munin_services_plugin_selinux(8)

1munin_services_plugin_SsEeLliinnuuxx(P8o)licy munin_servimcuensi_np_lsuegrivnices_plugin_selinux(8)
2
3
4

NAME

6       munin_services_plugin_selinux  - Security Enhanced Linux Policy for the
7       munin_services_plugin processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the munin_services_plugin processes via
11       flexible mandatory access control.
12
13       The   munin_services_plugin   processes  execute  with  the  munin_ser‐
14       vices_plugin_t SELinux type. You can check if you have these  processes
15       running by executing the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep munin_services_plugin_t
20
21
22

ENTRYPOINTS

24       The  munin_services_plugin_t  SELinux  type  can  be  entered  via  the
25       munin_services_plugin_exec_t file type.
26
27       The default entrypoint paths for the munin_services_plugin_t domain are
28       the following:
29
30       /usr/share/munin/plugins/nut.*,        /usr/share/munin/plugins/ntp_.*,
31       /usr/share/munin/plugins/snmp_.*,    /usr/share/munin/plugins/mysql_.*,
32       /usr/share/munin/plugins/slapd_.*,   /usr/share/munin/plugins/squid_.*,
33       /usr/share/munin/plugins/apache_.*, /usr/share/munin/plugins/tomcat_.*,
34       /usr/share/munin/plugins/varnish_.*,    /usr/share/munin/plugins/aster‐
35       isk_.*,  /usr/share/munin/plugins/postgres_.*,   /usr/share/munin/plug‐
36       ins/named,    /usr/share/munin/plugins/ping_,    /usr/share/munin/plug‐
37       ins/samba,   /usr/share/munin/plugins/lpstat,    /usr/share/munin/plug‐
38       ins/openvpn,  /usr/share/munin/plugins/fail2ban, /usr/share/munin/plug‐
39       ins/http_loadtime
40

PROCESS TYPES

42       SELinux defines process types (domains) for each process running on the
43       system
44
45       You can see the context of a process using the -Z option to ps
46
47       Policy  governs  the  access confined processes have to files.  SELinux
48       munin_services_plugin policy is very flexible allowing users  to  setup
49       their  munin_services_plugin  processes in as secure a method as possi‐
50       ble.
51
52       The following process types are defined for munin_services_plugin:
53
54       munin_services_plugin_t
55
56       Note: semanage permissive -a munin_services_plugin_t  can  be  used  to
57       make  the process type munin_services_plugin_t permissive. SELinux does
58       not deny access to permissive  process  types,  but  the  AVC  (SELinux
59       denials) messages are still generated.
60
61

BOOLEANS

63       SELinux   policy  is  customizable  based  on  least  access  required.
64       munin_services_plugin policy is  extremely  flexible  and  has  several
65       booleans  that  allow  you  to manipulate the policy and run munin_ser‐
66       vices_plugin with the tightest access possible.
67
68
69
70       If you want to allow all domains to use other domains file descriptors,
71       you must turn on the allow_domain_fd_use boolean. Enabled by default.
72
73       setsebool -P allow_domain_fd_use 1
74
75
76
77       If  you want to allow sysadm to debug or ptrace all processes, you must
78       turn on the allow_ptrace boolean. Disabled by default.
79
80       setsebool -P allow_ptrace 1
81
82
83
84       If you want to allow all domains to have the kernel load  modules,  you
85       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
86       default.
87
88       setsebool -P domain_kernel_load_modules 1
89
90
91
92       If you want to allow all domains to execute in fips_mode, you must turn
93       on the fips_mode boolean. Enabled by default.
94
95       setsebool -P fips_mode 1
96
97
98
99       If you want to enable reading of urandom for all domains, you must turn
100       on the global_ssp boolean. Disabled by default.
101
102       setsebool -P global_ssp 1
103
104
105

