1cluster_selinux(8) SELinux Policy cluster cluster_selinux(8)
2
3
4
6 cluster_selinux - Security Enhanced Linux Policy for the cluster pro‐
7 cesses
8
10 Security-Enhanced Linux secures the cluster processes via flexible
11 mandatory access control.
12
13 The cluster processes execute with the cluster_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep cluster_t
20
21
22
24 The cluster_t SELinux type can be entered via the file_type, unla‐
25 beled_t, proc_type, filesystem_type, mtrr_device_t, sysctl_type, clus‐
26 ter_exec_t file types.
27
28 The default entrypoint paths for the cluster_t domain are the follow‐
29 ing:
30
31 all files on the system, /dev/cpu/mtrr, /usr/lib(64)?/heartbeat/heart‐
32 beat, /usr/sbin/aisexec, /usr/sbin/corosync, /usr/sbin/cpglockd,
33 /usr/sbin/ccs_tool, /usr/sbin/cman_tool, /usr/sbin/rgmanager,
34 /usr/sbin/ldirectord, /usr/sbin/pacemakerd, /usr/sbin/corosync-notifyd,
35 /usr/sbin/pacemaker_remoted
36
38 SELinux defines process types (domains) for each process running on the
39 system
40
41 You can see the context of a process using the -Z option to ps
42
43 Policy governs the access confined processes have to files. SELinux
44 cluster policy is very flexible allowing users to setup their cluster
45 processes in as secure a method as possible.
46
47 The following process types are defined for cluster:
48
49 cluster_t
50
51 Note: semanage permissive -a cluster_t can be used to make the process
52 type cluster_t permissive. SELinux does not deny access to permissive
53 process types, but the AVC (SELinux denials) messages are still gener‐
54 ated.
55
56
58 SELinux policy is customizable based on least access required. cluster
59 policy is extremely flexible and has several booleans that allow you to
60 manipulate the policy and run cluster with the tightest access possi‐
61 ble.
62
63
64
65 If you want to allow cluster administrative domains to connect to the
66 network using TCP, you must turn on the cluster_can_network_connect
67 boolean. Disabled by default.
68
69 setsebool -P cluster_can_network_connect 1
70
71
72
73 If you want to allow cluster administrative domains to manage all files
74 on a system, you must turn on the cluster_manage_all_files boolean.
75 Disabled by default.
76
77 setsebool -P cluster_manage_all_files 1
78
79
80
81 If you want to allow cluster administrative cluster domains memcheck-
82 amd64- to use executable memory, you must turn on the clus‐
83 ter_use_execmem boolean. Disabled by default.
84
85 setsebool -P cluster_use_execmem 1
86
87
88
89 If you want to allow all daemons to write corefiles to /, you must turn
90 on the allow_daemons_dump_core boolean. Disabled by default.
91
92 setsebool -P allow_daemons_dump_core 1
93
94
95
96 If you want to allow all daemons to use tcp wrappers, you must turn on
97 the allow_daemons_use_tcp_wrapper boolean. Disabled by default.
98
99 setsebool -P allow_daemons_use_tcp_wrapper 1
100
101
102
103 If you want to allow all daemons the ability to read/write terminals,
104 you must turn on the allow_daemons_use_tty boolean. Disabled by
105 default.
106
107 setsebool -P allow_daemons_use_tty 1
108
109
110
111 If you want to allow all domains to use other domains file descriptors,
112 you must turn on the allow_domain_fd_use boolean. Enabled by default.
113
114 setsebool -P allow_domain_fd_use 1
115
116
117
118 If you want to allow unconfined executables to make their heap memory
119 executable. Doing this is a really bad idea. Probably indicates a
120 badly coded executable, but could indicate an attack. This executable
121 should be reported in bugzilla, you must turn on the allow_execheap
122 boolean. Disabled by default.
123
124 setsebool -P allow_execheap 1
125
126
127
128 If you want to allow unconfined executables to map a memory region as
129 both executable and writable, this is dangerous and the executable
130 should be reported in bugzilla), you must turn on the allow_execmem
131 boolean. Enabled by default.
132
133 setsebool -P allow_execmem 1
134
135
136
137 If you want to allow all unconfined executables to use libraries
138 requiring text relocation that are not labeled textrel_shlib_t), you
139 must turn on the allow_execmod boolean. Enabled by default.
