1piranha_lvs_selinux(8) SELinux Policy piranha_lvs piranha_lvs_selinux(8)
2
6 piranha_lvs_selinux - Security Enhanced Linux Policy for the
7 piranha_lvs processes
8
10 Security-Enhanced Linux secures the piranha_lvs processes via flexible
11 mandatory access control.
12 The piranha_lvs processes execute with the piranha_lvs_t SELinux type.
14 You can check if you have these processes running by executing the ps
15 command with the -Z qualifier.
16 For example:
18 ps -eZ | grep piranha_lvs_t
20
24 The piranha_lvs_t SELinux type can be entered via the
25 piranha_lvs_exec_t file type.
26 The default entrypoint paths for the piranha_lvs_t domain are the fol‐
28 lowing:
29 /usr/sbin/lvsd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 piranha_lvs policy is very flexible allowing users to setup their
40 piranha_lvs processes in as secure a method as possible.
41 The following process types are defined for piranha_lvs:
43 piranha_lvs_t
45 Note: semanage permissive -a piranha_lvs_t can be used to make the
47 process type piranha_lvs_t permissive. SELinux does not deny access to
48 permissive process types, but the AVC (SELinux denials) messages are
49 still generated.
50
53 SELinux policy is customizable based on least access required.
54 piranha_lvs policy is extremely flexible and has several booleans that
55 allow you to manipulate the policy and run piranha_lvs with the tight‐
56 est access possible.
57 If you want to allow piranha-lvs domain to connect to the network using
61 TCP, you must turn on the piranha_lvs_can_network_connect boolean. Dis‐
62 abled by default.
63 setsebool -P piranha_lvs_can_network_connect 1
65 If you want to allow users to resolve user passwd entries directly from
69 ldap rather then using a sssd server, you must turn on the authlo‐
70 gin_nsswitch_use_ldap boolean. Disabled by default.
71 setsebool -P authlogin_nsswitch_use_ldap 1
73 If you want to allow all daemons to write corefiles to /, you must turn
77 on the daemons_dump_core boolean. Disabled by default.
78 setsebool -P daemons_dump_core 1
80 If you want to enable cluster mode for daemons, you must turn on the
84 daemons_enable_cluster_mode boolean. Enabled by default.
85 setsebool -P daemons_enable_cluster_mode 1
87 If you want to allow all daemons to use tcp wrappers, you must turn on
91 the daemons_use_tcp_wrapper boolean. Disabled by default.
92 setsebool -P daemons_use_tcp_wrapper 1
94 If you want to allow all daemons the ability to read/write terminals,
98 you must turn on the daemons_use_tty boolean. Disabled by default.
99 setsebool -P daemons_use_tty 1
101 If you want to deny any process from ptracing or debugging any other
105 processes, you must turn on the deny_ptrace boolean. Enabled by
106 default.
107 setsebool -P deny_ptrace 1
109 If you want to allow any process to mmap any file on system with
113 attribute file_type, you must turn on the domain_can_mmap_files bool‐
114 ean. Enabled by default.
115 setsebool -P domain_can_mmap_files 1
117 If you want to allow all domains write to kmsg_device, while kernel is
121 executed with systemd.log_target=kmsg parameter, you must turn on the
122 domain_can_write_kmsg boolean. Disabled by default.
123 setsebool -P domain_can_write_kmsg 1
125 If you want to allow all domains to use other domains file descriptors,
129 you must turn on the domain_fd_use boolean. Enabled by default.
130 setsebool -P domain_fd_use 1
132 If you want to allow all domains to have the kernel load modules, you
136 must turn on the domain_kernel_load_modules boolean. Disabled by
137 default.
138 setsebool -P domain_kernel_load_modules 1
140 If you want to allow all domains to execute in fips_mode, you must turn
144 on the fips_mode boolean. Enabled by default.
145 setsebool -P fips_mode 1
147 If you want to enable reading of urandom for all domains, you must turn
151 on the global_ssp boolean. Disabled by default.
152 setsebool -P global_ssp 1
154 If you want to allow confined applications to run with kerberos, you
158 must turn on the kerberos_enabled boolean. Enabled by default.
