a diffent paths, you need to execute
195       the  semanage  command  to  sepecify  alternate  labeling  and then use
196       restorecon to put the labels on disk.
197
198       semanage  fcontext  -a  -t   logwatch_var_run_t   '/srv/mylogwatch_con‐
199       tent(/.*)?'
200       restorecon -R -v /srv/mylogwatch_content
201
202       Note:  SELinux  often  uses  regular expressions to specify labels that
203       match multiple files.
204
205       The following file types are defined for logwatch:
206
207
208
209       logwatch_cache_t
210
211       - Set files with the logwatch_cache_t type, if you want  to  store  the
212       files under the /var/cache directory.
213
214
215       Paths:
216            /var/lib/epylog(/.*)?,   /var/lib/logcheck(/.*)?,  /var/cache/log‐
217            watch(/.*)?
218
219
220       logwatch_exec_t
221
222       - Set files with the logwatch_exec_t type, if you want to transition an
223       executable to the logwatch_t domain.
224
225
226       Paths:
227            /usr/sbin/epylog,        /usr/sbin/logcheck,       /usr/share/log‐
228            watch/scripts/logwatch.pl
229
230
231       logwatch_lock_t
232
233       - Set files with the logwatch_lock_t type, if you  want  to  treat  the
234       files as logwatch lock data, stored under the /var/lock directory
235
236
237
238       logwatch_mail_tmp_t
239
240       -  Set  files  with  the logwatch_mail_tmp_t type, if you want to store
241       logwatch mail temporary files in the /tmp directories.
242
243
244
245       logwatch_tmp_t
246
247       - Set files with the logwatch_tmp_t type, if you want to store logwatch
248       temporary files in the /tmp directories.
249
250
251
252       logwatch_var_run_t
253
254       -  Set files with the logwatch_var_run_t type, if you want to store the
255       logwatch files under the /run or /var/run directory.
256
257
258
259       Note: File context can be temporarily modified with the chcon  command.
260       If  you want to permanently change the file context you need to use the
261       semanage fcontext command.  This will modify the SELinux labeling data‐
262       base.  You will need to use restorecon to apply the labels.
263
264

COMMANDS

266       semanage  fcontext  can also be used to manipulate default file context
267       mappings.
268
269       semanage permissive can also be used to manipulate  whether  or  not  a
270       process type is permissive.
271
272       semanage  module can also be used to enable/disable/install/remove pol‐
273       icy modules.
274
275       semanage boolean can also be used to manipulate the booleans
276
277
278       system-config-selinux is a GUI tool available to customize SELinux pol‐
279       icy settings.
280
281

AUTHOR

283       This manual page was auto-generated using sepolicy manpage .
284
285