sge_job_selinux(8)

1sge_job_selinux(8)          SELinux Policy sge_job          sge_job_selinux(8)
2
3
4

NAME

6       sge_job_selinux  -  Security Enhanced Linux Policy for the sge_job pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  sge_job  processes  via  flexible
11       mandatory access control.
12
13       The  sge_job processes execute with the sge_job_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep sge_job_t
20
21
22

ENTRYPOINTS

24       The  sge_job_t  SELinux  type  can  be  entered  via  the shell_exec_t,
25       sge_job_exec_t file types.
26
27       The default entrypoint paths for the sge_job_t domain are  the  follow‐
28       ing:
29
30       /bin/d?ash,  /bin/ksh.*,  /bin/zsh.*,  /usr/bin/d?ash,  /usr/bin/ksh.*,
31       /usr/bin/zsh.*, /bin/esh, /bin/bash, /bin/fish,  /bin/mksh,  /bin/sash,
32       /bin/tcsh,    /bin/yash,   /bin/bash2,   /usr/bin/esh,   /sbin/nologin,
33       /usr/bin/bash,     /usr/bin/fish,     /usr/bin/mksh,     /usr/bin/sash,
34       /usr/bin/tcsh,     /usr/bin/yash,    /usr/bin/bash2,    /usr/sbin/sesh,
35       /usr/sbin/smrsh, /usr/bin/scponly,  /usr/libexec/sesh,  /usr/sbin/nolo‐
36       gin,  /usr/bin/git-shell,  /usr/sbin/scponlyc,  /usr/libexec/sudo/sesh,
37       /usr/bin/cockpit-bridge, /usr/libexec/cockpit-agent,  /usr/libexec/git-
38       core/git-shell
39

PROCESS TYPES

41       SELinux defines process types (domains) for each process running on the
42       system
43
44       You can see the context of a process using the -Z option to ps
45
46       Policy governs the access confined processes have  to  files.   SELinux
47       sge_job  policy  is very flexible allowing users to setup their sge_job
48       processes in as secure a method as possible.
49
50       The following process types are defined for sge_job:
51
52       sge_job_t, sge_job_ssh_t
53
54       Note: semanage permissive -a sge_job_t can be used to make the  process
55       type  sge_job_t  permissive. SELinux does not deny access to permissive
56       process types, but the AVC (SELinux denials) messages are still  gener‐
57       ated.
58
59

BOOLEANS

61       SELinux policy is customizable based on least access required.  sge_job
62       policy is extremely flexible and has several booleans that allow you to
63       manipulate  the  policy and run sge_job with the tightest access possi‐
64       ble.
65
66
67
68       If you want to deny user domains applications to map a memory region as
69       both  executable  and  writable,  this  is dangerous and the executable
70       should be reported in bugzilla, you must turn on the deny_execmem bool‐
71       ean. Enabled by default.
72
73       setsebool -P deny_execmem 1
74
75
76
77       If you want to allow all domains to execute in fips_mode, you must turn
78       on the fips_mode boolean. Enabled by default.
79
80       setsebool -P fips_mode 1
81
82
83
84       If you want to control the ability to mmap a low area  of  the  address
85       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
86       the mmap_low_allowed boolean. Disabled by default.
87
88       setsebool -P mmap_low_allowed 1
89
90
91
92       If you want to allow confined applications to use nscd  shared  memory,
93       you must turn on the nscd_use_shm boolean. Enabled by default.
94
95       setsebool -P nscd_use_shm 1
96
97
98
99       If  you  want  to  disable  kernel module loading, you must turn on the
100       secure_mode_insmod boolean. Enabled by default.
101
102       setsebool -P secure_mode_insmod 1
103
104
105
106       If you want to allow unconfined executables to make their  heap  memory
107       executable.   Doing  this  is  a  really bad idea. Probably indicates a
108       badly coded executable, but could indicate an attack.  This  executable
109       should   be   reported  in  bugzilla,  you  must  turn  on  the  selin‐
110       uxuser_execheap boolean. Disabled by default.
111
112       setsebool -P selinuxuser_execheap 1
113
114
115
116       If you want to allow unconfined executables to make  their  stack  exe‐
117       cutable.   This  should  never, ever be necessary. Probably indicates a
118       badly coded executable, but could indicate an attack.  This  executable
119       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
120       stack boolean. Enabled by default.
121
122       setsebool -P selinuxuser_execstack 1
123
124
125

MANAGED FILES

127       The SELinux process type sge_job_t can manage files  labeled  with  the
128       following file types.  The paths listed are the default paths for these
129       file types.  Note the processes UID still need to have DAC permissions.
130
131       file_type
132
133            all files on the system
134
135

COMMANDS

137       semanage fcontext can also be used to manipulate default  file  context
138       mappings.
139
140       semanage  permissive  can  also  be used to manipulate whether or not a
141       process type is permissive.
142
143       semanage module can also be used to enable/disable/install/remove  pol‐
144       icy modules.
145
146       semanage boolean can also be used to manipulate the booleans
147
148
149       system-config-selinux is a GUI tool available to customize SELinux pol‐
150       icy settings.
151
152

AUTHOR

154       This manual page was auto-generated using sepolicy manpage .
155
156