159 setsebool -P kerberos_enabled 1
161 If you want to allow system to run with NIS, you must turn on the
165 nis_enabled boolean. Disabled by default.
166 setsebool -P nis_enabled 1
168 If you want to allow confined applications to use nscd shared memory,
172 you must turn on the nscd_use_shm boolean. Disabled by default.
173 setsebool -P nscd_use_shm 1
175
179 The SELinux process type piranha_lvs_t can manage files labeled with
180 the following file types. The paths listed are the default paths for
181 these file types. Note the processes UID still need to have DAC per‐
182 missions.
183 cluster_conf_t
185 /etc/cluster(/.*)?
187 cluster_var_lib_t
189 /var/lib/pcsd(/.*)?
191 /var/lib/cluster(/.*)?
192 /var/lib/openais(/.*)?
193 /var/lib/pengine(/.*)?
194 /var/lib/corosync(/.*)?
195 /usr/lib/heartbeat(/.*)?
196 /var/lib/heartbeat(/.*)?
197 /var/lib/pacemaker(/.*)?
198 cluster_var_run_t
200 /var/run/crm(/.*)?
202 /var/run/cman_.*
203 /var/run/rsctmp(/.*)?
204 /var/run/aisexec.*
205 /var/run/heartbeat(/.*)?
206 /var/run/corosync-qnetd(/.*)?
207 /var/run/corosync-qdevice(/.*)?
208 /var/run/cpglockd.pid
209 /var/run/corosync.pid
210 /var/run/rgmanager.pid
211 /var/run/cluster/rgmanager.sk
212 piranha_lvs_tmpfs_t
214 piranha_lvs_var_run_t
217 /var/run/lvs.pid
219 piranha_pulse_tmpfs_t
221 root_t
224 /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
226 /
227 /initrd
228
231 SELinux requires files to have an extended attribute to define the file
232 type.
233 You can see the context of a file using the -Z option to ls
235 Policy governs the access confined processes have to these files.
237 SELinux piranha_lvs policy is very flexible allowing users to setup
238 their piranha_lvs processes in as secure a method as possible.
239 STANDARD FILE CONTEXT
241 SELinux defines the file context types for the piranha_lvs, if you
243 wanted to store files with these types in a diffent paths, you need to
244 execute the semanage command to sepecify alternate labeling and then
245 use restorecon to put the labels on disk.
246 semanage fcontext -a -t piranha_lvs_var_run_t '/srv/mypiranha_lvs_con‐
248 tent(/.*)?'
249 restorecon -R -v /srv/mypiranha_lvs_content
250 Note: SELinux often uses regular expressions to specify labels that
252 match multiple files.
253 The following file types are defined for piranha_lvs:
255 piranha_lvs_exec_t
259 - Set files with the piranha_lvs_exec_t type, if you want to transition
261 an executable to the piranha_lvs_t domain.
262 piranha_lvs_tmpfs_t
266 - Set files with the piranha_lvs_tmpfs_t type, if you want to store
268 piranha lvs files on a tmpfs file system.
269 piranha_lvs_var_run_t
273 - Set files with the piranha_lvs_var_run_t type, if you want to store
275 the piranha lvs files under the /run or /var/run directory.
276 Note: File context can be temporarily modified with the chcon command.
280 If you want to permanently change the file context you need to use the
281 semanage fcontext command. This will modify the SELinux labeling data‐
282 base. You will need to use restorecon to apply the labels.
283
286 semanage fcontext can also be used to manipulate default file context
287 mappings.
288 semanage permissive can also be used to manipulate whether or not a
290 process type is permissive.
291 semanage module can also be used to enable/disable/install/remove pol‐
293 icy modules.
294 semanage boolean can also be used to manipulate the booleans
296 system-config-selinux is a GUI tool available to customize SELinux pol‐
299 icy settings.
300
303 This manual page was auto-generated using sepolicy manpage .
304
307 selinux(8), piranha_lvs(8), semanage(8), restorecon(8), chcon(1),
308 sepolicy(8) , setsebool(8)
309piranha_lvs 19-04-25 piranha_lvs_selinux(8)