munin_selinux(8)

1munin_selinux(8)             SELinux Policy munin             munin_selinux(8)
2
3
4

NAME

6       munin_selinux - Security Enhanced Linux Policy for the munin processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the munin processes via flexible manda‐
10       tory access control.
11
12       The munin processes execute with the  munin_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep munin_t
19
20
21

ENTRYPOINTS

23       The munin_t SELinux type can be entered via the munin_exec_t file type.
24
25       The default entrypoint paths for the munin_t domain are the following:
26
27       /usr/bin/munin-.*, /usr/sbin/munin-.*, /usr/share/munin/munin-.*
28

PROCESS TYPES

30       SELinux defines process types (domains) for each process running on the
31       system
32
33       You can see the context of a process using the -Z option to ps
34
35       Policy  governs  the  access confined processes have to files.  SELinux
36       munin policy is very flexible allowing users to setup their munin  pro‐
37       cesses in as secure a method as possible.
38
39       The following process types are defined for munin:
40
41       munin_mail_plugin_t, munin_disk_plugin_t, munin_services_plugin_t, munin_selinux_plugin_t, munin_system_plugin_t, munin_unconfined_plugin_t, munin_t
42
43       Note:  semanage  permissive  -a munin_t can be used to make the process
44       type munin_t permissive. SELinux does not  deny  access  to  permissive
45       process  types, but the AVC (SELinux denials) messages are still gener‐
46       ated.
47
48

BOOLEANS

50       SELinux policy is customizable based on least access  required.   munin
51       policy is extremely flexible and has several booleans that allow you to
52       manipulate the policy and run munin with the tightest access possible.
53
54
55
56       If you want to allow all daemons to write corefiles to /, you must turn
57       on the allow_daemons_dump_core boolean. Disabled by default.
58
59       setsebool -P allow_daemons_dump_core 1
60
61
62
63       If  you want to allow all daemons to use tcp wrappers, you must turn on
64       the allow_daemons_use_tcp_wrapper boolean. Disabled by default.
65
66       setsebool -P allow_daemons_use_tcp_wrapper 1
67
68
69
70       If you want to allow all daemons the ability to  read/write  terminals,
71       you  must  turn  on  the  allow_daemons_use_tty  boolean.  Disabled  by
72       default.
73
74       setsebool -P allow_daemons_use_tty 1
75
76
77
78       If you want to allow all domains to use other domains file descriptors,
79       you must turn on the allow_domain_fd_use boolean. Enabled by default.
80
81       setsebool -P allow_domain_fd_use 1
82
83
84
85       If  you  want  to allow confined applications to run with kerberos, you
86       must turn on the allow_kerberos boolean. Enabled by default.
87
88       setsebool -P allow_kerberos 1
89
90
91
92       If you want to allow sysadm to debug or ptrace all processes, you  must
93       turn on the allow_ptrace boolean. Disabled by default.
94
95       setsebool -P allow_ptrace 1
96
97
98
99       If  you  want  to  allow  system  to run with NIS, you must turn on the
100       allow_ypbind boolean. Disabled by default.
101
102       setsebool -P allow_ypbind 1
103
104
105
106       If you want to enable cluster mode for daemons, you must  turn  on  the
107       daemons_enable_cluster_mode boolean. Disabled by default.
108
109       setsebool -P daemons_enable_cluster_mode 1
110
111
112
113       If  you  want to allow all domains to have the kernel load modules, you
114       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
115       default.
116
117       setsebool -P domain_kernel_load_modules 1
118
119
120
121       If you want to allow all domains to execute in fips_mode, you must turn
122       on the fips_mode boolean. Enabled by default.
123
124       setsebool -P fips_mode 1
125
126
127
128       If you want to enable reading of urandom for all domains, you must turn
129       on the global_ssp boolean. Disabled by default.
130
131       setsebool -P global_ssp 1
132
133
134
135       If you want to enable support for upstart as the init program, you must
136       turn on the init_upstart boolean. Enabled by default.
137
138       setsebool -P init_upstart 1
139
140
141
142       If you want to allow confined applications to use nscd  shared  memory,
143       you must turn on the nscd_use_shm boolean. Enabled by default.
144
145       setsebool -P nscd_use_shm 1
146
147
148