140
141 setsebool -P allow_execmod 1
142
143
144
145 If you want to allow unconfined executables to make their stack exe‐
146 cutable. This should never, ever be necessary. Probably indicates a
147 badly coded executable, but could indicate an attack. This executable
148 should be reported in bugzilla), you must turn on the allow_execstack
149 boolean. Enabled by default.
150
151 setsebool -P allow_execstack 1
152
153
154
155 If you want to allow confined applications to run with kerberos, you
156 must turn on the allow_kerberos boolean. Enabled by default.
157
158 setsebool -P allow_kerberos 1
159
160
161
162 If you want to allow sysadm to debug or ptrace all processes, you must
163 turn on the allow_ptrace boolean. Disabled by default.
164
165 setsebool -P allow_ptrace 1
166
167
168
169 If you want to allow system to run with NIS, you must turn on the
170 allow_ypbind boolean. Disabled by default.
171
172 setsebool -P allow_ypbind 1
173
174
175
176 If you want to enable cluster mode for daemons, you must turn on the
177 daemons_enable_cluster_mode boolean. Disabled by default.
178
179 setsebool -P daemons_enable_cluster_mode 1
180
181
182
183 If you want to allow all domains to have the kernel load modules, you
184 must turn on the domain_kernel_load_modules boolean. Disabled by
185 default.
186
187 setsebool -P domain_kernel_load_modules 1
188
189
190
191 If you want to allow all domains to execute in fips_mode, you must turn
192 on the fips_mode boolean. Enabled by default.
193
194 setsebool -P fips_mode 1
195
196
197
198 If you want to enable reading of urandom for all domains, you must turn
199 on the global_ssp boolean. Disabled by default.
200
201 setsebool -P global_ssp 1
202
203
204
205 If you want to enable support for upstart as the init program, you must
206 turn on the init_upstart boolean. Enabled by default.
207
208 setsebool -P init_upstart 1
209
210
211
212 If you want to allow certain domains to map low memory in the kernel,
213 you must turn on the mmap_low_allowed boolean. Disabled by default.
214
215 setsebool -P mmap_low_allowed 1
216
217
218
219 If you want to allow confined applications to use nscd shared memory,
220 you must turn on the nscd_use_shm boolean. Enabled by default.
221
222 setsebool -P nscd_use_shm 1
223
224
225
226 If you want to boolean to determine whether the system permits loading
227 policy, setting enforcing mode, and changing boolean values. Set this
228 to true and you have to reboot to set it back, you must turn on the
229 secure_mode_policyload boolean. Disabled by default.
230
231 setsebool -P secure_mode_policyload 1
232
233
234
235 If you want to support X userspace object manager, you must turn on the
236 xserver_object_manager boolean. Disabled by default.
237
238 setsebool -P xserver_object_manager 1
239
240
241
243 SELinux defines port types to represent TCP and UDP ports.
244
245 You can see the types associated with a port by using the following
246 command:
247
248 semanage port -l
249
250
251 Policy governs the access confined processes have to these ports.
252 SELinux cluster policy is very flexible allowing users to setup their
253 cluster processes in as secure a method as possible.
254
255 The following port types are defined for cluster:
256
257
258 cluster_port_t
259
260
261
262 Default Defined Ports:
263 tcp 5149,40040,50006-50008
264 udp 5149,50006-50008
265
267 The SELinux process type cluster_t can manage files labeled with the
268 following file types. The paths listed are the default paths for these
269 file types. Note the processes UID still need to have DAC permissions.
270
271 file_type
272
273 all files on the system
274
275
277 SELinux requires files to have an extended attribute to define the file
278 type.
279
280 You can see the context of a file using the -Z option to ls
281
282 Policy governs the access confined processes have to these files.
283 SELinux cluster policy is very flexible allowing users to setup their
284 cluster processes in as secure a method as possible.
285
286 STANDARD FILE CONTEXT
287
288 SELinux defines the file context types for the cluster, if you wanted
289 to store files with these types in a diffent paths, you need to execute
290 the semanage command to sepecify alternate labeling and then use
291 restorecon to put the labels on disk.
292
293 semanage fcontext -a -t cluster_var_run_t '/srv/mycluster_con‐
294 tent(/.*)?'
