nagios_selinux(8)

1nagios_selinux(8)            SELinux Policy nagios           nagios_selinux(8)
2
3
4

NAME

6       nagios_selinux  -  Security  Enhanced  Linux Policy for the nagios pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  nagios  processes  via  flexible
11       mandatory access control.
12
13       The  nagios  processes  execute with the nagios_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep nagios_t
20
21
22

ENTRYPOINTS

24       The  nagios_t  SELinux  type  can be entered via the nagios_exec_t file
25       type.
26
27       The default entrypoint paths for the nagios_t domain are the following:
28
29       /usr/bin/nagios, /usr/bin/icinga, /usr/sbin/nagios, /usr/sbin/icinga
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       nagios policy is very flexible allowing users  to  setup  their  nagios
39       processes in as secure a method as possible.
40
41       The following process types are defined for nagios:
42
43       nagios_t, nagios_admin_plugin_t, nagios_checkdisk_plugin_t, nagios_mail_plugin_t, nagios_services_plugin_t, nagios_system_plugin_t, nagios_unconfined_plugin_t, nagios_eventhandler_plugin_t, nagios_openshift_plugin_t, nagios_script_t
44
45       Note:  semanage  permissive -a nagios_t can be used to make the process
46       type nagios_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   nagios
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run nagios with the tightest access possible.
55
56
57
58       If you want to allow nagios run in  conjunction  with  PNP4Nagios,  you
59       must turn on the nagios_run_pnp4nagios boolean. Disabled by default.
60
61       setsebool -P nagios_run_pnp4nagios 1
62
63
64
65       If  you want to allow nagios/nrpe to call sudo from NRPE utils scripts,
66       you must turn on the nagios_run_sudo boolean. Disabled by default.
67
68       setsebool -P nagios_run_sudo 1
69
70
71
72       If you want to determine whether Nagios, NRPE can access nfs file  sys‐
73       tems, you must turn on the nagios_use_nfs boolean. Disabled by default.
74
75       setsebool -P nagios_use_nfs 1
76
77
78
79       If you want to allow users to resolve user passwd entries directly from
80       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
81       gin_nsswitch_use_ldap boolean. Disabled by default.
82
83       setsebool -P authlogin_nsswitch_use_ldap 1
84
85
86
87       If you want to allow all daemons to write corefiles to /, you must turn
88       on the daemons_dump_core boolean. Disabled by default.
89
90       setsebool -P daemons_dump_core 1
91
92
93
94       If you want to enable cluster mode for daemons, you must  turn  on  the
95       daemons_enable_cluster_mode boolean. Enabled by default.
96
97       setsebool -P daemons_enable_cluster_mode 1
98
99
100
101       If  you want to allow all daemons to use tcp wrappers, you must turn on
102       the daemons_use_tcp_wrapper boolean. Disabled by default.
103
104       setsebool -P daemons_use_tcp_wrapper 1
105
106
107
108       If you want to allow all daemons the ability to  read/write  terminals,
109       you must turn on the daemons_use_tty boolean. Disabled by default.
110
111       setsebool -P daemons_use_tty 1
112
113
114
115       If  you  want  to deny any process from ptracing or debugging any other
116       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
117       default.
118
119       setsebool -P deny_ptrace 1
120
121
122
123       If  you  want  to  allow  any  process  to mmap any file on system with
124       attribute file_type, you must turn on the  domain_can_mmap_files  bool‐
125       ean. Enabled by default.
126
127       setsebool -P domain_can_mmap_files 1
128
129
130
131       If  you want to allow all domains write to kmsg_device, while kernel is
132       executed with systemd.log_target=kmsg parameter, you must turn  on  the
133       domain_can_write_kmsg boolean. Disabled by default.
134
135       setsebool -P domain_can_write_kmsg 1
136
137
138
139       If you want to allow all domains to use other domains file descriptors,
140       you must turn on the domain_fd_use boolean. Enabled by default.
141
142       setsebool -P domain_fd_use 1
143
144
145
146       If you want to allow all domains to have the kernel load  modules,  you
147       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
148       default.
149
150       setsebool -P domain_kernel_load_modules 1
151
152
153
154       If you want to allow all domains to execute in fips_mode, you must turn
155       on the fips_mode boolean. Enabled by default.
156
157       setsebool -P fips_mode 1
158
159
160
161       If you want to enable reading of urandom for all domains, you must turn
162       on the global_ssp boolean. Disabled by default.
163
164       setsebool -P global_ssp 1
165
166
167
168       If you want to allow confined applications to run  with  kerberos,  you
169       must turn on the kerberos_enabled boolean. Enabled by default.
170
171       setsebool -P kerberos_enabled 1
172
173
174
175       If  you  want  to  allow  system  to run with NIS, you must turn on the
176       nis_enabled boolean. Disabled by default.
177
178       setsebool -P nis_enabled 1
179
180
181
182       If you want to allow confined applications to use nscd  shared  memory,
183       you must turn on the nscd_use_shm boolean. Disabled by default.
184
185       setsebool -P nscd_use_shm 1
186
187
188