PORT TYPES

150       SELinux defines port types to represent TCP and UDP ports.
151
152       You  can  see  the  types associated with a port by using the following
153       command:
154
155       semanage port -l
156
157
158       Policy governs the access  confined  processes  have  to  these  ports.
159       SELinux  munin  policy  is  very flexible allowing users to setup their
160       munin processes in as secure a method as possible.
161
162       The following port types are defined for munin:
163
164
165       munin_port_t
166
167
168
169       Default Defined Ports:
170                 tcp 4949
171                 udp 4949
172

MANAGED FILES

174       The SELinux process type munin_t can manage files labeled with the fol‐
175       lowing  file  types.   The paths listed are the default paths for these
176       file types.  Note the processes UID still need to have DAC permissions.
177
178       cluster_conf_t
179
180            /etc/cluster(/.*)?
181
182       cluster_var_lib_t
183
184            /var/lib(64)?/openais(/.*)?
185            /var/lib(64)?/pengine(/.*)?
186            /var/lib(64)?/corosync(/.*)?
187            /usr/lib(64)?/heartbeat(/.*)?
188            /var/lib(64)?/heartbeat(/.*)?
189            /var/lib(64)?/pacemaker(/.*)?
190            /var/lib/cluster(/.*)?
191
192       cluster_var_run_t
193
194            /var/run/crm(/.*)?
195            /var/run/cman_.*
196            /var/run/rsctmp(/.*)?
197            /var/run/aisexec.*
198            /var/run/heartbeat(/.*)?
199            /var/run/cpglockd.pid
200            /var/run/corosync.pid
201            /var/run/rgmanager.pid
202            /var/run/cluster/rgmanager.sk
203
204       httpd_munin_content_t
205
206            /var/www/html/munin(/.*)?
207
208       initrc_tmp_t
209
210
211       mnt_t
212
213            /mnt(/[^/]*)
214            /mnt(/[^/]*)?
215            /rhev(/[^/]*)?
216            /media(/[^/]*)
217            /media(/[^/]*)?
218            /etc/rhgb(/.*)?
219            /media/.hal-.*
220            /net
221            /afs
222            /rhev
223            /misc
224
225       munin_log_t
226
227            /var/log/munin.*
228
229       munin_plugin_state_t
230
231            /var/lib/munin/plugin-state(/.*)?
232
233       munin_tmp_t
234
235
236       munin_var_lib_t
237
238            /var/lib/munin(/.*)?
239
240       munin_var_run_t
241
242            /var/run/munin(/.*)?
243
244       root_t
245
246            /
247            /initrd
248
249       tmp_t
250
251            /tmp
252            /usr/tmp
253            /var/tmp
254            /tmp-inst
255            /var/tmp-inst
256            /var/tmp/vi.recover
257
258

