ricci_selinux(8)

1ricci_selinux(8)             SELinux Policy ricci             ricci_selinux(8)
2
3
4

NAME

6       ricci_selinux - Security Enhanced Linux Policy for the ricci processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the ricci processes via flexible manda‐
10       tory access control.
11
12       The ricci processes execute with the  ricci_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ricci_t
19
20
21

ENTRYPOINTS

23       The ricci_t SELinux type can be entered via  the  ricci_exec_t,  usr_t,
24       bin_t file types.
25
26       The default entrypoint paths for the ricci_t domain are the following:
27
28       All  executeables  with the default executable label, usually stored in
29       /usr/bin and /usr/sbin.  /usr/sbin/ricci, /usr/.*,  /opt/.*,  /emul/.*,
30       /ostree(/.*)?,         /export(/.*)?,         /usr/doc(/.*)?/lib(/.*)?,
31       /usr/inclu.e(/.*)?, /usr/share/doc(/.*)?/README.*, /usr, /opt, /emul
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       ricci policy is very flexible allowing users to setup their ricci  pro‐
41       cesses in as secure a method as possible.
42
43       The following process types are defined for ricci:
44
45       ricci_t, ricci_modcluster_t, ricci_modclusterd_t, ricci_modlog_t, ricci_modrpm_t, ricci_modservice_t, ricci_modstorage_t
46
47       Note:  semanage  permissive  -a ricci_t can be used to make the process
48       type ricci_t permissive. SELinux does not  deny  access  to  permissive
49       process  types, but the AVC (SELinux denials) messages are still gener‐
50       ated.
51
52

BOOLEANS

54       SELinux policy is customizable based on least access  required.   ricci
55       policy is extremely flexible and has several booleans that allow you to
56       manipulate the policy and run ricci with the tightest access possible.
57
58
59
60       If you want to allow users to resolve user passwd entries directly from
61       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
62       gin_nsswitch_use_ldap boolean. Disabled by default.
63
64       setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68       If you want to allow all daemons to write corefiles to /, you must turn
69       on the daemons_dump_core boolean. Disabled by default.
70
71       setsebool -P daemons_dump_core 1
72
73
74
75       If  you  want  to enable cluster mode for daemons, you must turn on the
76       daemons_enable_cluster_mode boolean. Enabled by default.
77
78       setsebool -P daemons_enable_cluster_mode 1
79
80
81
82       If you want to allow all daemons to use tcp wrappers, you must turn  on
83       the daemons_use_tcp_wrapper boolean. Disabled by default.
84
85       setsebool -P daemons_use_tcp_wrapper 1
86
87
88
89       If  you  want to allow all daemons the ability to read/write terminals,
90       you must turn on the daemons_use_tty boolean. Disabled by default.
91
92       setsebool -P daemons_use_tty 1
93
94
95
96       If you want to deny any process from ptracing or  debugging  any  other
97       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
98       default.
99
100       setsebool -P deny_ptrace 1
101
102
103
104       If you want to allow any process  to  mmap  any  file  on  system  with
105       attribute  file_type,  you must turn on the domain_can_mmap_files bool‐
106       ean. Enabled by default.
107
108       setsebool -P domain_can_mmap_files 1
109
110
111
112       If you want to allow all domains write to kmsg_device, while kernel  is
113       executed  with  systemd.log_target=kmsg parameter, you must turn on the
114       domain_can_write_kmsg boolean. Disabled by default.
115
116       setsebool -P domain_can_write_kmsg 1
117
118
119
120       If you want to allow all domains to use other domains file descriptors,
121       you must turn on the domain_fd_use boolean. Enabled by default.
122
123       setsebool -P domain_fd_use 1
124
125
126
127       If  you  want to allow all domains to have the kernel load modules, you
128       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
129       default.
130
131       setsebool -P domain_kernel_load_modules 1
132
133
134
135       If you want to allow all domains to execute in fips_mode, you must turn
136       on the fips_mode boolean. Enabled by default.
137
138       setsebool -P fips_mode 1
139
140
141
142       If you want to enable reading of urandom for all domains, you must turn
143       on the global_ssp boolean. Disabled by default.
144
145       setsebool -P global_ssp 1
146
147
148
149       If  you  want  to allow confined applications to run with kerberos, you
150       must turn on the kerberos_enabled boolean. Enabled by default.
151
152       setsebool -P kerberos_enabled 1
153
154
155
156       If you want to allow system to run with  NIS,  you  must  turn  on  the
157       nis_enabled boolean. Disabled by default.
158
159       setsebool -P nis_enabled 1
160
161
162
163       If  you  want to allow confined applications to use nscd shared memory,
164       you must turn on the nscd_use_shm boolean. Disabled by default.
165
166       setsebool -P nscd_use_shm 1
167
168
169

