1cobblerd_selinux(8) SELinux Policy cobblerd cobblerd_selinux(8)
2
6 cobblerd_selinux - Security Enhanced Linux Policy for the cobblerd pro‐
7 cesses
8
10 Security-Enhanced Linux secures the cobblerd processes via flexible
11 mandatory access control.
12 The cobblerd processes execute with the cobblerd_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep cobblerd_t
20
24 The cobblerd_t SELinux type can be entered via the cobblerd_exec_t file
25 type.
26 The default entrypoint paths for the cobblerd_t domain are the follow‐
28 ing:
29 /usr/bin/cobblerd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 cobblerd policy is very flexible allowing users to setup their cobblerd
40 processes in as secure a method as possible.
41 The following process types are defined for cobblerd:
43 cobblerd_t
45 Note: semanage permissive -a cobblerd_t can be used to make the process
47 type cobblerd_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required. cob‐
54 blerd policy is extremely flexible and has several booleans that allow
55 you to manipulate the policy and run cobblerd with the tightest access
56 possible.
57 If you want to determine whether Cobbler can connect to the network us‐
61 ing TCP, you must turn on the cobbler_can_network_connect boolean. Dis‐
62 abled by default.
63 setsebool -P cobbler_can_network_connect 1
65 If you want to determine whether Cobbler can access cifs file systems,
69 you must turn on the cobbler_use_cifs boolean. Disabled by default.
70 setsebool -P cobbler_use_cifs 1
72 If you want to determine whether Cobbler can access nfs file systems,
76 you must turn on the cobbler_use_nfs boolean. Disabled by default.
77 setsebool -P cobbler_use_nfs 1
79 If you want to dontaudit all daemons scheduling requests (setsched,
83 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
84 Enabled by default.
85 setsebool -P daemons_dontaudit_scheduling 1
87 If you want to allow all domains to execute in fips_mode, you must turn
91 on the fips_mode boolean. Enabled by default.
92 setsebool -P fips_mode 1
94 If you want to allow system to run with NIS, you must turn on the
98 nis_enabled boolean. Disabled by default.
99 setsebool -P nis_enabled 1
101
105 SELinux defines port types to represent TCP and UDP ports.
106 You can see the types associated with a port by using the following
108 command:
109 semanage port -l
111 Policy governs the access confined processes have to these ports.
114 SELinux cobblerd policy is very flexible allowing users to setup their
115 cobblerd processes in as secure a method as possible.
116 The following port types are defined for cobblerd:
118 cobbler_port_t
121 Default Defined Ports:
125 tcp 25151
126
128 The SELinux process type cobblerd_t can manage files labeled with the
129 following file types. The paths listed are the default paths for these
130 file types. Note the processes UID still need to have DAC permissions.
131 cifs_t
133 cluster_conf_t
136 /etc/cluster(/.*)?
138 cluster_var_lib_t
140 /var/lib/pcsd(/.*)?
142 /var/lib/cluster(/.*)?
143 /var/lib/openais(/.*)?
144 /var/lib/pengine(/.*)?
145 /var/lib/corosync(/.*)?
146 /usr/lib/heartbeat(/.*)?
147 /var/lib/heartbeat(/.*)?
148 /var/lib/pacemaker(/.*)?
149 cluster_var_run_t
151 /var/run/crm(/.*)?
153 /var/run/cman_.*
154 /var/run/rsctmp(/.*)?
155 /var/run/aisexec.*
156 /var/run/heartbeat(/.*)?
157 /var/run/pcsd-ruby.socket
158 /var/run/corosync-qnetd(/.*)?
159 /var/run/corosync-qdevice(/.*)?
160 /var/run/corosync.pid
161 /var/run/cpglockd.pid
162 /var/run/rgmanager.pid
163 /var/run/cluster/rgmanager.sk
164 cobbler_tmp_t
166 cobbler_var_lib_t
169 /var/lib/cobbler(/.*)?
171 /var/www/cobbler(/.*)?
172 /var/cache/cobbler(/.*)?
173 /var/lib/tftpboot/etc(/.*)?
174 /var/lib/tftpboot/ppc(/.*)?
175 /var/lib/tftpboot/boot(/.*)?
176 /var/lib/tftpboot/grub(/.*)?
177 /var/lib/tftpboot/s390x(/.*)?
178 /var/lib/tftpboot/images(/.*)?
179 /var/lib/tftpboot/aarch64(/.*)?
180 /var/lib/tftpboot/images2(/.*)?
181 /var/lib/tftpboot/pxelinux.cfg(/.*)?
182 /var/lib/tftpboot/yaboot
183 /var/lib/tftpboot/memdisk
184 /var/lib/tftpboot/menu.c32
185 /var/lib/tftpboot/pxelinux.0
186 dhcp_etc_t
188 /etc/dhcpc.*
190 /etc/dhcp3?(/.*)?
191 /etc/dhcpd(6)?.conf
192 /etc/dhcp3?/dhclient.*
193 /etc/dhclient.*conf
194 /etc/dhcp/dhcpd(6)?.conf
195 /etc/dhclient-script
196 dnsmasq_etc_t
198 /etc/dnsmasq.d(/.*)?