FILE CONTEXTS

260       SELinux requires files to have an extended attribute to define the file
261       type.
262
263       You can see the context of a file using the -Z option to ls
264
265       Policy  governs  the  access  confined  processes  have to these files.
266       SELinux munin policy is very flexible allowing  users  to  setup  their
267       munin processes in as secure a method as possible.
268
269       EQUIVALENCE DIRECTORIES
270
271
272       munin  policy  stores  data  with multiple different file context types
273       under the /var/lib/munin directory.  If you would  like  to  store  the
274       data  in a different directory you can use the semanage command to cre‐
275       ate an equivalence mapping.  If you wanted to store this data under the
276       /srv dirctory you would execute the following command:
277
278       semanage fcontext -a -e /var/lib/munin /srv/munin
279       restorecon -R -v /srv/munin
280
281       STANDARD FILE CONTEXT
282
283       SELinux  defines the file context types for the munin, if you wanted to
284       store files with these types in a diffent paths, you  need  to  execute
285       the  semanage  command  to  sepecify  alternate  labeling  and then use
286       restorecon to put the labels on disk.
287
288       semanage fcontext -a -t munin_var_run_t '/srv/mymunin_content(/.*)?'
289       restorecon -R -v /srv/mymunin_content
290
291       Note: SELinux often uses regular expressions  to  specify  labels  that
292       match multiple files.
293
294       The following file types are defined for munin:
295
296
297
298       munin_disk_plugin_exec_t
299
300       -  Set  files  with  the  munin_disk_plugin_exec_t type, if you want to
301       transition an executable to the munin_disk_plugin_t domain.
302
303
304       Paths:
305            /usr/share/munin/plugins/df.*,  /usr/share/munin/plugins/smart_.*,
306            /usr/share/munin/plugins/hddtemp.*, /usr/share/munin/plugins/disk‐
307            stat.*
308
309
310       munin_disk_plugin_tmp_t
311
312       - Set files with the munin_disk_plugin_tmp_t type, if you want to store
313       munin disk plugin temporary files in the /tmp directories.
314
315
316
317       munin_etc_t
318
319       - Set files with the munin_etc_t type, if you want to store munin files
320       in the /etc directories.
321
322
323
324       munin_exec_t
325
326       - Set files with the munin_exec_t type, if you want  to  transition  an
327       executable to the munin_t domain.
328
329
330       Paths:
331            /usr/bin/munin-.*, /usr/sbin/munin-.*, /usr/share/munin/munin-.*
332
333
334       munin_initrc_exec_t
335
336       -  Set  files with the munin_initrc_exec_t type, if you want to transi‐
337       tion an executable to the munin_initrc_t domain.
338
339
340
341       munin_log_t
342
343       - Set files with the munin_log_t type, if you want to treat the data as
344       munin log data, usually stored under the /var/log directory.
345
346
347
348       munin_mail_plugin_exec_t
349
350       -  Set  files  with  the  munin_mail_plugin_exec_t type, if you want to
351       transition an executable to the munin_mail_plugin_t domain.
352
353
354       Paths:
355            /usr/share/munin/plugins/qmail.*,           /usr/share/munin/plug‐
356            ins/exim_mail.*,             /usr/share/munin/plugins/sendmail_.*,
357            /usr/share/munin/plugins/courier_mta_.*,    /usr/share/munin/plug‐
358            ins/postfix_mail.*,              /usr/share/munin/plugins/mailman,
359            /usr/share/munin/plugins/mailscanner
360
361
362       munin_mail_plugin_tmp_t
363
364       - Set files with the munin_mail_plugin_tmp_t type, if you want to store
365       munin mail plugin temporary files in the /tmp directories.
366
367
368
369       munin_plugin_state_t
370
371       -  Set  files  with the munin_plugin_state_t type, if you want to treat
372       the files as munin plugin state data.
373
374
375
376       munin_selinux_plugin_exec_t
377
378       - Set files with the munin_selinux_plugin_exec_t type, if you  want  to
379       transition an executable to the munin_selinux_plugin_t domain.
380
381
382
383       munin_selinux_plugin_tmp_t
384
385       -  Set  files  with the munin_selinux_plugin_tmp_t type, if you want to
386       store munin selinux plugin temporary files in the /tmp directories.
387
388
389
390       munin_services_plugin_exec_t
391
392       - Set files with the munin_services_plugin_exec_t type, if you want  to
393       transition an executable to the munin_services_plugin_t domain.
394
395
396       Paths:
