1openshift_domain_selinux(S8E)Linux Policy openshift_domoapiennshift_domain_selinux(8)
2
3
4
6 openshift_domain_selinux - Security Enhanced Linux Policy for the open‐
7 shift_domain processes
8
10 Security-Enhanced Linux secures the openshift_domain processes via
11 flexible mandatory access control.
12
13 The openshift_domain processes execute with the openshift_domain_t
14 SELinux type. You can check if you have these processes running by exe‐
15 cuting the ps command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep openshift_domain_t
20
21
22
24 The openshift_domain_t SELinux type can be entered via the
25 crontab_exec_t file type.
26
27 The default entrypoint paths for the openshift_domain_t domain are the
28 following:
29
30 /usr/bin/(f)?crontab, /usr/bin/at, /usr/sbin/fcronsighup,
31 /usr/libexec/fcronsighup
32
34 SELinux defines process types (domains) for each process running on the
35 system
36
37 You can see the context of a process using the -Z option to ps
38
39 Policy governs the access confined processes have to files. SELinux
40 openshift_domain policy is very flexible allowing users to setup their
41 openshift_domain processes in as secure a method as possible.
42
43 The following process types are defined for openshift_domain:
44
45 openshift_domain_t
46
47 Note: semanage permissive -a openshift_domain_t can be used to make the
48 process type openshift_domain_t permissive. SELinux does not deny
49 access to permissive process types, but the AVC (SELinux denials) mes‐
50 sages are still generated.
51
52
54 SELinux policy is customizable based on least access required. open‐
55 shift_domain policy is extremely flexible and has several booleans that
56 allow you to manipulate the policy and run openshift_domain with the
57 tightest access possible.
58
59
60
61 If you want to allow users to resolve user passwd entries directly from
62 ldap rather then using a sssd server, you must turn on the authlo‐
63 gin_nsswitch_use_ldap boolean. Disabled by default.
64
65 setsebool -P authlogin_nsswitch_use_ldap 1
66
67
68
69 If you want to allow all domains to execute in fips_mode, you must turn
70 on the fips_mode boolean. Enabled by default.
71
72 setsebool -P fips_mode 1
73
74
75
76 If you want to allow confined applications to run with kerberos, you
77 must turn on the kerberos_enabled boolean. Enabled by default.
78
79 setsebool -P kerberos_enabled 1
80
81
82
83 If you want to allow system to run with NIS, you must turn on the
84 nis_enabled boolean. Disabled by default.
85
86 setsebool -P nis_enabled 1
87
88
89
90 If you want to allow confined applications to use nscd shared memory,
91 you must turn on the nscd_use_shm boolean. Enabled by default.
92
93 setsebool -P nscd_use_shm 1
94
95
96
98 The SELinux process type openshift_domain_t can manage files labeled
99 with the following file types. The paths listed are the default paths
100 for these file types. Note the processes UID still need to have DAC
101 permissions.
102
103 cgroup_t
104
105 /sys/fs/cgroup
106
107 faillog_t
108
109 /var/log/btmp.*
110 /var/log/faillog.*
111 /var/log/tallylog.*
112 /var/run/faillock(/.*)?
113
114 openshift_domain_tmp_t
115
116
117 user_cron_spool_t
118
119 /var/spool/at(/.*)?
120 /var/spool/cron
121
122 user_tmp_t
123
124 /dev/shm/mono.*
125 /var/run/user(/.*)?
126 /tmp/.ICE-unix(/.*)?
127 /tmp/.X11-unix(/.*)?
128 /dev/shm/pulse-shm.*
129 /tmp/.X0-lock
130 /tmp/hsperfdata_root
131 /var/tmp/hsperfdata_root
132 /home/[^/]+/tmp
133 /home/[^/]+/.tmp
134 /tmp/gconfd-[^/]+
135
136 var_auth_t
137
138 /var/ace(/.*)?
139 /var/rsa(/.*)?
140 /var/lib/abl(/.*)?
141 /var/lib/rsa(/.*)?
142 /var/lib/pam_ssh(/.*)?
143 /var/run/pam_ssh(/.*)?
144 /var/lib/pam_shield(/.*)?
145 /var/opt/quest/vas/vasd(/.*)?
146 /var/lib/google-authenticator(/.*)?
147
148
150 semanage fcontext can also be used to manipulate default file context
151 mappings.
152
153 semanage permissive can also be used to manipulate whether or not a
154 process type is permissive.
155
156 semanage module can also be used to enable/disable/install/remove pol‐
157 icy modules.
158
159 semanage boolean can also be used to manipulate the booleans
160
161
162 system-config-selinux is a GUI tool available to customize SELinux pol‐
163 icy settings.
164
165
167 This manual page was auto-generated using sepolicy manpage .
168
169
171 selinux(8), openshift_domain(8), semanage(8), restorecon(8), chcon(1),
172 sepolicy(8), setsebool(8)
173
174
175
176openshift_domain 19-10-08 openshift_domain_selinux(8)