zabbix_selinux(8)

1zabbix_selinux(8)            SELinux Policy zabbix           zabbix_selinux(8)
2
3
4

NAME

6       zabbix_selinux  -  Security  Enhanced  Linux Policy for the zabbix pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  zabbix  processes  via  flexible
11       mandatory access control.
12
13       The  zabbix  processes  execute with the zabbix_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep zabbix_t
20
21
22

ENTRYPOINTS

24       The  zabbix_t  SELinux  type  can be entered via the zabbix_exec_t file
25       type.
26
27       The default entrypoint paths for the zabbix_t domain are the following:
28
29       /usr/bin/zabbix_server,     /usr/sbin/zabbix_proxy,      /usr/sbin/zab‐
30       bix_server, /usr/sbin/zabbix_proxy_mysql, /usr/sbin/zabbix_proxy_pgsql,
31       /usr/sbin/zabbix_server_mysql,           /usr/sbin/zabbix_server_pgsql,
32       /usr/sbin/zabbix_proxy_sqlite3, /usr/sbin/zabbix_server_sqlite3
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       zabbix  policy  is  very  flexible allowing users to setup their zabbix
42       processes in as secure a method as possible.
43
44       The following process types are defined for zabbix:
45
46       zabbix_t, zabbix_agent_t, zabbix_script_t
47
48       Note: semanage permissive -a zabbix_t can be used to make  the  process
49       type  zabbix_t  permissive.  SELinux does not deny access to permissive
50       process types, but the AVC (SELinux denials) messages are still  gener‐
51       ated.
52
53

BOOLEANS

55       SELinux  policy is customizable based on least access required.  zabbix
56       policy is extremely flexible and has several booleans that allow you to
57       manipulate the policy and run zabbix with the tightest access possible.
58
59
60
61       If  you  want to determine whether zabbix can connect to all TCP ports,
62       you must turn on the zabbix_can_network boolean. Disabled by default.
63
64       setsebool -P zabbix_can_network 1
65
66
67
68       If you want to allow Zabbix to run su/sudo, you must turn on  the  zab‐
69       bix_run_sudo boolean. Disabled by default.
70
71       setsebool -P zabbix_run_sudo 1
72
73
74
75       If you want to allow users to resolve user passwd entries directly from
76       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
77       gin_nsswitch_use_ldap boolean. Disabled by default.
78
79       setsebool -P authlogin_nsswitch_use_ldap 1
80
81
82
83       If you want to allow all daemons to write corefiles to /, you must turn
84       on the daemons_dump_core boolean. Disabled by default.
85
86       setsebool -P daemons_dump_core 1
87
88
89
90       If you want to enable cluster mode for daemons, you must  turn  on  the
91       daemons_enable_cluster_mode boolean. Enabled by default.
92
93       setsebool -P daemons_enable_cluster_mode 1
94
95
96
97       If  you want to allow all daemons to use tcp wrappers, you must turn on
98       the daemons_use_tcp_wrapper boolean. Disabled by default.
99
100       setsebool -P daemons_use_tcp_wrapper 1
101
102
103
104       If you want to allow all daemons the ability to  read/write  terminals,
105       you must turn on the daemons_use_tty boolean. Disabled by default.
106
107       setsebool -P daemons_use_tty 1
108
109
110
111       If  you  want  to deny any process from ptracing or debugging any other
112       processes, you  must  turn  on  the  deny_ptrace  boolean.  Enabled  by
113       default.
114
115       setsebool -P deny_ptrace 1
116
117
118
119       If  you  want  to  allow  any  process  to mmap any file on system with
120       attribute file_type, you must turn on the  domain_can_mmap_files  bool‐
121       ean. Enabled by default.
122
123       setsebool -P domain_can_mmap_files 1
124
125
126
127       If  you want to allow all domains write to kmsg_device, while kernel is
128       executed with systemd.log_target=kmsg parameter, you must turn  on  the
129       domain_can_write_kmsg boolean. Disabled by default.
130
131       setsebool -P domain_can_write_kmsg 1
132
133
134
135       If you want to allow all domains to use other domains file descriptors,
136       you must turn on the domain_fd_use boolean. Enabled by default.
137
138       setsebool -P domain_fd_use 1
139
140
141
142       If you want to allow all domains to have the kernel load  modules,  you
143       must  turn  on  the  domain_kernel_load_modules  boolean.  Disabled  by
144       default.
145
146       setsebool -P domain_kernel_load_modules 1
147
148
149
150       If you want to allow all domains to execute in fips_mode, you must turn
151       on the fips_mode boolean. Enabled by default.
152
153       setsebool -P fips_mode 1
154
155
156
157       If you want to enable reading of urandom for all domains, you must turn
158       on the global_ssp boolean. Disabled by default.
159
160       setsebool -P global_ssp 1
161
162
163
164       If you want to allow confined applications to run  with  kerberos,  you
165       must turn on the kerberos_enabled boolean. Enabled by default.
166
167       setsebool -P kerberos_enabled 1
168
169
170
171       If  you  want  to  allow  system  to run with NIS, you must turn on the
172       nis_enabled boolean. Disabled by default.
173
174       setsebool -P nis_enabled 1
175
176
177
178       If you want to allow confined applications to use nscd  shared  memory,
179       you must turn on the nscd_use_shm boolean. Disabled by default.
180
181       setsebool -P nscd_use_shm 1
182
183
184