397            /usr/share/munin/plugins/nut.*,   /usr/share/munin/plugins/ntp_.*,
398            /usr/share/munin/plugins/snmp_.*,           /usr/share/munin/plug‐
399            ins/mysql_.*,                   /usr/share/munin/plugins/slapd_.*,
400            /usr/share/munin/plugins/squid_.*,          /usr/share/munin/plug‐
401            ins/apache_.*,                 /usr/share/munin/plugins/tomcat_.*,
402            /usr/share/munin/plugins/varnish_.*,        /usr/share/munin/plug‐
403            ins/asterisk_.*,             /usr/share/munin/plugins/postgres_.*,
404            /usr/share/munin/plugins/named,    /usr/share/munin/plugins/ping_,
405            /usr/share/munin/plugins/samba,   /usr/share/munin/plugins/lpstat,
406            /usr/share/munin/plugins/openvpn,           /usr/share/munin/plug‐
407            ins/fail2ban, /usr/share/munin/plugins/http_loadtime
408
409
410       munin_services_plugin_tmp_t
411
412       -  Set  files with the munin_services_plugin_tmp_t type, if you want to
413       store munin services plugin temporary files in the /tmp directories.
414
415
416
417       munin_services_plugin_tmpfs_t
418
419       - Set files with the munin_services_plugin_tmpfs_t type, if you want to
420       store munin services plugin files on a tmpfs file system.
421
422
423
424       munin_system_plugin_exec_t
425
426       -  Set  files  with the munin_system_plugin_exec_t type, if you want to
427       transition an executable to the munin_system_plugin_t domain.
428
429
430       Paths:
431            /usr/share/munin/plugins/cpu.*,    /usr/share/munin/plugins/if_.*,
432            /usr/share/munin/plugins/nfs.*,  /usr/share/munin/plugins/munin_*,
433            /usr/share/munin/plugins/iostat.*,  /usr/share/munin/plugins/acpi,
434            /usr/share/munin/plugins/load,      /usr/share/munin/plugins/swap,
435            /usr/share/munin/plugins/forks,    /usr/share/munin/plugins/users,
436            /usr/share/munin/plugins/memory,  /usr/share/munin/plugins/uptime,
437            /usr/share/munin/plugins/netstat,           /usr/share/munin/plug‐
438            ins/threads,                     /usr/share/munin/plugins/unbound,
439            /usr/share/munin/plugins/irqstats,          /usr/share/munin/plug‐
440            ins/proc_pri,                  /usr/share/munin/plugins/processes,
441            /usr/share/munin/plugins/interrupts,        /usr/share/munin/plug‐
442            ins/open_files
443
444
445       munin_system_plugin_tmp_t
446
447       -  Set  files  with  the munin_system_plugin_tmp_t type, if you want to
448       store munin system plugin temporary files in the /tmp directories.
449
450
451
452       munin_tmp_t
453
454       - Set files with the munin_tmp_t type, if you want to store munin  tem‐
455       porary files in the /tmp directories.
456
457
458
459       munin_unconfined_plugin_exec_t
460
461       -  Set  files with the munin_unconfined_plugin_exec_t type, if you want
462       to transition an executable to the munin_unconfined_plugin_t domain.
463
464
465
466       munin_unconfined_plugin_tmp_t
467
468       - Set files with the munin_unconfined_plugin_tmp_t type, if you want to
469       store munin unconfined plugin temporary files in the /tmp directories.
470
471
472
473       munin_var_lib_t
474
475       -  Set  files  with  the munin_var_lib_t type, if you want to store the
476       munin files under the /var/lib directory.
477
478
479
480       munin_var_run_t
481
482       - Set files with the munin_var_run_t type, if you  want  to  store  the
483       munin files under the /run or /var/run directory.
484
485
486
487       Note:  File context can be temporarily modified with the chcon command.
488       If you want to permanently change the file context you need to use  the
489       semanage fcontext command.  This will modify the SELinux labeling data‐
490       base.  You will need to use restorecon to apply the labels.
491
492

COMMANDS

494       semanage fcontext can also be used to manipulate default  file  context
495       mappings.
496
497       semanage  permissive  can  also  be used to manipulate whether or not a
498       process type is permissive.
499
500       semanage module can also be used to enable/disable/install/remove  pol‐
501       icy modules.
502
503       semanage port can also be used to manipulate the port definitions
504
505       semanage boolean can also be used to manipulate the booleans
506
507
508       system-config-selinux is a GUI tool available to customize SELinux pol‐
509       icy settings.
510
511

AUTHOR

513       This manual page was auto-generated using sepolicy manpage .
514
515