1rlogind_selinux(8) SELinux Policy rlogind rlogind_selinux(8)
2
3
4
6 rlogind_selinux - Security Enhanced Linux Policy for the rlogind pro‐
7 cesses
8
10 Security-Enhanced Linux secures the rlogind processes via flexible
11 mandatory access control.
12
13 The rlogind processes execute with the rlogind_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep rlogind_t
20
21
22
24 The rlogind_t SELinux type can be entered via the rlogind_exec_t file
25 type.
26
27 The default entrypoint paths for the rlogind_t domain are the follow‐
28 ing:
29
30 /usr/lib/telnetlogin, /usr/sbin/in.rlogind, /usr/kerberos/sbin/klogind
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 rlogind policy is very flexible allowing users to setup their rlogind
40 processes in as secure a method as possible.
41
42 The following process types are defined for rlogind:
43
44 rlogind_t
45
46 Note: semanage permissive -a rlogind_t can be used to make the process
47 type rlogind_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. rlogind
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run rlogind with the tightest access possi‐
56 ble.
57
58
59
60 If you want to allow users to resolve user passwd entries directly from
61 ldap rather then using a sssd server, you must turn on the authlo‐
62 gin_nsswitch_use_ldap boolean. Disabled by default.
63
64 setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68 If you want to allow all domains to execute in fips_mode, you must turn
69 on the fips_mode boolean. Enabled by default.
70
71 setsebool -P fips_mode 1
72
73
74
75 If you want to allow confined applications to run with kerberos, you
76 must turn on the kerberos_enabled boolean. Enabled by default.
77
78 setsebool -P kerberos_enabled 1
79
80
81
82 If you want to allow system to run with NIS, you must turn on the
83 nis_enabled boolean. Disabled by default.
84
85 setsebool -P nis_enabled 1
86
87
88
89 If you want to allow confined applications to use nscd shared memory,
90 you must turn on the nscd_use_shm boolean. Enabled by default.
91
92 setsebool -P nscd_use_shm 1
93
94
95
96 If you want to enable polyinstantiated directory support, you must turn
97 on the polyinstantiation_enabled boolean. Disabled by default.
98
99 setsebool -P polyinstantiation_enabled 1
100
101
102
104 SELinux defines port types to represent TCP and UDP ports.
105
106 You can see the types associated with a port by using the following
107 command:
108
109 semanage port -l
110
111
112 Policy governs the access confined processes have to these ports.
113 SELinux rlogind policy is very flexible allowing users to setup their
114 rlogind processes in as secure a method as possible.
115
116 The following port types are defined for rlogind:
117
118
119 rlogin_port_t
120
121
122
123 Default Defined Ports:
124 tcp 543,2105
125
126
127 rlogind_port_t
128
129
130
131 Default Defined Ports:
132 tcp 513
133
135 The SELinux process type rlogind_t can manage files labeled with the
136 following file types. The paths listed are the default paths for these
137 file types. Note the processes UID still need to have DAC permissions.
138
139 auth_cache_t
140
141 /var/cache/coolkey(/.*)?
142
143 auth_home_t
144
145 /root/.yubico(/.*)?
146 /root/.google_authenticator
147 /root/.google_authenticator~
148 /home/[^/]+/.yubico(/.*)?
149 /home/[^/]+/.google_authenticator
150 /home/[^/]+/.google_authenticator~
151
152 cgroup_t
153
154 /sys/fs/cgroup
155
156 cluster_conf_t
157
158 /etc/cluster(/.*)?
159
160 cluster_var_lib_t
161
162 /var/lib/pcsd(/.*)?
163 /var/lib/cluster(/.*)?
164 /var/lib/openais(/.*)?
165 /var/lib/pengine(/.*)?
166 /var/lib/corosync(/.*)?
167 /usr/lib/heartbeat(/.*)?
168 /var/lib/heartbeat(/.*)?
169 /var/lib/pacemaker(/.*)?
170
171 cluster_var_run_t
172
173 /var/run/crm(/.*)?
174 /var/run/cman_.*
175 /var/run/rsctmp(/.*)?
176 /var/run/aisexec.*
177 /var/run/heartbeat(/.*)?
178 /var/run/corosync-qnetd(/.*)?
179 /var/run/corosync-qdevice(/.*)?
180 /var/run/corosync.pid
181 /var/run/cpglockd.pid
182 /var/run/rgmanager.pid
183 /var/run/cluster/rgmanager.sk
184
185 faillog_t
186
187 /var/log/btmp.*
188 /var/log/faillog.*
189 /var/log/tallylog.*
190 /var/run/faillock(/.*)?
191
192 initrc_var_run_t
193
194 /var/run/utmp
195 /var/run/random-seed
196 /var/run/runlevel.dir
197 /var/run/setmixer_flag
198
199 kdbusfs_t
200
201
202 krb5_host_rcache_t
203
204 /var/cache/krb5rcache(/.*)?
