1pegasus_openlmi_admin_SsEeLliinnuuxx(P8o)licy pegasus_opepnelgmais_uasd_moipnenlmi_admin_selinux(8)
2
6 pegasus_openlmi_admin_selinux - Security Enhanced Linux Policy for the
7 pegasus_openlmi_admin processes
8
10 Security-Enhanced Linux secures the pegasus_openlmi_admin processes via
11 flexible mandatory access control.
12 The pegasus_openlmi_admin processes execute with the pega‐
14 sus_openlmi_admin_t SELinux type. You can check if you have these pro‐
15 cesses running by executing the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep pegasus_openlmi_admin_t
20
24 The pegasus_openlmi_admin_t SELinux type can be entered via the pega‐
25 sus_openlmi_admin_exec_t file type.
26 The default entrypoint paths for the pegasus_openlmi_admin_t domain are
28 the following:
29 /usr/libexec/pegasus/cmpiLMI_Service-cimprovagt, /usr/libexec/pega‐
31 sus/cmpiLMI_Journald-cimprovagt
32
34 SELinux defines process types (domains) for each process running on the
35 system
36 You can see the context of a process using the -Z option to ps
38 Policy governs the access confined processes have to files. SELinux
40 pegasus_openlmi_admin policy is very flexible allowing users to setup
41 their pegasus_openlmi_admin processes in as secure a method as possi‐
42 ble.
43 The following process types are defined for pegasus_openlmi_admin:
45 pegasus_openlmi_admin_t
47 Note: semanage permissive -a pegasus_openlmi_admin_t can be used to
49 make the process type pegasus_openlmi_admin_t permissive. SELinux does
50 not deny access to permissive process types, but the AVC (SELinux
51 denials) messages are still generated.
52
55 SELinux policy is customizable based on least access required. pega‐
56 sus_openlmi_admin policy is extremely flexible and has several booleans
57 that allow you to manipulate the policy and run pegasus_openlmi_admin
58 with the tightest access possible.
59 If you want to allow all daemons to write corefiles to /, you must turn
63 on the daemons_dump_core boolean. Disabled by default.
64 setsebool -P daemons_dump_core 1
66 If you want to enable cluster mode for daemons, you must turn on the
70 daemons_enable_cluster_mode boolean. Enabled by default.
71 setsebool -P daemons_enable_cluster_mode 1
73 If you want to allow all daemons to use tcp wrappers, you must turn on
77 the daemons_use_tcp_wrapper boolean. Disabled by default.
78 setsebool -P daemons_use_tcp_wrapper 1
80 If you want to allow all daemons the ability to read/write terminals,
84 you must turn on the daemons_use_tty boolean. Disabled by default.
85 setsebool -P daemons_use_tty 1
87 If you want to deny any process from ptracing or debugging any other
91 processes, you must turn on the deny_ptrace boolean. Enabled by
92 default.
93 setsebool -P deny_ptrace 1
95 If you want to allow any process to mmap any file on system with
99 attribute file_type, you must turn on the domain_can_mmap_files bool‐
100 ean. Enabled by default.
101 setsebool -P domain_can_mmap_files 1
103 If you want to allow all domains write to kmsg_device, while kernel is
107 executed with systemd.log_target=kmsg parameter, you must turn on the
108 domain_can_write_kmsg boolean. Disabled by default.
109 setsebool -P domain_can_write_kmsg 1
111 If you want to allow all domains to use other domains file descriptors,
115 you must turn on the domain_fd_use boolean. Enabled by default.
116 setsebool -P domain_fd_use 1
118 If you want to allow all domains to have the kernel load modules, you
122 must turn on the domain_kernel_load_modules boolean. Disabled by
123 default.
124 setsebool -P domain_kernel_load_modules 1
126 If you want to allow all domains to execute in fips_mode, you must turn
130 on the fips_mode boolean. Enabled by default.
131 setsebool -P fips_mode 1
133 If you want to enable reading of urandom for all domains, you must turn
137 on the global_ssp boolean. Disabled by default.
138 setsebool -P global_ssp 1
140
144 The SELinux process type pegasus_openlmi_admin_t can manage files
145 labeled with the following file types. The paths listed are the
146 default paths for these file types. Note the processes UID still need
147 to have DAC permissions.
148 cluster_conf_t
150 /etc/cluster(/.*)?
152 cluster_var_lib_t
154 /var/lib/pcsd(/.*)?
156 /var/lib/cluster(/.*)?
157 /var/lib/openais(/.*)?
158 /var/lib/pengine(/.*)?
159 /var/lib/corosync(/.*)?
160 /usr/lib/heartbeat(/.*)?
161 /var/lib/heartbeat(/.*)?
162 /var/lib/pacemaker(/.*)?
163 cluster_var_run_t
165 /var/run/crm(/.*)?
167 /var/run/cman_.*
168 /var/run/rsctmp(/.*)?
169 /var/run/aisexec.*
170 /var/run/heartbeat(/.*)?
171 /var/run/corosync-qnetd(/.*)?
172 /var/run/corosync-qdevice(/.*)?
173 /var/run/cpglockd.pid
174 /var/run/corosync.pid
175 /var/run/rgmanager.pid
176 /var/run/cluster/rgmanager.sk
177 pegasus_data_t
179 /var/lib/Pegasus(/.*)?
181 /etc/Pegasus/pegasus_current.conf
182 /etc/Pegasus/cimserver_current.conf
183 root_t
185 /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
187 /
188 /initrd
189 systemd_passwd_var_run_t
191 /var/run/systemd/ask-password(/.*)?
193 /var/run/systemd/ask-password-block(/.*)?
194 systemd_unit_file_type
196
200 SELinux requires files to have an extended attribute to define the file
201 type.
202 You can see the context of a file using the -Z option to ls
204 Policy governs the access confined processes have to these files.
206 SELinux pegasus_openlmi_admin policy is very flexible allowing users to
207 setup their pegasus_openlmi_admin processes in as secure a method as
208 possible.
209 The following file types are defined for pegasus_openlmi_admin:
211 pegasus_openlmi_admin_exec_t
215 - Set files with the pegasus_openlmi_admin_exec_t type, if you want to
217 transition an executable to the pegasus_openlmi_admin_t domain.
218 Paths:
221 /usr/libexec/pegasus/cmpiLMI_Service-cimprovagt,
222 /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
223 Note: File context can be temporarily modified with the chcon command.
226 If you want to permanently change the file context you need to use the
227 semanage fcontext command. This will modify the SELinux labeling data‐
228 base. You will need to use restorecon to apply the labels.
229
232 semanage fcontext can also be used to manipulate default file context
233 mappings.
234 semanage permissive can also be used to manipulate whether or not a
236 process type is permissive.
237 semanage module can also be used to enable/disable/install/remove pol‐
239 icy modules.
240 semanage boolean can also be used to manipulate the booleans
242 system-config-selinux is a GUI tool available to customize SELinux pol‐
245 icy settings.
246
249 This manual page was auto-generated using sepolicy manpage .
250
253 selinux(8), pegasus_openlmi_admin(8), semanage(8), restorecon(8),
254 chcon(1), sepolicy(8) , setsebool(8)
255pegasus_openlmi_admin 19-04-25 pegasus_openlmi_admin_selinux(8)