sge_job_selinux(8)

1sge_job_selinux(8)          SELinux Policy sge_job          sge_job_selinux(8)
2
3
4

NAME

6       sge_job_selinux  -  Security Enhanced Linux Policy for the sge_job pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  sge_job  processes  via  flexible
11       mandatory access control.
12
13       The  sge_job processes execute with the sge_job_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep sge_job_t
20
21
22

ENTRYPOINTS

24       The  sge_job_t  SELinux  type  can  be  entered via the sge_job_exec_t,
25       shell_exec_t file types.
26
27       The default entrypoint paths for the sge_job_t domain are  the  follow‐
28       ing:
29
30       /bin/d?ash,  /bin/ksh.*,  /bin/zsh.*,  /usr/bin/d?ash,  /usr/bin/ksh.*,
31       /usr/bin/zsh.*, /bin/esh, /bin/bash, /bin/fish,  /bin/mksh,  /bin/sash,
32       /bin/tcsh,    /bin/yash,   /bin/bash2,   /usr/bin/esh,   /sbin/nologin,
33       /usr/bin/bash,     /usr/bin/fish,     /usr/bin/mksh,     /usr/bin/sash,
34       /usr/bin/tcsh,     /usr/bin/yash,    /usr/bin/bash2,    /usr/sbin/sesh,
35       /usr/sbin/smrsh, /usr/bin/scponly,  /usr/libexec/sesh,  /usr/sbin/nolo‐
36       gin,  /usr/bin/git-shell,  /usr/sbin/scponlyc,  /usr/libexec/sudo/sesh,
37       /usr/bin/cockpit-bridge, /usr/libexec/cockpit-agent,  /usr/libexec/git-
38       core/git-shell
39

PROCESS TYPES

41       SELinux defines process types (domains) for each process running on the
42       system
43
44       You can see the context of a process using the -Z option to ps
45
46       Policy governs the access confined processes have  to  files.   SELinux
47       sge_job  policy  is very flexible allowing users to setup their sge_job
48       processes in as secure a method as possible.
49
50       The following process types are defined for sge_job:
51
52       sge_job_t, sge_job_ssh_t
53
54       Note: semanage permissive -a sge_job_t can be used to make the  process
55       type  sge_job_t  permissive. SELinux does not deny access to permissive
56       process types, but the AVC (SELinux denials) messages are still  gener‐
57       ated.
58
59

BOOLEANS

61       SELinux policy is customizable based on least access required.  sge_job
62       policy is extremely flexible and has several booleans that allow you to
63       manipulate  the  policy and run sge_job with the tightest access possi‐
64       ble.
65
66
67
68       If you want to deny user domains applications to map a memory region as
69       both  executable  and  writable,  this  is dangerous and the executable
70       should be reported in bugzilla, you must turn on the deny_execmem bool‐
71       ean. Enabled by default.
72
73       setsebool -P deny_execmem 1
74
75
76
77       If  you  want  to control the ability to mmap a low area of the address
78       space, as configured by /proc/sys/vm/mmap_min_addr, you  must  turn  on
79       the mmap_low_allowed boolean. Disabled by default.
80
81       setsebool -P mmap_low_allowed 1
82
83
84
85       If  you  want  to  disable  kernel module loading, you must turn on the
86       secure_mode_insmod boolean. Enabled by default.
87
88       setsebool -P secure_mode_insmod 1
89
90
91
92       If you want to allow unconfined executables to make their  heap  memory
93       executable.   Doing  this  is  a  really bad idea. Probably indicates a
94       badly coded executable, but could indicate an attack.  This  executable
95       should   be   reported  in  bugzilla,  you  must  turn  on  the  selin‐
96       uxuser_execheap boolean. Disabled by default.
97
98       setsebool -P selinuxuser_execheap 1
99
100
101
102       If you want to allow unconfined executables to make  their  stack  exe‐
103       cutable.   This  should  never, ever be necessary. Probably indicates a
104       badly coded executable, but could indicate an attack.  This  executable
105       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
106       stack boolean. Disabled by default.
107
108       setsebool -P selinuxuser_execstack 1
109
110
111

MANAGED FILES

113       The SELinux process type sge_job_t can manage files  labeled  with  the
114       following file types.  The paths listed are the default paths for these
115       file types.  Note the processes UID still need to have DAC permissions.
116
117       file_type
118
119            all files on the system
120
121

COMMANDS

123       semanage fcontext can also be used to manipulate default  file  context
124       mappings.
125
126       semanage  permissive  can  also  be used to manipulate whether or not a
127       process type is permissive.
128
129       semanage module can also be used to enable/disable/install/remove  pol‐
130       icy modules.
131
132       semanage boolean can also be used to manipulate the booleans
133
134
135       system-config-selinux is a GUI tool available to customize SELinux pol‐
136       icy settings.
137
138

AUTHOR

140       This manual page was auto-generated using sepolicy manpage .
141
142