205 /var/tmp/nfs_0
206 /var/tmp/DNS_25
207 /var/tmp/host_0
208 /var/tmp/imap_0
209 /var/tmp/HTTP_23
210 /var/tmp/HTTP_48
211 /var/tmp/ldap_55
212 /var/tmp/ldap_487
213 /var/tmp/ldapmap1_0
214
215 lastlog_t
216
217 /var/log/lastlog.*
218
219 pam_var_run_t
220
221 /var/(db|adm)/sudo(/.*)?
222 /var/lib/sudo(/.*)?
223 /var/run/sudo(/.*)?
224 /var/run/sepermit(/.*)?
225 /var/run/pam_mount(/.*)?
226
227 rlogind_tmp_t
228
229
230 rlogind_var_run_t
231
232
233 root_t
234
235 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
236 /
237 /initrd
238
239 security_t
240
241 /selinux
242
243 user_tmp_t
244
245 /dev/shm/mono.*
246 /var/run/user(/.*)?
247 /tmp/.ICE-unix(/.*)?
248 /tmp/.X11-unix(/.*)?
249 /dev/shm/pulse-shm.*
250 /tmp/.X0-lock
251 /tmp/hsperfdata_root
252 /var/tmp/hsperfdata_root
253 /home/[^/]+/tmp
254 /home/[^/]+/.tmp
255 /tmp/gconfd-[^/]+
256
257 var_auth_t
258
259 /var/ace(/.*)?
260 /var/rsa(/.*)?
261 /var/lib/abl(/.*)?
262 /var/lib/rsa(/.*)?
263 /var/lib/pam_ssh(/.*)?
264 /var/run/pam_ssh(/.*)?
265 /var/lib/pam_shield(/.*)?
266 /var/opt/quest/vas/vasd(/.*)?
267 /var/lib/google-authenticator(/.*)?
268
269 wtmp_t
270
271 /var/log/wtmp.*
272
273
275 SELinux requires files to have an extended attribute to define the file
276 type.
277
278 You can see the context of a file using the -Z option to ls
279
280 Policy governs the access confined processes have to these files.
281 SELinux rlogind policy is very flexible allowing users to setup their
282 rlogind processes in as secure a method as possible.
283
284 STANDARD FILE CONTEXT
285
286 SELinux defines the file context types for the rlogind, if you wanted
287 to store files with these types in a diffent paths, you need to execute
288 the semanage command to sepecify alternate labeling and then use
289 restorecon to put the labels on disk.
290
291 semanage fcontext -a -t rlogind_var_run_t '/srv/myrlogind_con‐
292 tent(/.*)?'
293 restorecon -R -v /srv/myrlogind_content
294
295 Note: SELinux often uses regular expressions to specify labels that
296 match multiple files.
297
298 The following file types are defined for rlogind:
299
300
301
302 rlogind_exec_t
303
304 - Set files with the rlogind_exec_t type, if you want to transition an
305 executable to the rlogind_t domain.
306
307
308 Paths:
309 /usr/lib/telnetlogin, /usr/sbin/in.rlogind, /usr/ker‐
310 beros/sbin/klogind
311
312
313 rlogind_home_t
314
315 - Set files with the rlogind_home_t type, if you want to store rlogind
316 files in the users home directory.
317
318
319 Paths:
320 /root/.rhosts, /root/.rlogin, /home/[^/]+/.rhosts,
321 /home/[^/]+/.rlogin
322
323
324 rlogind_keytab_t
325
326 - Set files with the rlogind_keytab_t type, if you want to treat the
327 files as kerberos keytab files.
328
329
330
331 rlogind_tmp_t
332
333 - Set files with the rlogind_tmp_t type, if you want to store rlogind
334 temporary files in the /tmp directories.
335
336
337
338 rlogind_var_run_t
339
340 - Set files with the rlogind_var_run_t type, if you want to store the
341 rlogind files under the /run or /var/run directory.
342
343
344
345 Note: File context can be temporarily modified with the chcon command.
346 If you want to permanently change the file context you need to use the
347 semanage fcontext command. This will modify the SELinux labeling data‐
348 base. You will need to use restorecon to apply the labels.
349
350
352 semanage fcontext can also be used to manipulate default file context
353 mappings.
354
355 semanage permissive can also be used to manipulate whether or not a
356 process type is permissive.
357
358 semanage module can also be used to enable/disable/install/remove pol‐
359 icy modules.
360
361 semanage port can also be used to manipulate the port definitions
362
363 semanage boolean can also be used to manipulate the booleans
364
365
366 system-config-selinux is a GUI tool available to customize SELinux pol‐
367 icy settings.
368
369
371 This manual page was auto-generated using sepolicy manpage .
372
373
375 selinux(8), rlogind(8), semanage(8), restorecon(8), chcon(1), sepol‐
376 icy(8), setsebool(8)
377
378
379
380rlogind 19-10-08 rlogind_selinux(8)