200 /etc/dnsmasq.conf
201 krb5_host_rcache_t
203 /var/tmp/krb5_0.rcache2
205 /var/cache/krb5rcache(/.*)?
206 /var/tmp/nfs_0
207 /var/tmp/DNS_25
208 /var/tmp/host_0
209 /var/tmp/imap_0
210 /var/tmp/HTTP_23
211 /var/tmp/HTTP_48
212 /var/tmp/ldap_55
213 /var/tmp/ldap_487
214 /var/tmp/ldapmap1_0
215 named_conf_t
217 /etc/rndc.*
219 /etc/named(/.*)?
220 /etc/unbound(/.*)?
221 /var/named/chroot(/.*)?
222 /etc/named.rfc1912.zones
223 /var/named/chroot/etc/named.rfc1912.zones
224 /etc/named.conf
225 /var/named/named.ca
226 /etc/named.root.hints
227 /var/named/chroot/etc/named.conf
228 /etc/named.caching-nameserver.conf
229 /var/named/chroot/var/named/named.ca
230 /var/named/chroot/etc/named.root.hints
231 /var/named/chroot/etc/named.caching-nameserver.conf
232 named_zone_t
234 /var/named(/.*)?
236 /var/named/chroot/var/named(/.*)?
237 nfs_t
239 root_t
242 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
244 /
245 /initrd
246 rsync_etc_t
248 /etc/rsyncd.conf
250 systemd_passwd_var_run_t
252 /var/run/systemd/ask-password(/.*)?
254 /var/run/systemd/ask-password-block(/.*)?
255 tftpd_etc_t
257 /etc/(x)?inetd.d/tftp
259
262 SELinux requires files to have an extended attribute to define the file
263 type.
264 You can see the context of a file using the -Z option to ls
266 Policy governs the access confined processes have to these files.
268 SELinux cobblerd policy is very flexible allowing users to setup their
269 cobblerd processes in as secure a method as possible.
270 STANDARD FILE CONTEXT
272 SELinux defines the file context types for the cobblerd, if you wanted
274 to store files with these types in a different paths, you need to exe‐
275 cute the semanage command to specify alternate labeling and then use
276 restorecon to put the labels on disk.
277 semanage fcontext -a -t cobblerd_exec_t '/srv/cobblerd/content(/.*)?'
279 restorecon -R -v /srv/mycobblerd_content
280 Note: SELinux often uses regular expressions to specify labels that
282 match multiple files.
283 The following file types are defined for cobblerd:
285 cobblerd_exec_t
289 - Set files with the cobblerd_exec_t type, if you want to transition an
291 executable to the cobblerd_t domain.
292 cobblerd_initrc_exec_t
296 - Set files with the cobblerd_initrc_exec_t type, if you want to tran‐
298 sition an executable to the cobblerd_initrc_t domain.
299 Note: File context can be temporarily modified with the chcon command.
303 If you want to permanently change the file context you need to use the
304 semanage fcontext command. This will modify the SELinux labeling data‐
305 base. You will need to use restorecon to apply the labels.
306
309 If you want to share files with multiple domains (Apache, FTP, rsync,
310 Samba), you can set a file context of public_content_t and public_con‐
311 tent_rw_t. These context allow any of the above domains to read the
312 content. If you want a particular domain to write to the public_con‐
313 tent_rw_t domain, you must set the appropriate boolean.
314 Allow cobblerd servers to read the /var/cobblerd directory by adding
316 the public_content_t file type to the directory and by restoring the
317 file type.
318 semanage fcontext -a -t public_content_t "/var/cobblerd(/.*)?"
320 restorecon -F -R -v /var/cobblerd
321 Allow cobblerd servers to read and write /var/cobblerd/incoming by
323 adding the public_content_rw_t type to the directory and by restoring
324 the file type. You also need to turn on the cobblerd_anon_write bool‐
325 ean.
326 semanage fcontext -a -t public_content_rw_t "/var/cobblerd/incom‐
328 ing(/.*)?"
329 restorecon -F -R -v /var/cobblerd/incoming
330 setsebool -P cobblerd_anon_write 1
331 If you want to determine whether Cobbler can modify public files used
334 for public file transfer services., you must turn on the cob‐
335 bler_anon_write boolean.
336 setsebool -P cobbler_anon_write 1
338
341 semanage fcontext can also be used to manipulate default file context
342 mappings.
343 semanage permissive can also be used to manipulate whether or not a
345 process type is permissive.
346 semanage module can also be used to enable/disable/install/remove pol‐
348 icy modules.
349 semanage port can also be used to manipulate the port definitions
351 semanage boolean can also be used to manipulate the booleans
353 system-config-selinux is a GUI tool available to customize SELinux pol‐
356 icy settings.
357
360 This manual page was auto-generated using sepolicy manpage .
361
364 selinux(8), cobblerd(8), semanage(8), restorecon(8), chcon(1), sepol‐
365 icy(8), setsebool(8)
366cobblerd 23-12-15 cobblerd_selinux(8)