1cardmgr_selinux(8) SELinux Policy cardmgr cardmgr_selinux(8)
2
3
4
6 cardmgr_selinux - Security Enhanced Linux Policy for the cardmgr pro‐
7 cesses
8
10 Security-Enhanced Linux secures the cardmgr processes via flexible
11 mandatory access control.
12
13 The cardmgr processes execute with the cardmgr_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep cardmgr_t
20
21
22
24 The cardmgr_t SELinux type can be entered via the cardmgr_exec_t, card‐
25 ctl_exec_t file types.
26
27 The default entrypoint paths for the cardmgr_t domain are the follow‐
28 ing:
29
30 /sbin/cardmgr, /usr/sbin/cardmgr, /etc/apm/event.d/pcmcia, /sbin/card‐
31 ctl, /usr/sbin/cardctl
32
34 SELinux defines process types (domains) for each process running on the
35 system
36
37 You can see the context of a process using the -Z option to ps
38
39 Policy governs the access confined processes have to files. SELinux
40 cardmgr policy is very flexible allowing users to setup their cardmgr
41 processes in as secure a method as possible.
42
43 The following process types are defined for cardmgr:
44
45 cardmgr_t
46
47 Note: semanage permissive -a cardmgr_t can be used to make the process
48 type cardmgr_t permissive. SELinux does not deny access to permissive
49 process types, but the AVC (SELinux denials) messages are still gener‐
50 ated.
51
52
54 SELinux policy is customizable based on least access required. cardmgr
55 policy is extremely flexible and has several booleans that allow you to
56 manipulate the policy and run cardmgr with the tightest access possi‐
57 ble.
58
59
60
61 If you want to allow all daemons to write corefiles to /, you must turn
62 on the daemons_dump_core boolean. Disabled by default.
63
64 setsebool -P daemons_dump_core 1
65
66
67
68 If you want to enable cluster mode for daemons, you must turn on the
69 daemons_enable_cluster_mode boolean. Enabled by default.
70
71 setsebool -P daemons_enable_cluster_mode 1
72
73
74
75 If you want to allow all daemons to use tcp wrappers, you must turn on
76 the daemons_use_tcp_wrapper boolean. Disabled by default.
77
78 setsebool -P daemons_use_tcp_wrapper 1
79
80
81
82 If you want to allow all daemons the ability to read/write terminals,
83 you must turn on the daemons_use_tty boolean. Disabled by default.
84
85 setsebool -P daemons_use_tty 1
86
87
88
89 If you want to deny any process from ptracing or debugging any other
90 processes, you must turn on the deny_ptrace boolean. Enabled by
91 default.
92
93 setsebool -P deny_ptrace 1
94
95
96
97 If you want to allow any process to mmap any file on system with
98 attribute file_type, you must turn on the domain_can_mmap_files bool‐
99 ean. Enabled by default.
100
101 setsebool -P domain_can_mmap_files 1
102
103
104
105 If you want to allow all domains write to kmsg_device, while kernel is
106 executed with systemd.log_target=kmsg parameter, you must turn on the
107 domain_can_write_kmsg boolean. Disabled by default.
108
109 setsebool -P domain_can_write_kmsg 1
110
111
112
113 If you want to allow all domains to use other domains file descriptors,
114 you must turn on the domain_fd_use boolean. Enabled by default.
115
116 setsebool -P domain_fd_use 1
117
118
119
120 If you want to allow all domains to have the kernel load modules, you
121 must turn on the domain_kernel_load_modules boolean. Disabled by
122 default.
123
124 setsebool -P domain_kernel_load_modules 1
125
126
127
128 If you want to allow all domains to execute in fips_mode, you must turn
129 on the fips_mode boolean. Enabled by default.
130
131 setsebool -P fips_mode 1
132
133
134
135 If you want to enable reading of urandom for all domains, you must turn
136 on the global_ssp boolean. Disabled by default.
137
138 setsebool -P global_ssp 1
139
140
141
143 The SELinux process type cardmgr_t can manage files labeled with the
144 following file types. The paths listed are the default paths for these
145 file types. Note the processes UID still need to have DAC permissions.
146
147 cardmgr_var_lib_t
148
149
150 cardmgr_var_run_t
151
152 /var/lib/pcmcia(/.*)?
153 /var/run/stab
154 /var/run/cardmgr.pid
155
156 cluster_conf_t
157
158 /etc/cluster(/.*)?
159
160 cluster_var_lib_t
161
162 /var/lib/pcsd(/.*)?
163 /var/lib/cluster(/.*)?