PORT TYPES

171       SELinux defines port types to represent TCP and UDP ports.
172
173       You can see the types associated with a port  by  using  the  following
174       command:
175
176       semanage port -l
177
178
179       Policy  governs  the  access  confined  processes  have to these ports.
180       SELinux ricci policy is very flexible allowing  users  to  setup  their
181       ricci processes in as secure a method as possible.
182
183       The following port types are defined for ricci:
184
185
186       ricci_modcluster_port_t
187
188
189
190       Default Defined Ports:
191                 tcp 16851
192                 udp 16851
193
194
195       ricci_port_t
196
197
198
199       Default Defined Ports:
200                 tcp 11111
201                 udp 11111
202

MANAGED FILES

204       The SELinux process type ricci_t can manage files labeled with the fol‐
205       lowing file types.  The paths listed are the default  paths  for  these
206       file types.  Note the processes UID still need to have DAC permissions.
207
208       cluster_conf_t
209
210            /etc/cluster(/.*)?
211
212       cluster_var_lib_t
213
214            /var/lib/pcsd(/.*)?
215            /var/lib/cluster(/.*)?
216            /var/lib/openais(/.*)?
217            /var/lib/pengine(/.*)?
218            /var/lib/corosync(/.*)?
219            /usr/lib/heartbeat(/.*)?
220            /var/lib/heartbeat(/.*)?
221            /var/lib/pacemaker(/.*)?
222
223       cluster_var_run_t
224
225            /var/run/crm(/.*)?
226            /var/run/cman_.*
227            /var/run/rsctmp(/.*)?
228            /var/run/aisexec.*
229            /var/run/heartbeat(/.*)?
230            /var/run/corosync-qnetd(/.*)?
231            /var/run/corosync-qdevice(/.*)?
232            /var/run/cpglockd.pid
233            /var/run/corosync.pid
234            /var/run/rgmanager.pid
235            /var/run/cluster/rgmanager.sk
236
237       etc_runtime_t
238
239            /[^/]+
240            /etc/mtab.*
241            /etc/blkid(/.*)?
242            /etc/nologin.*
243            /etc/.fstab.hal..+
244            /halt
245            /fastboot
246            /poweroff
247            /etc/cmtab
248            /forcefsck
249            /.autofsck
250            /.suspended
251            /fsckoptions
252            /var/.updated
253            /etc/.updated
254            /.autorelabel
255            /etc/securetty
256            /etc/nohotplug
257            /etc/killpower
258            /etc/ioctl.save
259            /etc/fstab.REVOKE
260            /etc/network/ifstate
261            /etc/sysconfig/hwconf
262            /etc/ptal/ptal-printd-like
263            /etc/sysconfig/iptables.save
264            /etc/xorg.conf.d/00-system-setup-keyboard.conf
265            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
266
267       faillog_t
268
269            /var/log/btmp.*
270            /var/log/faillog.*
271            /var/log/tallylog.*
272            /var/run/faillock(/.*)?
273
274       ricci_tmp_t
275
276
277       ricci_var_lib_t
278
279            /var/lib/ricci(/.*)?
280
281       ricci_var_run_t
282
283            /var/run/ricci.pid
284
285       root_t
286
287            /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
288            /
289            /initrd
290
291       systemd_passwd_var_run_t
292
293            /var/run/systemd/ask-password(/.*)?
294            /var/run/systemd/ask-password-block(/.*)?
295
296

