1fenced_selinux(8) SELinux Policy fenced fenced_selinux(8)
2
6 fenced_selinux - Security Enhanced Linux Policy for the fenced pro‐
7 cesses
8
10 Security-Enhanced Linux secures the fenced processes via flexible
11 mandatory access control.
12 The fenced processes execute with the fenced_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep fenced_t
20
24 The fenced_t SELinux type can be entered via the fenced_exec_t file
25 type.
26 The default entrypoint paths for the fenced_t domain are the following:
28 /usr/sbin/fenced, /usr/sbin/fence_node, /usr/sbin/fence_tool,
30 /usr/sbin/fence_virtd, /usr/sbin/fence_sanlockd, /usr/share/clus‐
31 ter/fence_scsi_check, /usr/share/cluster/fence_mpath_check,
32 /usr/share/cluster/fence_scsi_check.pl, /usr/lib/systemd/systemd-
33 fence_sanlockd, /usr/share/cluster/fence_scsi_check_hardreboot,
34 /usr/share/cluster/fence_mpath_check_hardreboot
35
37 SELinux defines process types (domains) for each process running on the
38 system
39 You can see the context of a process using the -Z option to ps
41 Policy governs the access confined processes have to files. SELinux
43 fenced policy is very flexible allowing users to setup their fenced
44 processes in as secure a method as possible.
45 The following process types are defined for fenced:
47 fenced_t
49 Note: semanage permissive -a fenced_t can be used to make the process
51 type fenced_t permissive. SELinux does not deny access to permissive
52 process types, but the AVC (SELinux denials) messages are still gener‐
53 ated.
54
57 SELinux policy is customizable based on least access required. fenced
58 policy is extremely flexible and has several booleans that allow you to
59 manipulate the policy and run fenced with the tightest access possible.
60 If you want to determine whether fenced can connect to the TCP network,
64 you must turn on the fenced_can_network_connect boolean. Disabled by
65 default.
66 setsebool -P fenced_can_network_connect 1
68 If you want to determine whether fenced can use ssh, you must turn on
72 the fenced_can_ssh boolean. Disabled by default.
73 setsebool -P fenced_can_ssh 1
75 If you want to allow cluster administrative cluster domains memcheck-
79 amd64- to use executable memory, you must turn on the cluster_use_ex‐
80 ecmem boolean. Disabled by default.
81 setsebool -P cluster_use_execmem 1
83 If you want to dontaudit all daemons scheduling requests (setsched,
87 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
88 Enabled by default.
89 setsebool -P daemons_dontaudit_scheduling 1
91 If you want to allow all domains to execute in fips_mode, you must turn
95 on the fips_mode boolean. Enabled by default.
96 setsebool -P fips_mode 1
98 If you want to allow system to run with NIS, you must turn on the
102 nis_enabled boolean. Disabled by default.
103 setsebool -P nis_enabled 1
105
109 The SELinux process type fenced_t can manage files labeled with the
110 following file types. The paths listed are the default paths for these
111 file types. Note the processes UID still need to have DAC permissions.
112 cluster_conf_t
114 /etc/cluster(/.*)?
116 cluster_log
118 cluster_tmpfs_t
121 cluster_var_lib_t
124 /var/lib/pcsd(/.*)?
126 /var/lib/cluster(/.*)?
127 /var/lib/openais(/.*)?
128 /var/lib/pengine(/.*)?
129 /var/lib/corosync(/.*)?
130 /usr/lib/heartbeat(/.*)?
131 /var/lib/heartbeat(/.*)?
132 /var/lib/pacemaker(/.*)?
133 cluster_var_run_t
135 /var/run/crm(/.*)?
137 /var/run/cman_.*
138 /var/run/rsctmp(/.*)?
139 /var/run/aisexec.*
140 /var/run/heartbeat(/.*)?
141 /var/run/pcsd-ruby.socket
142 /var/run/corosync-qnetd(/.*)?
143 /var/run/corosync-qdevice(/.*)?
144 /var/run/corosync.pid
145 /var/run/cpglockd.pid
146 /var/run/rgmanager.pid
147 /var/run/cluster/rgmanager.sk
148 fenced_lock_t
150 /var/lock/fence_manual.lock
152 fenced_tmp_t
154 fenced_tmpfs_t
157 fenced_var_run_t
160 /var/run/fence.*
162 /var/run/cluster/fence_scsi.*
163 /var/run/cluster/mpath.devices
164 /var/run/cluster/fenced_override
165 krb5_host_rcache_t
167 /var/tmp/krb5_0.rcache2
169 /var/cache/krb5rcache(/.*)?