164 /var/lib/openais(/.*)?
165 /var/lib/pengine(/.*)?
166 /var/lib/corosync(/.*)?
167 /usr/lib/heartbeat(/.*)?
168 /var/lib/heartbeat(/.*)?
169 /var/lib/pacemaker(/.*)?
170
171 cluster_var_run_t
172
173 /var/run/crm(/.*)?
174 /var/run/cman_.*
175 /var/run/rsctmp(/.*)?
176 /var/run/aisexec.*
177 /var/run/heartbeat(/.*)?
178 /var/run/corosync-qnetd(/.*)?
179 /var/run/corosync-qdevice(/.*)?
180 /var/run/cpglockd.pid
181 /var/run/corosync.pid
182 /var/run/rgmanager.pid
183 /var/run/cluster/rgmanager.sk
184
185 net_conf_t
186
187 /etc/hosts[^/]*
188 /etc/yp.conf.*
189 /etc/denyhosts.*
190 /etc/hosts.deny.*
191 /etc/resolv.conf.*
192 /etc/.resolv.conf.*
193 /etc/resolv-secure.conf.*
194 /var/run/systemd/network(/.*)?
195 /etc/sysconfig/networking(/.*)?
196 /etc/sysconfig/network-scripts(/.*)?
197 /etc/sysconfig/network-scripts/.*resolv.conf
198 /var/run/NetworkManager/resolv.conf.*
199 /etc/ethers
200 /etc/ntp.conf
201 /var/run/systemd/resolve/resolv.conf
202
203 root_t
204
205 /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
206 /
207 /initrd
208
209
211 SELinux requires files to have an extended attribute to define the file
212 type.
213
214 You can see the context of a file using the -Z option to ls
215
216 Policy governs the access confined processes have to these files.
217 SELinux cardmgr policy is very flexible allowing users to setup their
218 cardmgr processes in as secure a method as possible.
219
220 STANDARD FILE CONTEXT
221
222 SELinux defines the file context types for the cardmgr, if you wanted
223 to store files with these types in a diffent paths, you need to execute
224 the semanage command to sepecify alternate labeling and then use
225 restorecon to put the labels on disk.
226
227 semanage fcontext -a -t cardmgr_var_run_t '/srv/mycardmgr_con‐
228 tent(/.*)?'
229 restorecon -R -v /srv/mycardmgr_content
230
231 Note: SELinux often uses regular expressions to specify labels that
232 match multiple files.
233
234 The following file types are defined for cardmgr:
235
236
237
238 cardmgr_dev_t
239
240 - Set files with the cardmgr_dev_t type, if you want to treat the files
241 as cardmgr dev data.
242
243
244
245 cardmgr_exec_t
246
247 - Set files with the cardmgr_exec_t type, if you want to transition an
248 executable to the cardmgr_t domain.
249
250
251 Paths:
252 /sbin/cardmgr, /usr/sbin/cardmgr, /etc/apm/event.d/pcmcia
253
254
255 cardmgr_lnk_t
256
257 - Set files with the cardmgr_lnk_t type, if you want to treat the files
258 as cardmgr lnk data.
259
260
261
262 cardmgr_var_lib_t
263
264 - Set files with the cardmgr_var_lib_t type, if you want to store the
265 cardmgr files under the /var/lib directory.
266
267
268
269 cardmgr_var_run_t
270
271 - Set files with the cardmgr_var_run_t type, if you want to store the
272 cardmgr files under the /run or /var/run directory.
273
274
275 Paths:
276 /var/lib/pcmcia(/.*)?, /var/run/stab, /var/run/cardmgr.pid
277
278
279 Note: File context can be temporarily modified with the chcon command.
280 If you want to permanently change the file context you need to use the
281 semanage fcontext command. This will modify the SELinux labeling data‐
282 base. You will need to use restorecon to apply the labels.
283
284
286 semanage fcontext can also be used to manipulate default file context
287 mappings.
288
289 semanage permissive can also be used to manipulate whether or not a
290 process type is permissive.
291
292 semanage module can also be used to enable/disable/install/remove pol‐
293 icy modules.
294
295 semanage boolean can also be used to manipulate the booleans
296
297
298 system-config-selinux is a GUI tool available to customize SELinux pol‐
299 icy settings.
300
301
303 This manual page was auto-generated using sepolicy manpage .
304
305
307 selinux(8), cardmgr(8), semanage(8), restorecon(8), chcon(1), sepol‐
308 icy(8) , setsebool(8)
309
310
311
312cardmgr 19-04-25 cardmgr_selinux(8)