PORT TYPES

186       SELinux defines port types to represent TCP and UDP ports.
187
188       You  can  see  the  types associated with a port by using the following
189       command:
190
191       semanage port -l
192
193
194       Policy governs the access  confined  processes  have  to  these  ports.
195       SELinux  zabbix  policy  is very flexible allowing users to setup their
196       zabbix processes in as secure a method as possible.
197
198       The following port types are defined for zabbix:
199
200
201       zabbix_agent_port_t
202
203
204
205       Default Defined Ports:
206                 tcp 10050
207
208
209       zabbix_port_t
210
211
212
213       Default Defined Ports:
214                 tcp 10051
215

MANAGED FILES

217       The SELinux process type zabbix_t can manage  files  labeled  with  the
218       following file types.  The paths listed are the default paths for these
219       file types.  Note the processes UID still need to have DAC permissions.
220
221       cluster_conf_t
222
223            /etc/cluster(/.*)?
224
225       cluster_var_lib_t
226
227            /var/lib/pcsd(/.*)?
228            /var/lib/cluster(/.*)?
229            /var/lib/openais(/.*)?
230            /var/lib/pengine(/.*)?
231            /var/lib/corosync(/.*)?
232            /usr/lib/heartbeat(/.*)?
233            /var/lib/heartbeat(/.*)?
234            /var/lib/pacemaker(/.*)?
235
236       cluster_var_run_t
237
238            /var/run/crm(/.*)?
239            /var/run/cman_.*
240            /var/run/rsctmp(/.*)?
241            /var/run/aisexec.*
242            /var/run/heartbeat(/.*)?
243            /var/run/corosync-qnetd(/.*)?
244            /var/run/corosync-qdevice(/.*)?
245            /var/run/cpglockd.pid
246            /var/run/corosync.pid
247            /var/run/rgmanager.pid
248            /var/run/cluster/rgmanager.sk
249
250       faillog_t
251
252            /var/log/btmp.*
253            /var/log/faillog.*
254            /var/log/tallylog.*
255            /var/run/faillock(/.*)?
256
257       lastlog_t
258
259            /var/log/lastlog.*
260
261       root_t
262
263            /sysroot/ostree/deploy/.*-atomic.*/deploy(/.*)?
264            /
265            /initrd
266
267       security_t
268
269            /selinux
270
271       zabbix_log_t
272
273            /var/log/zabbix.*
274
275       zabbix_tmp_t
276
277
278       zabbix_tmpfs_t
279
280
281       zabbix_var_lib_t
282
283            /var/lib/zabbix(/.*)?
284            /var/lib/zabbixsrv(/.*)?
285
286       zabbix_var_run_t
287
288            /var/run/zabbix(/.*)?
289
290