FILE CONTEXTS

298       SELinux requires files to have an extended attribute to define the file
299       type.
300
301       You can see the context of a file using the -Z option to ls
302
303       Policy governs the access  confined  processes  have  to  these  files.
304       SELinux  ricci  policy  is  very flexible allowing users to setup their
305       ricci processes in as secure a method as possible.
306
307       STANDARD FILE CONTEXT
308
309       SELinux defines the file context types for the ricci, if you wanted  to
310       store  files  with  these types in a diffent paths, you need to execute
311       the semanage command  to  sepecify  alternate  labeling  and  then  use
312       restorecon to put the labels on disk.
313
314       semanage fcontext -a -t ricci_var_run_t '/srv/myricci_content(/.*)?'
315       restorecon -R -v /srv/myricci_content
316
317       Note:  SELinux  often  uses  regular expressions to specify labels that
318       match multiple files.
319
320       The following file types are defined for ricci:
321
322
323
324       ricci_exec_t
325
326       - Set files with the ricci_exec_t type, if you want  to  transition  an
327       executable to the ricci_t domain.
328
329
330
331       ricci_initrc_exec_t
332
333       -  Set  files with the ricci_initrc_exec_t type, if you want to transi‐
334       tion an executable to the ricci_initrc_t domain.
335
336
337
338       ricci_modcluster_exec_t
339
340       - Set files with the ricci_modcluster_exec_t type, if you want to tran‐
341       sition an executable to the ricci_modcluster_t domain.
342
343
344
345       ricci_modcluster_var_lib_t
346
347       -  Set  files  with the ricci_modcluster_var_lib_t type, if you want to
348       store the ricci modcluster files under the /var/lib directory.
349
350
351
352       ricci_modcluster_var_log_t
353
354       - Set files with the ricci_modcluster_var_log_t type, if  you  want  to
355       treat  the  data as ricci modcluster var log data, usually stored under
356       the /var/log directory.
357
358
359
360       ricci_modcluster_var_run_t
361
362       - Set files with the ricci_modcluster_var_run_t type, if  you  want  to
363       store the ricci modcluster files under the /run or /var/run directory.
364
365
366       Paths:
367            /var/run/clumond.sock, /var/run/modclusterd.pid
368
369
370       ricci_modclusterd_exec_t
371
372       -  Set  files  with  the  ricci_modclusterd_exec_t type, if you want to
373       transition an executable to the ricci_modclusterd_t domain.
374
375
376
377       ricci_modclusterd_tmpfs_t
378
379       - Set files with the ricci_modclusterd_tmpfs_t type,  if  you  want  to
380       store ricci modclusterd files on a tmpfs file system.
381
382
383
384       ricci_modlog_exec_t
385
386       -  Set  files with the ricci_modlog_exec_t type, if you want to transi‐
387       tion an executable to the ricci_modlog_t domain.
388
389
390
391       ricci_modrpm_exec_t
392
393       - Set files with the ricci_modrpm_exec_t type, if you want  to  transi‐
394       tion an executable to the ricci_modrpm_t domain.
395
396
397
398       ricci_modservice_exec_t
399
400       - Set files with the ricci_modservice_exec_t type, if you want to tran‐
401       sition an executable to the ricci_modservice_t domain.
402
403
404
405       ricci_modstorage_exec_t
406
407       - Set files with the ricci_modstorage_exec_t type, if you want to tran‐
408       sition an executable to the ricci_modstorage_t domain.
409
410
411
412       ricci_modstorage_lock_t
413
414       - Set files with the ricci_modstorage_lock_t type, if you want to treat
415       the files as ricci modstorage lock data,  stored  under  the  /var/lock
416       directory
417
418
419
420       ricci_tmp_t
421
422       -  Set files with the ricci_tmp_t type, if you want to store ricci tem‐
423       porary files in the /tmp directories.
424
425
426
427       ricci_var_lib_t
428
429       - Set files with the ricci_var_lib_t type, if you  want  to  store  the
430       ricci files under the /var/lib directory.
431
432
433
434       ricci_var_log_t
435
436       -  Set  files  with  the ricci_var_log_t type, if you want to treat the
437       data as ricci var log data, usually stored under  the  /var/log  direc‐
438       tory.
439
440
441
442       ricci_var_run_t
443
444       -  Set  files  with  the ricci_var_run_t type, if you want to store the
445       ricci files under the /run or /var/run directory.
446
447
448
449       Note: File context can be temporarily modified with the chcon  command.
450       If  you want to permanently change the file context you need to use the
451       semanage fcontext command.  This will modify the SELinux labeling data‐
452       base.  You will need to use restorecon to apply the labels.
453
454

COMMANDS

456       semanage  fcontext  can also be used to manipulate default file context
457       mappings.
458
459       semanage permissive can also be used to manipulate  whether  or  not  a
460       process type is permissive.
461
462       semanage  module can also be used to enable/disable/install/remove pol‐
463       icy modules.
464
465       semanage port can also be used to manipulate the port definitions
466
467       semanage boolean can also be used to manipulate the booleans
468
469
470       system-config-selinux is a GUI tool available to customize SELinux pol‐
471       icy settings.
472
473

AUTHOR

475       This manual page was auto-generated using sepolicy manpage .
476
477