1dhcpc_selinux(8) SELinux Policy dhcpc dhcpc_selinux(8)
2
3
4
6 dhcpc_selinux - Security Enhanced Linux Policy for the dhcpc processes
7
9 Security-Enhanced Linux secures the dhcpc processes via flexible manda‐
10 tory access control.
11
12 The dhcpc processes execute with the dhcpc_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep dhcpc_t
19
20
21
23 The dhcpc_t SELinux type can be entered via the dhcpc_exec_t file type.
24
25 The default entrypoint paths for the dhcpc_t domain are the following:
26
27 /sbin/dhclient.*, /usr/sbin/dhclient.*, /sbin/pump, /sbin/dhcdbd,
28 /sbin/dhcpcd, /usr/sbin/pump, /usr/sbin/dhcdbd, /usr/sbin/dhcpcd
29
31 SELinux defines process types (domains) for each process running on the
32 system
33
34 You can see the context of a process using the -Z option to ps
35
36 Policy governs the access confined processes have to files. SELinux
37 dhcpc policy is very flexible allowing users to setup their dhcpc pro‐
38 cesses in as secure a method as possible.
39
40 The following process types are defined for dhcpc:
41
42 dhcpc_t
43
44 Note: semanage permissive -a dhcpc_t can be used to make the process
45 type dhcpc_t permissive. SELinux does not deny access to permissive
46 process types, but the AVC (SELinux denials) messages are still gener‐
47 ated.
48
49
51 SELinux policy is customizable based on least access required. dhcpc
52 policy is extremely flexible and has several booleans that allow you to
53 manipulate the policy and run dhcpc with the tightest access possible.
54
55
56
57 If you want to allow dhcpc client applications to execute iptables com‐
58 mands, you must turn on the dhcpc_exec_iptables boolean. Disabled by
59 default.
60
61 setsebool -P dhcpc_exec_iptables 1
62
63
64
65 If you want to allow users to resolve user passwd entries directly from
66 ldap rather then using a sssd server, you must turn on the authlo‐
67 gin_nsswitch_use_ldap boolean. Disabled by default.
68
69 setsebool -P authlogin_nsswitch_use_ldap 1
70
71
72
73 If you want to allow all domains to execute in fips_mode, you must turn
74 on the fips_mode boolean. Enabled by default.
75
76 setsebool -P fips_mode 1
77
78
79
80 If you want to allow confined applications to run with kerberos, you
81 must turn on the kerberos_enabled boolean. Enabled by default.
82
83 setsebool -P kerberos_enabled 1
84
85
86
87 If you want to allow system to run with NIS, you must turn on the
88 nis_enabled boolean. Disabled by default.
89
90 setsebool -P nis_enabled 1
91
92
93
94 If you want to allow confined applications to use nscd shared memory,
95 you must turn on the nscd_use_shm boolean. Disabled by default.
96
97 setsebool -P nscd_use_shm 1
98
99
100
102 SELinux defines port types to represent TCP and UDP ports.
103
104 You can see the types associated with a port by using the following
105 command:
106
107 semanage port -l
108
109
110 Policy governs the access confined processes have to these ports.
111 SELinux dhcpc policy is very flexible allowing users to setup their
112 dhcpc processes in as secure a method as possible.
113
114 The following port types are defined for dhcpc:
115
116
117 dhcpc_port_t
118
119
120
121 Default Defined Ports:
122 tcp 68,546,5546
123 udp 68,546,5546
124
126 The SELinux process type dhcpc_t can manage files labeled with the fol‐
127 lowing file types. The paths listed are the default paths for these
128 file types. Note the processes UID still need to have DAC permissions.
129
130 NetworkManager_var_lib_t
131
132 /var/lib/wicd(/.*)?
133 /var/lib/NetworkManager(/.*)?
134 /etc/dhcp/wired-settings.conf
135 /etc/wicd/wired-settings.conf
136 /etc/dhcp/manager-settings.conf
137 /etc/wicd/manager-settings.conf
138 /etc/dhcp/wireless-settings.conf
139 /etc/wicd/wireless-settings.conf
140
141 cluster_conf_t
142
143 /etc/cluster(/.*)?
144
145 cluster_var_lib_t
146
147 /var/lib/pcsd(/.*)?
148 /var/lib/cluster(/.*)?
149 /var/lib/openais(/.*)?
150 /var/lib/pengine(/.*)?
151 /var/lib/corosync(/.*)?
152 /usr/lib/heartbeat(/.*)?
153 /var/lib/heartbeat(/.*)?
154 /var/lib/pacemaker(/.*)?
155
156 cluster_var_run_t
157
158 /var/run/crm(/.*)?
159 /var/run/cman_.*
160 /var/run/rsctmp(/.*)?
161 /var/run/aisexec.*
162 /var/run/heartbeat(/.*)?
163 /var/run/corosync-qnetd(/.*)?
164 /var/run/corosync-qdevice(/.*)?
165 /var/run/corosync.pid
166 /var/run/cpglockd.pid
167 /var/run/rgmanager.pid
168 /var/run/cluster/rgmanager.sk
169
170 dhcpc_state_t
171
172 /var/lib/dhcp3?/dhclient.*
173 /var/lib/dhcpcd(/.*)?
174 /var/lib/dhclient(/.*)?