FILE CONTEXTS

292       SELinux requires files to have an extended attribute to define the file
293       type.
294
295       You can see the context of a file using the -Z option to ls
296
297       Policy  governs  the  access  confined  processes  have to these files.
298       SELinux zabbix policy is very flexible allowing users  to  setup  their
299       zabbix processes in as secure a method as possible.
300
301       EQUIVALENCE DIRECTORIES
302
303
304       zabbix  policy  stores  data with multiple different file context types
305       under the /var/lib/zabbix directory.  If you would like  to  store  the
306       data  in a different directory you can use the semanage command to cre‐
307       ate an equivalence mapping.  If you wanted to store this data under the
308       /srv dirctory you would execute the following command:
309
310       semanage fcontext -a -e /var/lib/zabbix /srv/zabbix
311       restorecon -R -v /srv/zabbix
312
313       STANDARD FILE CONTEXT
314
315       SELinux defines the file context types for the zabbix, if you wanted to
316       store files with these types in a diffent paths, you  need  to  execute
317       the  semanage  command  to  sepecify  alternate  labeling  and then use
318       restorecon to put the labels on disk.
319
320       semanage fcontext -a -t zabbixd_var_lib_t '/srv/myzabbix_content(/.*)?'
321       restorecon -R -v /srv/myzabbix_content
322
323       Note: SELinux often uses regular expressions  to  specify  labels  that
324       match multiple files.
325
326       The following file types are defined for zabbix:
327
328
329
330       zabbix_agent_exec_t
331
332       -  Set  files with the zabbix_agent_exec_t type, if you want to transi‐
333       tion an executable to the zabbix_agent_t domain.
334
335
336       Paths:
337            /usr/bin/zabbix_agentd, /usr/sbin/zabbix_agentd
338
339
340       zabbix_agent_initrc_exec_t
341
342       - Set files with the zabbix_agent_initrc_exec_t type, if  you  want  to
343       transition an executable to the zabbix_agent_initrc_t domain.
344
345
346
347       zabbix_exec_t
348
349       -  Set  files with the zabbix_exec_t type, if you want to transition an
350       executable to the zabbix_t domain.
351
352
353       Paths:
354            /usr/bin/zabbix_server,   /usr/sbin/zabbix_proxy,   /usr/sbin/zab‐
355            bix_server,      /usr/sbin/zabbix_proxy_mysql,      /usr/sbin/zab‐
356            bix_proxy_pgsql,   /usr/sbin/zabbix_server_mysql,   /usr/sbin/zab‐
357            bix_server_pgsql,  /usr/sbin/zabbix_proxy_sqlite3,  /usr/sbin/zab‐
358            bix_server_sqlite3
359
360
361       zabbix_initrc_exec_t
362
363       - Set files with the zabbix_initrc_exec_t type, if you want to  transi‐
364       tion an executable to the zabbix_initrc_t domain.
365
366
367
368       zabbix_log_t
369
370       -  Set  files with the zabbix_log_t type, if you want to treat the data
371       as zabbix log data, usually stored under the /var/log directory.
372
373
374
375       zabbix_script_exec_t
376
377       - Set files with the zabbix_script_exec_t type, if you want to  transi‐
378       tion an executable to the zabbix_script_t domain.
379
380
381       Paths:
382            /usr/lib/zabbix/externalscripts(/.*)?,      /var/lib/zabbix/exter‐
383            nalscripts(/.*)?
384
385
386       zabbix_tmp_t
387
388       - Set files with the zabbix_tmp_t type, if you  want  to  store  zabbix
389       temporary files in the /tmp directories.
390
391
392
393       zabbix_tmpfs_t
394
395       -  Set  files with the zabbix_tmpfs_t type, if you want to store zabbix
396       files on a tmpfs file system.
397
398
399
400       zabbix_var_lib_t
401
402       - Set files with the zabbix_var_lib_t type, if you want  to  store  the
403       zabbix files under the /var/lib directory.
404
405
406       Paths:
407            /var/lib/zabbix(/.*)?, /var/lib/zabbixsrv(/.*)?
408
409
410       zabbix_var_run_t
411
412       -  Set  files  with the zabbix_var_run_t type, if you want to store the
413       zabbix files under the /run or /var/run directory.
414
415
416
417       zabbixd_var_lib_t
418
419       - Set files with the zabbixd_var_lib_t type, if you want to  store  the
420       zabbixd files under the /var/lib directory.
421
422
423
424       Note:  File context can be temporarily modified with the chcon command.
425       If you want to permanently change the file context you need to use  the
426       semanage fcontext command.  This will modify the SELinux labeling data‐
427       base.  You will need to use restorecon to apply the labels.
428
429

COMMANDS

431       semanage fcontext can also be used to manipulate default  file  context
432       mappings.
433
434       semanage  permissive  can  also  be used to manipulate whether or not a
435       process type is permissive.
436
437       semanage module can also be used to enable/disable/install/remove  pol‐
438       icy modules.
439
440       semanage port can also be used to manipulate the port definitions
441
442       semanage boolean can also be used to manipulate the booleans
443
444
445       system-config-selinux is a GUI tool available to customize SELinux pol‐
446       icy settings.
447
448

AUTHOR

450       This manual page was auto-generated using sepolicy manpage .
451
452