svnserve_selinux(8)

1svnserve_selinux(8)         SELinux Policy svnserve        svnserve_selinux(8)
2
3
4

NAME

6       svnserve_selinux - Security Enhanced Linux Policy for the svnserve pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  svnserve  processes  via  flexible
11       mandatory access control.
12
13       The  svnserve  processes  execute with the svnserve_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep svnserve_t
20
21
22

ENTRYPOINTS

24       The svnserve_t SELinux type can be entered via the svnserve_exec_t file
25       type.
26
27       The default entrypoint paths for the svnserve_t domain are the  follow‐
28       ing:
29
30       /usr/bin/svnserve
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       svnserve policy is very flexible allowing users to setup their svnserve
40       processes in as secure a method as possible.
41
42       The following process types are defined for svnserve:
43
44       svnserve_t
45
46       Note: semanage permissive -a svnserve_t can be used to make the process
47       type  svnserve_t permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       svnserve policy is extremely flexible and has several booleans that al‐
55       low you to manipulate the policy and run svnserve with the tightest ac‐
56       cess possible.
57
58
59
60       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
61       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
62       Enabled by default.
63
64       setsebool -P daemons_dontaudit_scheduling 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to allow confined applications to run with kerberos, you
76       must turn on the kerberos_enabled boolean. Enabled by default.
77
78       setsebool -P kerberos_enabled 1
79
80
81
82       If you want to allow system to run with  NIS,  you  must  turn  on  the
83       nis_enabled boolean. Disabled by default.
84
85       setsebool -P nis_enabled 1
86
87
88

MANAGED FILES

90       The  SELinux  process type svnserve_t can manage files labeled with the
91       following file types.  The paths listed are the default paths for these
92       file types.  Note the processes UID still need to have DAC permissions.
93
94       cluster_conf_t
95
96            /etc/cluster(/.*)?
97
98       cluster_var_lib_t
99
100            /var/lib/pcsd(/.*)?
101            /var/lib/cluster(/.*)?
102            /var/lib/openais(/.*)?
103            /var/lib/pengine(/.*)?
104            /var/lib/corosync(/.*)?
105            /usr/lib/heartbeat(/.*)?
106            /var/lib/heartbeat(/.*)?
107            /var/lib/pacemaker(/.*)?
108
109       cluster_var_run_t
110
111            /var/run/crm(/.*)?
112            /var/run/cman_.*
113            /var/run/rsctmp(/.*)?
114            /var/run/aisexec.*
115            /var/run/heartbeat(/.*)?
116            /var/run/pcsd-ruby.socket
117            /var/run/corosync-qnetd(/.*)?
118            /var/run/corosync-qdevice(/.*)?
119            /var/run/corosync.pid
120            /var/run/cpglockd.pid
121            /var/run/rgmanager.pid
122            /var/run/cluster/rgmanager.sk
123
124       krb5_host_rcache_t
125
126            /var/tmp/krb5_0.rcache2
127            /var/cache/krb5rcache(/.*)?
128            /var/tmp/nfs_0
129            /var/tmp/DNS_25
130            /var/tmp/host_0
131            /var/tmp/imap_0
132            /var/tmp/HTTP_23
133            /var/tmp/HTTP_48
134            /var/tmp/ldap_55
135            /var/tmp/ldap_487
136            /var/tmp/ldapmap1_0
137
138       root_t
139
140            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
141            /
142            /initrd
143
144       security_t
145
146            /selinux
147
148       svnserve_content_t
149
150            /var/svn(/.*)?
151            /var/subversion/repo(/.*)?
152            /var/lib/subversion/repo(/.*)?
153
154       svnserve_log_t
155
156            /var/log/svnserve(/.*)?
157
158       svnserve_tmp_t
159
160
161       svnserve_var_run_t
162
163            /var/run/svnserve.pid
164            /var/run/svnserve(/.*)?
165
166

FILE CONTEXTS

168       SELinux requires files to have an extended attribute to define the file
169       type.
170
171       You can see the context of a file using the -Z option to ls
172
173       Policy governs the access  confined  processes  have  to  these  files.
174       SELinux  svnserve policy is very flexible allowing users to setup their
175       svnserve processes in as secure a method as possible.
176
177       EQUIVALENCE DIRECTORIES
178
179
180       svnserve policy stores data with multiple different file context  types
181       under  the /var/run/svnserve directory.  If you would like to store the
182       data in a different directory you can use the semanage command to  cre‐
183       ate an equivalence mapping.  If you wanted to store this data under the
184       /srv directory you would execute the following command:
185
186       semanage fcontext -a -e /var/run/svnserve /srv/svnserve
187       restorecon -R -v /srv/svnserve
188
189       STANDARD FILE CONTEXT
190
191       SELinux defines the file context types for the svnserve, if you  wanted
192       to  store files with these types in a different paths, you need to exe‐
193       cute the semanage command to specify alternate labeling  and  then  use
194       restorecon to put the labels on disk.
195
196       semanage fcontext -a -t svnserve_exec_t '/srv/svnserve/content(/.*)?'
197       restorecon -R -v /srv/mysvnserve_content
198
199       Note:  SELinux  often  uses  regular expressions to specify labels that
200       match multiple files.
201
202       The following file types are defined for svnserve:
203
204
205
206       svnserve_content_t
207
208       - Set files with the svnserve_content_t type, if you want to treat  the
209       files as svnserve content.
210
211
212       Paths:
213            /var/svn(/.*)?,    /var/subversion/repo(/.*)?,    /var/lib/subver‐
214            sion/repo(/.*)?
215
216
217       svnserve_exec_t
218
219       - Set files with the svnserve_exec_t type, if you want to transition an
220       executable to the svnserve_t domain.
221
222
223
224       svnserve_initrc_exec_t
225
226       -  Set files with the svnserve_initrc_exec_t type, if you want to tran‐
227       sition an executable to the svnserve_initrc_t domain.
228
229
230
231       svnserve_log_t
232
233       - Set files with the svnserve_log_t type, if you want to treat the data
234       as svnserve log data, usually stored under the /var/log directory.
235
236
237
238       svnserve_tmp_t
239
240       - Set files with the svnserve_tmp_t type, if you want to store svnserve
241       temporary files in the /tmp directories.
242
243
244
245       svnserve_unit_file_t
246
247       - Set files with the svnserve_unit_file_t type, if you  want  to  treat
248       the files as svnserve unit content.
249
250
251       Paths:
252            /lib/systemd/system/svnserve.service,        /usr/lib/systemd/sys‐
253            tem/svnserve.service
254
255
256       svnserve_var_run_t
257
258       - Set files with the svnserve_var_run_t type, if you want to store  the
259       svnserve files under the /run or /var/run directory.
260
261
262       Paths:
263            /var/run/svnserve.pid, /var/run/svnserve(/.*)?
264
265
266       Note:  File context can be temporarily modified with the chcon command.
267       If you want to permanently change the file context you need to use  the
268       semanage fcontext command.  This will modify the SELinux labeling data‐
269       base.  You will need to use restorecon to apply the labels.
270
271

COMMANDS

273       semanage fcontext can also be used to manipulate default  file  context
274       mappings.
275
276       semanage  permissive  can  also  be used to manipulate whether or not a
277       process type is permissive.
278
279       semanage module can also be used to enable/disable/install/remove  pol‐
280       icy modules.
281
282       semanage boolean can also be used to manipulate the booleans
283
284
285       system-config-selinux is a GUI tool available to customize SELinux pol‐
286       icy settings.
287
288

AUTHOR

290       This manual page was auto-generated using sepolicy manpage .
291
292