170 /var/tmp/nfs_0
171 /var/tmp/DNS_25
172 /var/tmp/host_0
173 /var/tmp/imap_0
174 /var/tmp/HTTP_23
175 /var/tmp/HTTP_48
176 /var/tmp/ldap_55
177 /var/tmp/ldap_487
178 /var/tmp/ldapmap1_0
179 root_t
181 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
183 /
184 /initrd
185 snmpd_var_lib_t
187 /var/agentx(/.*)?
189 /var/net-snmp(/.*)
190 /var/lib/snmp(/.*)?
191 /var/net-snmp(/.*)?
192 /var/lib/net-snmp(/.*)?
193 /var/spool/snmptt(/.*)?
194 /usr/share/snmp/mibs/.index
195
198 SELinux requires files to have an extended attribute to define the file
199 type.
200 You can see the context of a file using the -Z option to ls
202 Policy governs the access confined processes have to these files.
204 SELinux fenced policy is very flexible allowing users to setup their
205 fenced processes in as secure a method as possible.
206 STANDARD FILE CONTEXT
208 SELinux defines the file context types for the fenced, if you wanted to
210 store files with these types in a different paths, you need to execute
211 the semanage command to specify alternate labeling and then use re‐
212 storecon to put the labels on disk.
213 semanage fcontext -a -t fenced_exec_t '/srv/fenced/content(/.*)?'
215 restorecon -R -v /srv/myfenced_content
216 Note: SELinux often uses regular expressions to specify labels that
218 match multiple files.
219 The following file types are defined for fenced:
221 fenced_exec_t
225 - Set files with the fenced_exec_t type, if you want to transition an
227 executable to the fenced_t domain.
228 Paths:
231 /usr/sbin/fenced, /usr/sbin/fence_node, /usr/sbin/fence_tool,
232 /usr/sbin/fence_virtd, /usr/sbin/fence_sanlockd, /usr/share/clus‐
233 ter/fence_scsi_check, /usr/share/cluster/fence_mpath_check,
234 /usr/share/cluster/fence_scsi_check.pl, /usr/lib/systemd/systemd-
235 fence_sanlockd, /usr/share/cluster/fence_scsi_check_hardreboot,
236 /usr/share/cluster/fence_mpath_check_hardreboot
237 fenced_lock_t
240 - Set files with the fenced_lock_t type, if you want to treat the files
242 as fenced lock data, stored under the /var/lock directory
243 fenced_tmp_t
247 - Set files with the fenced_tmp_t type, if you want to store fenced
249 temporary files in the /tmp directories.
250 fenced_tmpfs_t
254 - Set files with the fenced_tmpfs_t type, if you want to store fenced
256 files on a tmpfs file system.
257 fenced_var_log_t
261 - Set files with the fenced_var_log_t type, if you want to treat the
263 data as fenced var log data, usually stored under the /var/log direc‐
264 tory.
265 fenced_var_run_t
269 - Set files with the fenced_var_run_t type, if you want to store the
271 fenced files under the /run or /var/run directory.
272 Paths:
275 /var/run/fence.*, /var/run/cluster/fence_scsi.*, /var/run/clus‐
276 ter/mpath.devices, /var/run/cluster/fenced_override
277 Note: File context can be temporarily modified with the chcon command.
280 If you want to permanently change the file context you need to use the
281 semanage fcontext command. This will modify the SELinux labeling data‐
282 base. You will need to use restorecon to apply the labels.
283
286 semanage fcontext can also be used to manipulate default file context
287 mappings.
288 semanage permissive can also be used to manipulate whether or not a
290 process type is permissive.
291 semanage module can also be used to enable/disable/install/remove pol‐
293 icy modules.
294 semanage boolean can also be used to manipulate the booleans
296 system-config-selinux is a GUI tool available to customize SELinux pol‐
299 icy settings.
300
303 This manual page was auto-generated using sepolicy manpage .
304
307 selinux(8), fenced(8), semanage(8), restorecon(8), chcon(1), sepol‐
308 icy(8), setsebool(8)
309fenced 23-10-20 fenced_selinux(8)