lsassd_selinux(8)

1lsassd_selinux(8)            SELinux Policy lsassd           lsassd_selinux(8)
2
3
4

NAME

6       lsassd_selinux  -  Security  Enhanced  Linux Policy for the lsassd pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  lsassd  processes  via  flexible
11       mandatory access control.
12
13       The  lsassd  processes  execute with the lsassd_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep lsassd_t
20
21
22

ENTRYPOINTS

24       The  lsassd_t  SELinux  type  can be entered via the lsassd_exec_t file
25       type.
26
27       The default entrypoint paths for the lsassd_t domain are the following:
28
29       /usr/sbin/lsassd, /opt/likewise/sbin/lsassd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       lsassd policy is very flexible allowing users  to  setup  their  lsassd
39       processes in as secure a method as possible.
40
41       The following process types are defined for lsassd:
42
43       lsassd_t
44
45       Note:  semanage  permissive -a lsassd_t can be used to make the process
46       type lsassd_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   lsassd
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run lsassd with the tightest access possible.
55
56
57
58       If you want to allow all domains to execute in fips_mode, you must turn
59       on the fips_mode boolean. Enabled by default.
60
61       setsebool -P fips_mode 1
62
63
64
65       If  you  want  to allow confined applications to run with kerberos, you
66       must turn on the kerberos_enabled boolean. Enabled by default.
67
68       setsebool -P kerberos_enabled 1
69
70
71

MANAGED FILES

73       The SELinux process type lsassd_t can manage  files  labeled  with  the
74       following file types.  The paths listed are the default paths for these
75       file types.  Note the processes UID still need to have DAC permissions.
76
77       cluster_conf_t
78
79            /etc/cluster(/.*)?
80
81       cluster_var_lib_t
82
83            /var/lib/pcsd(/.*)?
84            /var/lib/cluster(/.*)?
85            /var/lib/openais(/.*)?
86            /var/lib/pengine(/.*)?
87            /var/lib/corosync(/.*)?
88            /usr/lib/heartbeat(/.*)?
89            /var/lib/heartbeat(/.*)?
90            /var/lib/pacemaker(/.*)?
91
92       cluster_var_run_t
93
94            /var/run/crm(/.*)?
95            /var/run/cman_.*
96            /var/run/rsctmp(/.*)?
97            /var/run/aisexec.*
98            /var/run/heartbeat(/.*)?
99            /var/run/corosync-qnetd(/.*)?
100            /var/run/corosync-qdevice(/.*)?
101            /var/run/corosync.pid
102            /var/run/cpglockd.pid
103            /var/run/rgmanager.pid
104            /var/run/cluster/rgmanager.sk
105
106       etc_runtime_t
107
108            /[^/]+
109            /etc/mtab.*
110            /etc/blkid(/.*)?
111            /etc/nologin.*
112            /etc/.fstab.hal..+
113            /halt
114            /fastboot
115            /poweroff
116            /.autofsck
117            /etc/cmtab
118            /forcefsck
119            /.suspended
120            /fsckoptions
121            /.autorelabel
122            /etc/.updated
123            /var/.updated
124            /etc/killpower
125            /etc/nohotplug
126            /etc/securetty
127            /etc/ioctl.save
128            /etc/fstab.REVOKE
129            /etc/network/ifstate
130            /etc/sysconfig/hwconf
131            /etc/ptal/ptal-printd-like
132            /etc/sysconfig/iptables.save
133            /etc/xorg.conf.d/00-system-setup-keyboard.conf
134            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
135
136       etc_t
137
138            /etc/.*
139            /usr/etc(/.*)?
140            /run/motd.d(/.*)?
141            /var/ftp/etc(/.*)?
142            /var/lib/openshift/.limits.d(/.*)?
143            /var/lib/openshift/.openshift-proxy.d(/.*)?
144            /var/lib/openshift/.stickshift-proxy.d(/.*)?
145            /var/lib/stickshift/.limits.d(/.*)?
146            /var/lib/stickshift/.stickshift-proxy.d(/.*)?
147            /etc/ipsec.d/examples(/.*)?
148            /var/named/chroot/etc(/.*)?
149            /var/spool/postfix/etc(/.*)?
150            /etc
151            /run/motd
152            /run/cockpit/motd
153            /etc/cups/client.conf
154
155       krb5_keytab_t
156
157            /etc/krb5.keytab
158            /etc/krb5kdc/kadm5.keytab
159            /var/kerberos/krb5kdc/kadm5.keytab
160
161       likewise_etc_t
162
163            /etc/likewise-open(/.*)?
164
165       lsassd_tmp_t
166
167
168       lsassd_var_lib_t
169
170            /var/lib/likewise/krb5cc.*
171            /var/lib/likewise-open/krb5cc.*
172            /var/lib/likewise/krb5ccr_lsass..*
173            /var/lib/likewise-open/krb5ccr_lsass..*
174            /var/lib/likewise/db/lsass-adcache.filedb..*
175            /var/lib/likewise-open/db/lsass-adcache.filedb..*
176            /var/lib/likewise/db/sam.db
177            /var/lib/likewise/lsasd.err
178            /var/lib/likewise/krb5ccr_lsass
179            /var/lib/likewise-open/db/sam.db
180            /var/lib/likewise-open/lsasd.err
181            /var/lib/likewise-open/krb5ccr_lsass
182            /var/lib/likewise/db/lsass-adcache.db
183            /var/lib/likewise/db/lsass-adstate.filedb
184            /var/lib/likewise-open/db/lsass-adcache.db
185            /var/lib/likewise-open/db/lsass-adstate.filedb
186
187       lsassd_var_run_t
188
189            /var/run/lsassd.pid
190
191       root_t
192
193            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
194            /
195            /initrd
196
197       security_t
198
199            /selinux
200
201       user_home_t
202
203            /home/[^/]+/.+
204
205