175 /var/lib/wifiroamd(/.*)?
176
177 dhcpc_tmp_t
178
179
180 dhcpc_var_run_t
181
182 /var/run/dhcpcd(/.*)?
183 /var/run/dhclient.*
184
185 initrc_var_run_t
186
187 /var/run/utmp
188 /var/run/random-seed
189 /var/run/runlevel.dir
190 /var/run/setmixer_flag
191
192 net_conf_t
193
194 /etc/hosts[^/]*
195 /etc/yp.conf.*
196 /etc/denyhosts.*
197 /etc/hosts.deny.*
198 /etc/resolv.conf.*
199 /etc/.resolv.conf.*
200 /etc/resolv-secure.conf.*
201 /var/run/cloud-init(/.*)?
202 /var/run/systemd/network(/.*)?
203 /etc/sysconfig/networking(/.*)?
204 /etc/sysconfig/network-scripts(/.*)?
205 /etc/sysconfig/network-scripts/.*resolv.conf
206 /var/run/NetworkManager/resolv.conf.*
207 /etc/ethers
208 /etc/ntp.conf
209 /var/run/systemd/resolve/resolv.conf
210 /var/run/systemd/resolve/stub-resolv.conf
211
212 root_t
213
214 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
215 /
216 /initrd
217
218 systemd_passwd_var_run_t
219
220 /var/run/systemd/ask-password(/.*)?
221 /var/run/systemd/ask-password-block(/.*)?
222
223 virt_lxc_var_run_t
224
225 /var/run/libvirt/lxc(/.*)?
226 /var/run/libvirt-sandbox(/.*)?
227
228 virt_var_run_t
229
230 /var/vdsm(/.*)?
231 /var/run/vdsm(/.*)?
232 /var/run/libvirt(/.*)?
233 /var/run/libvirtd.pid
234 /var/run/qemu-pr-helper.sock
235
236
238 SELinux requires files to have an extended attribute to define the file
239 type.
240
241 You can see the context of a file using the -Z option to ls
242
243 Policy governs the access confined processes have to these files.
244 SELinux dhcpc policy is very flexible allowing users to setup their
245 dhcpc processes in as secure a method as possible.
246
247 STANDARD FILE CONTEXT
248
249 SELinux defines the file context types for the dhcpc, if you wanted to
250 store files with these types in a diffent paths, you need to execute
251 the semanage command to sepecify alternate labeling and then use
252 restorecon to put the labels on disk.
253
254 semanage fcontext -a -t dhcpc_var_run_t '/srv/mydhcpc_content(/.*)?'
255 restorecon -R -v /srv/mydhcpc_content
256
257 Note: SELinux often uses regular expressions to specify labels that
258 match multiple files.
259
260 The following file types are defined for dhcpc:
261
262
263
264 dhcpc_exec_t
265
266 - Set files with the dhcpc_exec_t type, if you want to transition an
267 executable to the dhcpc_t domain.
268
269
270 Paths:
271 /sbin/dhclient.*, /usr/sbin/dhclient.*, /sbin/pump, /sbin/dhcdbd,
272 /sbin/dhcpcd, /usr/sbin/pump, /usr/sbin/dhcdbd, /usr/sbin/dhcpcd
273
274
275 dhcpc_helper_exec_t
276
277 - Set files with the dhcpc_helper_exec_t type, if you want to transi‐
278 tion an executable to the dhcpc_helper_t domain.
279
280
281
282 dhcpc_state_t
283
284 - Set files with the dhcpc_state_t type, if you want to treat the files
285 as dhcpc state data.
286
287
288 Paths:
289 /var/lib/dhcp3?/dhclient.*, /var/lib/dhcpcd(/.*)?,
290 /var/lib/dhclient(/.*)?, /var/lib/wifiroamd(/.*)?
291
292
293 dhcpc_tmp_t
294
295 - Set files with the dhcpc_tmp_t type, if you want to store dhcpc tem‐
296 porary files in the /tmp directories.
297
298
299
300 dhcpc_var_run_t
301
302 - Set files with the dhcpc_var_run_t type, if you want to store the
303 dhcpc files under the /run or /var/run directory.
304
305
306 Paths:
307 /var/run/dhcpcd(/.*)?, /var/run/dhclient.*
308
309
310 Note: File context can be temporarily modified with the chcon command.
311 If you want to permanently change the file context you need to use the
312 semanage fcontext command. This will modify the SELinux labeling data‐
313 base. You will need to use restorecon to apply the labels.
314
315
317 semanage fcontext can also be used to manipulate default file context
318 mappings.
319
320 semanage permissive can also be used to manipulate whether or not a
321 process type is permissive.
322
323 semanage module can also be used to enable/disable/install/remove pol‐
324 icy modules.
325
326 semanage port can also be used to manipulate the port definitions
327
328 semanage boolean can also be used to manipulate the booleans
329
330
331 system-config-selinux is a GUI tool available to customize SELinux pol‐
332 icy settings.
333
334
336 This manual page was auto-generated using sepolicy manpage .
337
338
340 selinux(8), dhcpc(8), semanage(8), restorecon(8), chcon(1), sepol‐
341 icy(8), setsebool(8)
342
343
344
345dhcpc 19-05-30 dhcpc_selinux(8)