MANAGED FILES

190       The  SELinux  process  type  nagios_t can manage files labeled with the
191       following file types.  The paths listed are the default paths for these
192       file types.  Note the processes UID still need to have DAC permissions.
193
194       cluster_conf_t
195
196            /etc/cluster(/.*)?
197
198       cluster_var_lib_t
199
200            /var/lib/pcsd(/.*)?
201            /var/lib/cluster(/.*)?
202            /var/lib/openais(/.*)?
203            /var/lib/pengine(/.*)?
204            /var/lib/corosync(/.*)?
205            /usr/lib/heartbeat(/.*)?
206            /var/lib/heartbeat(/.*)?
207            /var/lib/pacemaker(/.*)?
208
209       cluster_var_run_t
210
211            /var/run/crm(/.*)?
212            /var/run/cman_.*
213            /var/run/rsctmp(/.*)?
214            /var/run/aisexec.*
215            /var/run/heartbeat(/.*)?
216            /var/run/corosync-qnetd(/.*)?
217            /var/run/corosync-qdevice(/.*)?
218            /var/run/cpglockd.pid
219            /var/run/corosync.pid
220            /var/run/rgmanager.pid
221            /var/run/cluster/rgmanager.sk
222
223       faillog_t
224
225            /var/log/btmp.*
226            /var/log/faillog.*
227            /var/log/tallylog.*
228            /var/run/faillock(/.*)?
229
230       lastlog_t
231
232            /var/log/lastlog.*
233
234       nagios_log_t
235
236            /var/log/nagios(/.*)?
237            /var/log/icinga(/.*)?
238            /var/log/netsaint(/.*)?
239            /var/log/pnp4nagios(/.*)?
240
241       nagios_spool_t
242
243            /var/spool/nagios(/.*)?
244            /var/spool/icinga(/.*)?
245
246       nagios_tmp_t
247
248
249       nagios_var_lib_t
250
251            /var/lib/pnp4nagios(/.*)?
252            /usr/lib/pnp4nagios(/.*)?
253
254       nagios_var_run_t
255
256            /var/run/nagios.*
257
258       nfs_t
259
260
261       root_t
262
263            /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
264            /
265            /initrd
266
267       security_t
268
269            /selinux
270
271       sudo_db_t
272
273            /var/db/sudo(/.*)?
274
275       systemd_passwd_var_run_t
276
277            /var/run/systemd/ask-password(/.*)?
278            /var/run/systemd/ask-password-block(/.*)?
279
280

