1pcp_pmie_selinux(8)         SELinux Policy pcp_pmie        pcp_pmie_selinux(8)
2
3
4

NAME

6       pcp_pmie_selinux - Security Enhanced Linux Policy for the pcp_pmie pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  pcp_pmie  processes  via  flexible
11       mandatory access control.
12
13       The  pcp_pmie  processes  execute with the pcp_pmie_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep pcp_pmie_t
20
21
22

ENTRYPOINTS

24       The pcp_pmie_t SELinux type can be entered via the pcp_pmie_exec_t file
25       type.
26
27       The default entrypoint paths for the pcp_pmie_t domain are the  follow‐
28       ing:
29
30       /usr/bin/pmie, /usr/share/pcp/lib/pmie, /usr/libexec/pcp/bin/pmie
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       pcp_pmie policy is very flexible allowing users to setup their pcp_pmie
40       processes in as secure a method as possible.
41
42       The following process types are defined for pcp_pmie:
43
44       pcp_pmie_t
45
46       Note: semanage permissive -a pcp_pmie_t can be used to make the process
47       type  pcp_pmie_t permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       pcp_pmie policy is extremely flexible and  has  several  booleans  that
55       allow  you  to manipulate the policy and run pcp_pmie with the tightest
56       access possible.
57
58
59
60       If you want to allow users to resolve user passwd entries directly from
61       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
62       gin_nsswitch_use_ldap boolean. Disabled by default.
63
64       setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to allow confined applications to run with kerberos, you
76       must turn on the kerberos_enabled boolean. Disabled by default.
77
78       setsebool -P kerberos_enabled 1
79
80
81
82       If you want to allow system to run with  NIS,  you  must  turn  on  the
83       nis_enabled boolean. Disabled by default.
84
85       setsebool -P nis_enabled 1
86
87
88
89       If  you  want to allow confined applications to use nscd shared memory,
90       you must turn on the nscd_use_shm boolean. Disabled by default.
91
92       setsebool -P nscd_use_shm 1
93
94
95

MANAGED FILES

97       The SELinux process type pcp_pmie_t can manage files labeled  with  the
98       following file types.  The paths listed are the default paths for these
99       file types.  Note the processes UID still need to have DAC permissions.
100
101       cluster_conf_t
102
103            /etc/cluster(/.*)?
104
105       cluster_var_lib_t
106
107            /var/lib/pcsd(/.*)?
108            /var/lib/cluster(/.*)?
109            /var/lib/openais(/.*)?
110            /var/lib/pengine(/.*)?
111            /var/lib/corosync(/.*)?
112            /usr/lib/heartbeat(/.*)?
113            /var/lib/heartbeat(/.*)?
114            /var/lib/pacemaker(/.*)?
115
116       cluster_var_run_t
117
118            /var/run/crm(/.*)?
119            /var/run/cman_.*
120            /var/run/rsctmp(/.*)?
121            /var/run/aisexec.*
122            /var/run/heartbeat(/.*)?
123            /var/run/corosync-qnetd(/.*)?
124            /var/run/corosync-qdevice(/.*)?
125            /var/run/corosync.pid
126            /var/run/cpglockd.pid
127            /var/run/rgmanager.pid
128            /var/run/cluster/rgmanager.sk
129
130       pcp_log_t
131
132            /var/log/pcp(/.*)?
133
134       pcp_tmp_t
135
136
137       pcp_tmpfs_t
138
139
140       pcp_var_lib_t
141
142            /var/lib/pcp(/.*)?
143
144       pcp_var_run_t
145
146            /var/run/pcp(/.*)?
147            /var/run/pmcd.socket
148            /var/run/pmlogger.primary.socket
149
150       root_t
151
152            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
153            /
154            /initrd
155
156       systemd_passwd_var_run_t
157
158            /var/run/systemd/ask-password(/.*)?
159            /var/run/systemd/ask-password-block(/.*)?
160
161

FILE CONTEXTS

163       SELinux requires files to have an extended attribute to define the file
164       type.
165
166       You can see the context of a file using the -Z option to ls
167
168       Policy  governs  the  access  confined  processes  have to these files.
169       SELinux pcp_pmie policy is very flexible allowing users to setup  their
170       pcp_pmie processes in as secure a method as possible.
171
172       The following file types are defined for pcp_pmie:
173
174
175
176       pcp_pmie_exec_t
177
178       - Set files with the pcp_pmie_exec_t type, if you want to transition an
179       executable to the pcp_pmie_t domain.
180
181
182       Paths:
183            /usr/bin/pmie, /usr/share/pcp/lib/pmie, /usr/libexec/pcp/bin/pmie
184
185
186       pcp_pmie_initrc_exec_t
187
188       - Set files with the pcp_pmie_initrc_exec_t type, if you want to  tran‐
189       sition an executable to the pcp_pmie_initrc_t domain.
190
191
192
193       Note:  File context can be temporarily modified with the chcon command.
194       If you want to permanently change the file context you need to use  the
195       semanage fcontext command.  This will modify the SELinux labeling data‐
196       base.  You will need to use restorecon to apply the labels.
197
198

COMMANDS

200       semanage fcontext can also be used to manipulate default  file  context
201       mappings.
202
203       semanage  permissive  can  also  be used to manipulate whether or not a
204       process type is permissive.
205
206       semanage module can also be used to enable/disable/install/remove  pol‐
207       icy modules.
208
209       semanage boolean can also be used to manipulate the booleans
210
211
212       system-config-selinux is a GUI tool available to customize SELinux pol‐
213       icy settings.
214
215

AUTHOR

217       This manual page was auto-generated using sepolicy manpage .
218
219

SEE ALSO

221       selinux(8), pcp_pmie(8), semanage(8), restorecon(8),  chcon(1),  sepol‐
222       icy(8), setsebool(8)
223
224
225
226pcp_pmie                           19-12-02                pcp_pmie_selinux(8)
Impressum