FILE CONTEXTS

207       SELinux requires files to have an extended attribute to define the file
208       type.
209
210       You can see the context of a file using the -Z option to ls
211
212       Policy  governs  the  access  confined  processes  have to these files.
213       SELinux lsassd policy is very flexible allowing users  to  setup  their
214       lsassd processes in as secure a method as possible.
215
216       STANDARD FILE CONTEXT
217
218       SELinux defines the file context types for the lsassd, if you wanted to
219       store files with these types in a diffent paths, you  need  to  execute
220       the  semanage  command  to  sepecify  alternate  labeling  and then use
221       restorecon to put the labels on disk.
222
223       semanage fcontext -a -t lsassd_tmp_t '/srv/mylsassd_content(/.*)?'
224       restorecon -R -v /srv/mylsassd_content
225
226       Note: SELinux often uses regular expressions  to  specify  labels  that
227       match multiple files.
228
229       The following file types are defined for lsassd:
230
231
232
233       lsassd_exec_t
234
235       -  Set  files with the lsassd_exec_t type, if you want to transition an
236       executable to the lsassd_t domain.
237
238
239       Paths:
240            /usr/sbin/lsassd, /opt/likewise/sbin/lsassd
241
242
243       lsassd_tmp_t
244
245       - Set files with the lsassd_tmp_t type, if you  want  to  store  lsassd
246       temporary files in the /tmp directories.
247
248
249
250       lsassd_var_lib_t
251
252       -  Set  files  with the lsassd_var_lib_t type, if you want to store the
253       lsassd files under the /var/lib directory.
254
255
256       Paths:
257            /var/lib/likewise/krb5cc.*,       /var/lib/likewise-open/krb5cc.*,
258            /var/lib/likewise/krb5ccr_lsass..*,             /var/lib/likewise-
259            open/krb5ccr_lsass..*,                 /var/lib/likewise/db/lsass-
260            adcache.filedb..*,                /var/lib/likewise-open/db/lsass-
261            adcache.filedb..*,   /var/lib/likewise/db/sam.db,   /var/lib/like‐
262            wise/lsasd.err,   /var/lib/likewise/krb5ccr_lsass,  /var/lib/like‐
263            wise-open/db/sam.db,             /var/lib/likewise-open/lsasd.err,
264            /var/lib/likewise-open/krb5ccr_lsass,  /var/lib/likewise/db/lsass-
265            adcache.db,             /var/lib/likewise/db/lsass-adstate.filedb,
266            /var/lib/likewise-open/db/lsass-adcache.db,     /var/lib/likewise-
267            open/db/lsass-adstate.filedb
268
269
270       lsassd_var_run_t
271
272       - Set files with the lsassd_var_run_t type, if you want  to  store  the
273       lsassd files under the /run or /var/run directory.
274
275
276
277       lsassd_var_socket_t
278
279       - Set files with the lsassd_var_socket_t type, if you want to treat the
280       files as lsassd var socket data.
281
282
283       Paths:
284            /var/lib/likewise/.ntlmd,               /var/lib/likewise/.lsassd,
285            /var/lib/likewise/rpc/lsass,        /var/lib/likewise-open/.ntlmd,
286            /var/lib/likewise-open/.lsassd, /var/lib/likewise-open/rpc/lsass
287
288
289       Note: File context can be temporarily modified with the chcon  command.
290       If  you want to permanently change the file context you need to use the
291       semanage fcontext command.  This will modify the SELinux labeling data‐
292       base.  You will need to use restorecon to apply the labels.
293
294

COMMANDS

296       semanage  fcontext  can also be used to manipulate default file context
297       mappings.
298
299       semanage permissive can also be used to manipulate  whether  or  not  a
300       process type is permissive.
301
302       semanage  module can also be used to enable/disable/install/remove pol‐
303       icy modules.
304
305       semanage boolean can also be used to manipulate the booleans
306
307
308       system-config-selinux is a GUI tool available to customize SELinux pol‐
309       icy settings.
310
311

AUTHOR

313       This manual page was auto-generated using sepolicy manpage .
314
315