FILE CONTEXTS

282       SELinux requires files to have an extended attribute to define the file
283       type.
284
285       You can see the context of a file using the -Z option to ls
286
287       Policy governs the access  confined  processes  have  to  these  files.
288       SELinux  nagios  policy  is very flexible allowing users to setup their
289       nagios processes in as secure a method as possible.
290
291       STANDARD FILE CONTEXT
292
293       SELinux defines the file context types for the nagios, if you wanted to
294       store  files  with  these types in a diffent paths, you need to execute
295       the semanage command  to  sepecify  alternate  labeling  and  then  use
296       restorecon to put the labels on disk.
297
298       semanage fcontext -a -t nagios_var_run_t '/srv/mynagios_content(/.*)?'
299       restorecon -R -v /srv/mynagios_content
300
301       Note:  SELinux  often  uses  regular expressions to specify labels that
302       match multiple files.
303
304       The following file types are defined for nagios:
305
306
307
308       nagios_admin_plugin_exec_t
309
310       - Set files with the nagios_admin_plugin_exec_t type, if  you  want  to
311       transition an executable to the nagios_admin_plugin_t domain.
312
313
314
315       nagios_checkdisk_plugin_exec_t
316
317       -  Set  files with the nagios_checkdisk_plugin_exec_t type, if you want
318       to transition an executable to the nagios_checkdisk_plugin_t domain.
319
320
321       Paths:
322            /usr/lib/nagios/plugins/check_disk,          /usr/lib/nagios/plug‐
323            ins/check_disk_smb,       /usr/lib/nagios/plugins/check_ide_smart,
324            /usr/lib/nagios/plugins/check_linux_raid
325
326
327       nagios_content_t
328
329       - Set files with the nagios_content_t type, if you want  to  treat  the
330       files as nagios content.
331
332
333
334       nagios_etc_t
335
336       -  Set  files  with  the nagios_etc_t type, if you want to store nagios
337       files in the /etc directories.
338
339
340       Paths:
341            /etc/nagios(/.*)?, /etc/icinga(/.*)?, /etc/pnp4nagios(/.*)?
342
343
344       nagios_eventhandler_plugin_exec_t
345
346       - Set files with the  nagios_eventhandler_plugin_exec_t  type,  if  you
347       want  to  transition  an executable to the nagios_eventhandler_plugin_t
348       domain.
349
350
351       Paths:
352            /usr/lib/nagios/plugins/eventhandlers(/.*),  /usr/lib/icinga/plug‐
353            ins/eventhandlers(/.*)
354
355
356       nagios_eventhandler_plugin_tmp_t
357
358       - Set files with the nagios_eventhandler_plugin_tmp_t type, if you want
359       to store nagios eventhandler plugin temporary files in the /tmp  direc‐
360       tories.
361
362
363
364       nagios_exec_t
365
366       -  Set  files with the nagios_exec_t type, if you want to transition an
367       executable to the nagios_t domain.
368
369
370       Paths:
371            /usr/bin/nagios,        /usr/bin/icinga,         /usr/sbin/nagios,
372            /usr/sbin/icinga
373
374
375       nagios_htaccess_t
376
377       -  Set  files with the nagios_htaccess_t type, if you want to treat the
378       file as a nagios access file.
379
380
381
382       nagios_initrc_exec_t
383
384       - Set files with the nagios_initrc_exec_t type, if you want to  transi‐
385       tion an executable to the nagios_initrc_t domain.
386
387
388       Paths:
389            /etc/rc.d/init.d/nrpe, /etc/rc.d/init.d/nagios
390
391
392       nagios_log_t
393
394       -  Set  files with the nagios_log_t type, if you want to treat the data
395       as nagios log data, usually stored under the /var/log directory.
396
397
398       Paths:
399            /var/log/nagios(/.*)?,    /var/log/icinga(/.*)?,     /var/log/net‐
400            saint(/.*)?, /var/log/pnp4nagios(/.*)?
401
402
403       nagios_mail_plugin_exec_t
404
405       -  Set  files  with  the nagios_mail_plugin_exec_t type, if you want to
406       transition an executable to the nagios_mail_plugin_t domain.
407
408
409
410       nagios_openshift_plugin_exec_t
411
412       - Set files with the nagios_openshift_plugin_exec_t type, if  you  want
413       to transition an executable to the nagios_openshift_plugin_t domain.
414
415
416       Paths:
417            /usr/lib64/nagios/plugins/check_node_accept_status,
418            /usr/lib64/nagios/plugins/check_number_openshift_apps
419
420
421       nagios_openshift_plugin_tmp_t
422
423       - Set files with the nagios_openshift_plugin_tmp_t type, if you want to
424       store nagios openshift plugin temporary files in the /tmp directories.
425
426
427
428       nagios_ra_content_t
429
430       - Set files with the nagios_ra_content_t type, if you want to treat the
431       files as nagios  read/append content.
432
433
434
435       nagios_rw_content_t
436
437       - Set files with the nagios_rw_content_t type, if you want to treat the
438       files as nagios read/write content.
439
440
441
442       nagios_script_exec_t
443
444       -  Set files with the nagios_script_exec_t type, if you want to transi‐
445       tion an executable to the nagios_script_t domain.
446
447
448       Paths:
449            /usr/lib/nagios/cgi(/.*)?,              /usr/lib/icinga/cgi(/.*)?,
450            /usr/lib/cgi-bin/nagios(/.+)?,      /usr/lib/nagios/cgi-bin(/.*)?,