295 restorecon -R -v /srv/mycluster_content
296
297 Note: SELinux often uses regular expressions to specify labels that
298 match multiple files.
299
300 The following file types are defined for cluster:
301
302
303
304 cluster_conf_t
305
306 - Set files with the cluster_conf_t type, if you want to treat the
307 files as cluster configuration data, usually stored under the /etc
308 directory.
309
310
311
312 cluster_exec_t
313
314 - Set files with the cluster_exec_t type, if you want to transition an
315 executable to the cluster_t domain.
316
317
318 Paths:
319 /usr/lib(64)?/heartbeat/heartbeat, /usr/sbin/aisexec,
320 /usr/sbin/corosync, /usr/sbin/cpglockd, /usr/sbin/ccs_tool,
321 /usr/sbin/cman_tool, /usr/sbin/rgmanager, /usr/sbin/ldirectord,
322 /usr/sbin/pacemakerd, /usr/sbin/corosync-notifyd, /usr/sbin/pace‐
323 maker_remoted
324
325
326 cluster_initrc_exec_t
327
328 - Set files with the cluster_initrc_exec_t type, if you want to transi‐
329 tion an executable to the cluster_initrc_t domain.
330
331
332 Paths:
333 /etc/rc.d/init.d/openais, /etc/rc.d/init.d/cpglockd,
334 /etc/rc.d/init.d/corosync, /etc/rc.d/init.d/rgmanager,
335 /etc/rc.d/init.d/heartbeat, /etc/rc.d/init.d/pacemaker
336
337
338 cluster_tmp_t
339
340 - Set files with the cluster_tmp_t type, if you want to store cluster
341 temporary files in the /tmp directories.
342
343
344
345 cluster_tmpfs_t
346
347 - Set files with the cluster_tmpfs_t type, if you want to store cluster
348 files on a tmpfs file system.
349
350
351
352 cluster_var_lib_t
353
354 - Set files with the cluster_var_lib_t type, if you want to store the
355 cluster files under the /var/lib directory.
356
357
358 Paths:
359 /var/lib(64)?/openais(/.*)?, /var/lib(64)?/pengine(/.*)?,
360 /var/lib(64)?/corosync(/.*)?, /usr/lib(64)?/heartbeat(/.*)?,
361 /var/lib(64)?/heartbeat(/.*)?, /var/lib(64)?/pacemaker(/.*)?,
362 /var/lib/cluster(/.*)?
363
364
365 cluster_var_log_t
366
367 - Set files with the cluster_var_log_t type, if you want to treat the
368 data as cluster var log data, usually stored under the /var/log direc‐
369 tory.
370
371
372 Paths:
373 /var/log/cluster/aisexec.log.*, /var/log/cluster/cpglockd.log.*,
374 /var/log/cluster/corosync.log.*, /var/log/cluster/rgmanager.log.*
375
376
377 cluster_var_run_t
378
379 - Set files with the cluster_var_run_t type, if you want to store the
380 cluster files under the /run or /var/run directory.
381
382
383 Paths:
384 /var/run/crm(/.*)?, /var/run/cman_.*, /var/run/rsctmp(/.*)?,
385 /var/run/aisexec.*, /var/run/heartbeat(/.*)?,
386 /var/run/cpglockd.pid, /var/run/corosync.pid, /var/run/rgman‐
387 ager.pid, /var/run/cluster/rgmanager.sk
388
389
390 Note: File context can be temporarily modified with the chcon command.
391 If you want to permanently change the file context you need to use the
392 semanage fcontext command. This will modify the SELinux labeling data‐
393 base. You will need to use restorecon to apply the labels.
394
395
397 semanage fcontext can also be used to manipulate default file context
398 mappings.
399
400 semanage permissive can also be used to manipulate whether or not a
401 process type is permissive.
402
403 semanage module can also be used to enable/disable/install/remove pol‐
404 icy modules.
405
406 semanage port can also be used to manipulate the port definitions
407
408 semanage boolean can also be used to manipulate the booleans
409
410
411 system-config-selinux is a GUI tool available to customize SELinux pol‐
412 icy settings.
413
414
416 This manual page was auto-generated using sepolicy manpage .
417
418
420 selinux(8), cluster(8), semanage(8), restorecon(8), chcon(1) , setse‐
421 bool(8)
422
423
424
425cluster 15-06-03 cluster_selinux(8)