1collectd_selinux(8) SELinux Policy collectd collectd_selinux(8)
2
6 collectd_selinux - Security Enhanced Linux Policy for the collectd pro‐
7 cesses
8
10 Security-Enhanced Linux secures the collectd processes via flexible
11 mandatory access control.
12 The collectd processes execute with the collectd_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep collectd_t
20
24 The collectd_t SELinux type can be entered via the collectd_exec_t file
25 type.
26 The default entrypoint paths for the collectd_t domain are the follow‐
28 ing:
29 /usr/sbin/collectd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 collectd policy is very flexible allowing users to setup their collectd
40 processes in as secure a method as possible.
41 The following process types are defined for collectd:
43 collectd_t, collectd_script_t
45 Note: semanage permissive -a collectd_t can be used to make the process
47 type collectd_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required. col‐
54 lectd policy is extremely flexible and has several booleans that allow
55 you to manipulate the policy and run collectd with the tightest access
56 possible.
57 If you want to determine whether collectd can connect to the network
61 using TCP, you must turn on the collectd_tcp_network_connect boolean.
62 Disabled by default.
63 setsebool -P collectd_tcp_network_connect 1
65 If you want to allow users to resolve user passwd entries directly from
69 ldap rather then using a sssd server, you must turn on the authlo‐
70 gin_nsswitch_use_ldap boolean. Disabled by default.
71 setsebool -P authlogin_nsswitch_use_ldap 1
73 If you want to allow all domains to execute in fips_mode, you must turn
77 on the fips_mode boolean. Enabled by default.
78 setsebool -P fips_mode 1
80 If you want to allow confined applications to run with kerberos, you
84 must turn on the kerberos_enabled boolean. Enabled by default.
85 setsebool -P kerberos_enabled 1
87 If you want to allow system to run with NIS, you must turn on the
91 nis_enabled boolean. Disabled by default.
92 setsebool -P nis_enabled 1
94 If you want to allow confined applications to use nscd shared memory,
98 you must turn on the nscd_use_shm boolean. Disabled by default.
99 setsebool -P nscd_use_shm 1
101 If you want to support ecryptfs home directories, you must turn on the
105 use_ecryptfs_home_dirs boolean. Disabled by default.
106 setsebool -P use_ecryptfs_home_dirs 1
108
112 SELinux defines port types to represent TCP and UDP ports.
113 You can see the types associated with a port by using the following
115 command:
116 semanage port -l
118 Policy governs the access confined processes have to these ports.
121 SELinux collectd policy is very flexible allowing users to setup their
122 collectd processes in as secure a method as possible.
123 The following port types are defined for collectd:
125 collectd_port_t
128 Default Defined Ports:
132 udp 25826
133
135 The SELinux process type collectd_t can manage files labeled with the
136 following file types. The paths listed are the default paths for these
137 file types. Note the processes UID still need to have DAC permissions.
138 cluster_conf_t
140 /etc/cluster(/.*)?
142 cluster_var_lib_t
144 /var/lib/pcsd(/.*)?
146 /var/lib/cluster(/.*)?
147 /var/lib/openais(/.*)?
148 /var/lib/pengine(/.*)?
149 /var/lib/corosync(/.*)?
150 /usr/lib/heartbeat(/.*)?
151 /var/lib/heartbeat(/.*)?
152 /var/lib/pacemaker(/.*)?
153 cluster_var_run_t
155 /var/run/crm(/.*)?
157 /var/run/cman_.*
158 /var/run/rsctmp(/.*)?
159 /var/run/aisexec.*
160 /var/run/heartbeat(/.*)?
161 /var/run/corosync-qnetd(/.*)?
162 /var/run/corosync-qdevice(/.*)?
163 /var/run/corosync.pid
164 /var/run/cpglockd.pid
165 /var/run/rgmanager.pid
166 /var/run/cluster/rgmanager.sk
167 collectd_log_t
169 /var/log/collectd.json.log
171 collectd_var_lib_t
173 /var/lib/collectd(/.*)?
175 collectd_var_run_t
177 /var/run/collectd(/.*)?
179 /var/run/collectd.pid
180 /var/run/collectd-unixsock
181 ecryptfs_t
183 /home/[^/]+/.Private(/.*)?