451            /usr/lib/cgi-bin/netsaint(/.*)?
452
453
454       nagios_services_plugin_exec_t
455
456       - Set files with the nagios_services_plugin_exec_t type, if you want to
457       transition an executable to the nagios_services_plugin_t domain.
458
459
460       Paths:
461            /usr/lib(64)?/nagios/plugins/check_nt,  /usr/lib(64)?/nagios/plug‐
462            ins/check_dig,             /usr/lib(64)?/nagios/plugins/check_dns,
463            /usr/lib(64)?/nagios/plugins/check_rpc, /usr/lib(64)?/nagios/plug‐
464            ins/check_tcp,             /usr/lib(64)?/nagios/plugins/check_sip,
465            /usr/lib(64)?/nagios/plugins/check_ssh, /usr/lib(64)?/nagios/plug‐
466            ins/check_ups,            /usr/lib(64)?/nagios/plugins/check_dhcp,
467            /usr/lib(64)?/nagios/plugins/check_game,
468            /usr/lib(64)?/nagios/plugins/check_hpjd,
469            /usr/lib(64)?/nagios/plugins/check_http,
470            /usr/lib(64)?/nagios/plugins/check_icmp,
471            /usr/lib(64)?/nagios/plugins/check_ircd,
472            /usr/lib(64)?/nagios/plugins/check_ldap,
473            /usr/lib(64)?/nagios/plugins/check_nrpe,
474            /usr/lib(64)?/nagios/plugins/check_ping,
475            /usr/lib(64)?/nagios/plugins/check_real,
476            /usr/lib(64)?/nagios/plugins/check_time,
477            /usr/lib(64)?/nagios/plugins/check_smtp,
478            /usr/lib(64)?/nagios/plugins/check_dummy,
479            /usr/lib(64)?/nagios/plugins/check_fping,
480            /usr/lib(64)?/nagios/plugins/check_mysql,
481            /usr/lib(64)?/nagios/plugins/check_ntp.*,
482            /usr/lib(64)?/nagios/plugins/check_pgsql,
483            /usr/lib(64)?/nagios/plugins/check_breeze,
484            /usr/lib(64)?/nagios/plugins/check_oracle,
485            /usr/lib(64)?/nagios/plugins/check_radius,
486            /usr/lib(64)?/nagios/plugins/check_snmp.*,
487            /usr/lib(64)?/nagios/plugins/check_cluster,
488            /usr/lib(64)?/nagios/plugins/check_mysql_query
489
490
491       nagios_spool_t
492
493       - Set files with the nagios_spool_t type, if  you  want  to  store  the
494       nagios files under the /var/spool directory.
495
496
497       Paths:
498            /var/spool/nagios(/.*)?, /var/spool/icinga(/.*)?
499
500
501       nagios_system_plugin_exec_t
502
503       -  Set  files with the nagios_system_plugin_exec_t type, if you want to
504       transition an executable to the nagios_system_plugin_t domain.
505
506
507       Paths:
508            /usr/lib(64)?/nagios/plugins/check_log, /usr/lib(64)?/nagios/plug‐
509            ins/check_load,           /usr/lib(64)?/nagios/plugins/check_mrtg,
510            /usr/lib(64)?/nagios/plugins/check_swap,
511            /usr/lib(64)?/nagios/plugins/check_wave,
512            /usr/lib(64)?/nagios/plugins/check_procs,
513            /usr/lib(64)?/nagios/plugins/check_users,
514            /usr/lib(64)?/nagios/plugins/check_flexlm,
515            /usr/lib(64)?/nagios/plugins/check_nagios,
516            /usr/lib(64)?/nagios/plugins/check_nwstat,
517            /usr/lib(64)?/nagios/plugins/check_overcr,
518            /usr/lib(64)?/nagios/plugins/check_sensors,
519            /usr/lib(64)?/nagios/plugins/check_ifstatus,
520            /usr/lib(64)?/nagios/plugins/check_mrtgtraf,
521            /usr/lib(64)?/nagios/plugins/check_ifoperstatus
522
523
524       nagios_system_plugin_tmp_t
525
526       -  Set  files  with the nagios_system_plugin_tmp_t type, if you want to
527       store nagios system plugin temporary files in the /tmp directories.
528
529
530
531       nagios_tmp_t
532
533       - Set files with the nagios_tmp_t type, if you  want  to  store  nagios
534       temporary files in the /tmp directories.
535
536
537
538       nagios_unconfined_plugin_exec_t
539
540       -  Set files with the nagios_unconfined_plugin_exec_t type, if you want
541       to transition an executable to the nagios_unconfined_plugin_t domain.
542
543
544
545       nagios_var_lib_t
546
547       - Set files with the nagios_var_lib_t type, if you want  to  store  the
548       nagios files under the /var/lib directory.
549
550
551       Paths:
552            /var/lib/pnp4nagios(/.*)?, /usr/lib/pnp4nagios(/.*)?
553
554
555       nagios_var_run_t
556
557       -  Set  files  with the nagios_var_run_t type, if you want to store the
558       nagios files under the /run or /var/run directory.
559
560
561
562       Note: File context can be temporarily modified with the chcon  command.
563       If  you want to permanently change the file context you need to use the
564       semanage fcontext command.  This will modify the SELinux labeling data‐
565       base.  You will need to use restorecon to apply the labels.
566
567

COMMANDS

569       semanage  fcontext  can also be used to manipulate default file context
570       mappings.
571
572       semanage permissive can also be used to manipulate  whether  or  not  a
573       process type is permissive.
574
575       semanage  module can also be used to enable/disable/install/remove pol‐
576       icy modules.
577
578       semanage boolean can also be used to manipulate the booleans
579
580
581       system-config-selinux is a GUI tool available to customize SELinux pol‐
582       icy settings.
583
584

AUTHOR

586       This manual page was auto-generated using sepolicy manpage .
587
588