MANAGED FILES

107       The SELinux  process  type  munin_services_plugin_t  can  manage  files
108       labeled  with  the  following  file  types.   The  paths listed are the
109       default paths for these file types.  Note the processes UID still  need
110       to have DAC permissions.
111
112       initrc_tmp_t
113
114
115       mnt_t
116
117            /mnt(/[^/]*)
118            /mnt(/[^/]*)?
119            /rhev(/[^/]*)?
120            /media(/[^/]*)
121            /media(/[^/]*)?
122            /etc/rhgb(/.*)?
123            /media/.hal-.*
124            /net
125            /afs
126            /rhev
127            /misc
128
129       munin_plugin_state_t
130
131            /var/lib/munin/plugin-state(/.*)?
132
133       munin_services_plugin_tmp_t
134
135
136       munin_services_plugin_tmpfs_t
137
138
139       tmp_t
140
141            /tmp
142            /usr/tmp
143            /var/tmp
144            /tmp-inst
145            /var/tmp-inst
146            /var/tmp/vi.recover
147
148

FILE CONTEXTS

150       SELinux requires files to have an extended attribute to define the file
151       type.
152
153       You can see the context of a file using the -Z option to ls
154
155       Policy governs the access  confined  processes  have  to  these  files.
156       SELinux munin_services_plugin policy is very flexible allowing users to
157       setup their munin_services_plugin processes in as secure  a  method  as
158       possible.
159
160       STANDARD FILE CONTEXT
161
162       SELinux  defines  the file context types for the munin_services_plugin,
163       if you wanted to store files with these types in a diffent  paths,  you
164       need to execute the semanage command to sepecify alternate labeling and
165       then use restorecon to put the labels on disk.
166
167       semanage     fcontext     -a      -t      munin_services_plugin_tmpfs_t
168       '/srv/mymunin_services_plugin_content(/.*)?'
169       restorecon -R -v /srv/mymunin_services_plugin_content
170
171       Note:  SELinux  often  uses  regular expressions to specify labels that
172       match multiple files.
173
174       The following file types are defined for munin_services_plugin:
175
176
177
178       munin_services_plugin_exec_t
179
180       - Set files with the munin_services_plugin_exec_t type, if you want  to
181       transition an executable to the munin_services_plugin_t domain.
182
183
184       Paths:
185            /usr/share/munin/plugins/nut.*,   /usr/share/munin/plugins/ntp_.*,
186            /usr/share/munin/plugins/snmp_.*,           /usr/share/munin/plug‐
187            ins/mysql_.*,                   /usr/share/munin/plugins/slapd_.*,
188            /usr/share/munin/plugins/squid_.*,          /usr/share/munin/plug‐
189            ins/apache_.*,                 /usr/share/munin/plugins/tomcat_.*,
190            /usr/share/munin/plugins/varnish_.*,        /usr/share/munin/plug‐
191            ins/asterisk_.*,             /usr/share/munin/plugins/postgres_.*,
192            /usr/share/munin/plugins/named,    /usr/share/munin/plugins/ping_,
193            /usr/share/munin/plugins/samba,   /usr/share/munin/plugins/lpstat,
194            /usr/share/munin/plugins/openvpn,           /usr/share/munin/plug‐
195            ins/fail2ban, /usr/share/munin/plugins/http_loadtime
196
197
198       munin_services_plugin_tmp_t
199
200       -  Set  files with the munin_services_plugin_tmp_t type, if you want to
201       store munin services plugin temporary files in the /tmp directories.
202
203
204
205       munin_services_plugin_tmpfs_t
206
207       - Set files with the munin_services_plugin_tmpfs_t type, if you want to
208       store munin services plugin files on a tmpfs file system.
209
210
211
212       Note:  File context can be temporarily modified with the chcon command.
213       If you want to permanently change the file context you need to use  the
214       semanage fcontext command.  This will modify the SELinux labeling data‐
215       base.  You will need to use restorecon to apply the labels.
216
217

COMMANDS

219       semanage fcontext can also be used to manipulate default  file  context
220       mappings.
221
222       semanage  permissive  can  also  be used to manipulate whether or not a
223       process type is permissive.
224
225       semanage module can also be used to enable/disable/install/remove  pol‐
226       icy modules.
227
228       semanage boolean can also be used to manipulate the booleans
229
230
231       system-config-selinux is a GUI tool available to customize SELinux pol‐
232       icy settings.
233
234

AUTHOR

236       This manual page was auto-generated using sepolicy manpage .
237
238