185 /home/[^/]+/.ecryptfs(/.*)?
186 root_t
188 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
190 /
191 /initrd
192
195 SELinux requires files to have an extended attribute to define the file
196 type.
197 You can see the context of a file using the -Z option to ls
199 Policy governs the access confined processes have to these files.
201 SELinux collectd policy is very flexible allowing users to setup their
202 collectd processes in as secure a method as possible.
203 EQUIVALENCE DIRECTORIES
205 collectd policy stores data with multiple different file context types
208 under the /var/run/collectd directory. If you would like to store the
209 data in a different directory you can use the semanage command to cre‐
210 ate an equivalence mapping. If you wanted to store this data under the
211 /srv dirctory you would execute the following command:
212 semanage fcontext -a -e /var/run/collectd /srv/collectd
214 restorecon -R -v /srv/collectd
215 STANDARD FILE CONTEXT
217 SELinux defines the file context types for the collectd, if you wanted
219 to store files with these types in a diffent paths, you need to execute
220 the semanage command to sepecify alternate labeling and then use
221 restorecon to put the labels on disk.
222 semanage fcontext -a -t collectd_script_tmp_t '/srv/mycollectd_con‐
224 tent(/.*)?'
225 restorecon -R -v /srv/mycollectd_content
226 Note: SELinux often uses regular expressions to specify labels that
228 match multiple files.
229 The following file types are defined for collectd:
231 collectd_content_t
235 - Set files with the collectd_content_t type, if you want to treat the
237 files as collectd content.
238 collectd_exec_t
242 - Set files with the collectd_exec_t type, if you want to transition an
244 executable to the collectd_t domain.
245 collectd_htaccess_t
249 - Set files with the collectd_htaccess_t type, if you want to treat the
251 file as a collectd access file.
252 collectd_initrc_exec_t
256 - Set files with the collectd_initrc_exec_t type, if you want to tran‐
258 sition an executable to the collectd_initrc_t domain.
259 collectd_log_t
263 - Set files with the collectd_log_t type, if you want to treat the data
265 as collectd log data, usually stored under the /var/log directory.
266 collectd_ra_content_t
270 - Set files with the collectd_ra_content_t type, if you want to treat
272 the files as collectd read/append content.
273 collectd_rw_content_t
277 - Set files with the collectd_rw_content_t type, if you want to treat
279 the files as collectd read/write content.
280 collectd_script_exec_t
284 - Set files with the collectd_script_exec_t type, if you want to tran‐
286 sition an executable to the collectd_script_t domain.
287 collectd_script_tmp_t
291 - Set files with the collectd_script_tmp_t type, if you want to store
293 collectd script temporary files in the /tmp directories.
294 collectd_unit_file_t
298 - Set files with the collectd_unit_file_t type, if you want to treat
300 the files as collectd unit content.
301 collectd_var_lib_t
305 - Set files with the collectd_var_lib_t type, if you want to store the
307 collectd files under the /var/lib directory.
308 collectd_var_run_t
312 - Set files with the collectd_var_run_t type, if you want to store the
314 collectd files under the /run or /var/run directory.
315 Paths:
318 /var/run/collectd(/.*)?, /var/run/collectd.pid, /var/run/collectd-
319 unixsock
320 Note: File context can be temporarily modified with the chcon command.
323 If you want to permanently change the file context you need to use the
324 semanage fcontext command. This will modify the SELinux labeling data‐
325 base. You will need to use restorecon to apply the labels.
326
329 semanage fcontext can also be used to manipulate default file context
330 mappings.
331 semanage permissive can also be used to manipulate whether or not a
333 process type is permissive.
334 semanage module can also be used to enable/disable/install/remove pol‐
336 icy modules.
337 semanage port can also be used to manipulate the port definitions
339 semanage boolean can also be used to manipulate the booleans
341 system-config-selinux is a GUI tool available to customize SELinux pol‐
344 icy settings.
345
348 This manual page was auto-generated using sepolicy manpage .
349
352 selinux(8), collectd(8), semanage(8), restorecon(8), chcon(1), sepol‐
353 icy(8), setsebool(8), collectd_script_selinux(8)
354collectd 19-06-18 collectd_selinux(8)