1glance_registry_selinux(8S)ELinux Policy glance_registrgylance_registry_selinux(8)
2
3
4

NAME

6       glance_registry_selinux  -  Security  Enhanced  Linux  Policy  for  the
7       glance_registry processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the glance_registry processes via flex‐
11       ible mandatory access control.
12
13       The   glance_registry  processes  execute  with  the  glance_registry_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep glance_registry_t
20
21
22

ENTRYPOINTS

24       The  glance_registry_t  SELinux type can be entered via the glance_reg‐
25       istry_exec_t file type.
26
27       The default entrypoint paths for the glance_registry_t domain  are  the
28       following:
29
30       /usr/bin/glance-registry
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       glance_registry  policy  is very flexible allowing users to setup their
40       glance_registry processes in as secure a method as possible.
41
42       The following process types are defined for glance_registry:
43
44       glance_registry_t
45
46       Note: semanage permissive -a glance_registry_t can be used to make  the
47       process type glance_registry_t permissive. SELinux does not deny access
48       to permissive process types, but the AVC (SELinux denials) messages are
49       still generated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       glance_registry policy is extremely flexible and has  several  booleans
55       that  allow  you  to manipulate the policy and run glance_registry with
56       the tightest access possible.
57
58
59
60       If you want to allow users to resolve user passwd entries directly from
61       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
62       gin_nsswitch_use_ldap boolean. Disabled by default.
63
64       setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to allow glance domain to use executable memory and exe‐
76       cutable stack, you must turn on the  glance_use_execmem  boolean.  Dis‐
77       abled by default.
78
79       setsebool -P glance_use_execmem 1
80
81
82
83       If  you  want  to allow confined applications to run with kerberos, you
84       must turn on the kerberos_enabled boolean. Enabled by default.
85
86       setsebool -P kerberos_enabled 1
87
88
89
90       If you want to allow system to run with  NIS,  you  must  turn  on  the
91       nis_enabled boolean. Disabled by default.
92
93       setsebool -P nis_enabled 1
94
95
96
97       If  you  want to allow confined applications to use nscd shared memory,
98       you must turn on the nscd_use_shm boolean. Disabled by default.
99
100       setsebool -P nscd_use_shm 1
101
102
103

PORT TYPES

105       SELinux defines port types to represent TCP and UDP ports.
106
107       You can see the types associated with a port  by  using  the  following
108       command:
109
110       semanage port -l
111
112
113       Policy  governs  the  access  confined  processes  have to these ports.
114       SELinux glance_registry policy is very flexible allowing users to setup
115       their glance_registry processes in as secure a method as possible.
116
117       The following port types are defined for glance_registry:
118
119
120       glance_registry_port_t
121
122
123
124       Default Defined Ports:
125                 tcp 9191
126                 udp 9191
127

MANAGED FILES

129       The  SELinux  process  type  glance_registry_t can manage files labeled
130       with the following file types.  The paths listed are the default  paths
131       for  these  file  types.  Note the processes UID still need to have DAC
132       permissions.
133
134       cluster_conf_t
135
136            /etc/cluster(/.*)?
137
138       cluster_var_lib_t
139
140            /var/lib/pcsd(/.*)?
141            /var/lib/cluster(/.*)?
142            /var/lib/openais(/.*)?
143            /var/lib/pengine(/.*)?
144            /var/lib/corosync(/.*)?
145            /usr/lib/heartbeat(/.*)?
146            /var/lib/heartbeat(/.*)?
147            /var/lib/pacemaker(/.*)?
148
149       cluster_var_run_t
150
151            /var/run/crm(/.*)?
152            /var/run/cman_.*
153            /var/run/rsctmp(/.*)?
154            /var/run/aisexec.*
155            /var/run/heartbeat(/.*)?
156            /var/run/corosync-qnetd(/.*)?
157            /var/run/corosync-qdevice(/.*)?
158            /var/run/corosync.pid
159            /var/run/cpglockd.pid
160            /var/run/rgmanager.pid
161            /var/run/cluster/rgmanager.sk
162
163       fusefs_t
164
165            /var/run/user/[^/]*/gvfs
166
167       glance_registry_tmp_t
168
169
170       glance_registry_tmpfs_t
171
172
173       glance_var_lib_t
174
175            /var/lib/glance(/.*)?
176
177       glance_var_run_t
178
179            /var/run/glance(/.*)?
180
181       root_t
182
183            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
184            /
185            /initrd
186
187

FILE CONTEXTS

189       SELinux requires files to have an extended attribute to define the file
190       type.
191
192       You can see the context of a file using the -Z option to ls
193
194       Policy  governs  the  access  confined  processes  have to these files.
195       SELinux glance_registry policy is very flexible allowing users to setup
196       their glance_registry processes in as secure a method as possible.
197
198       STANDARD FILE CONTEXT
199
200       SELinux  defines the file context types for the glance_registry, if you
201       wanted to store files with these types in a diffent paths, you need  to
202       execute  the  semanage  command to sepecify alternate labeling and then
203       use restorecon to put the labels on disk.
204
205       semanage fcontext  -a  -t  glance_registry_tmpfs_t  '/srv/myglance_reg‐
206       istry_content(/.*)?'
207       restorecon -R -v /srv/myglance_registry_content
208
209       Note:  SELinux  often  uses  regular expressions to specify labels that
210       match multiple files.
211
212       The following file types are defined for glance_registry:
213
214
215
216       glance_registry_exec_t
217
218       - Set files with the glance_registry_exec_t type, if you want to  tran‐
219       sition an executable to the glance_registry_t domain.
220
221
222
223       glance_registry_initrc_exec_t
224
225       - Set files with the glance_registry_initrc_exec_t type, if you want to
226       transition an executable to the glance_registry_initrc_t domain.
227
228
229
230       glance_registry_tmp_t
231
232       - Set files with the glance_registry_tmp_t type, if you want  to  store
233       glance registry temporary files in the /tmp directories.
234
235
236
237       glance_registry_tmpfs_t
238
239       - Set files with the glance_registry_tmpfs_t type, if you want to store
240       glance registry files on a tmpfs file system.
241
242
243
244       glance_registry_unit_file_t
245
246       - Set files with the glance_registry_unit_file_t type, if you  want  to
247       treat the files as glance registry unit content.
248
249
250
251       Note:  File context can be temporarily modified with the chcon command.
252       If you want to permanently change the file context you need to use  the
253       semanage fcontext command.  This will modify the SELinux labeling data‐
254       base.  You will need to use restorecon to apply the labels.
255
256

COMMANDS

258       semanage fcontext can also be used to manipulate default  file  context
259       mappings.
260
261       semanage  permissive  can  also  be used to manipulate whether or not a
262       process type is permissive.
263
264       semanage module can also be used to enable/disable/install/remove  pol‐
265       icy modules.
266
267       semanage port can also be used to manipulate the port definitions
268
269       semanage boolean can also be used to manipulate the booleans
270
271
272       system-config-selinux is a GUI tool available to customize SELinux pol‐
273       icy settings.
274
275

AUTHOR

277       This manual page was auto-generated using sepolicy manpage .
278
279

SEE ALSO

281       selinux(8), glance_registry(8), semanage(8),  restorecon(8),  chcon(1),
282       sepolicy(8), setsebool(8)
283
284
285
286glance_registry                    19-05-30         glance_registry_selinux(8)
Impressum