lsassd_selinux(8)

1lsassd_selinux(8)            SELinux Policy lsassd           lsassd_selinux(8)
2
3
4

NAME

6       lsassd_selinux  -  Security  Enhanced  Linux Policy for the lsassd pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  lsassd  processes  via  flexible
11       mandatory access control.
12
13       The  lsassd  processes  execute with the lsassd_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep lsassd_t
20
21
22

ENTRYPOINTS

24       The  lsassd_t  SELinux  type  can be entered via the lsassd_exec_t file
25       type.
26
27       The default entrypoint paths for the lsassd_t domain are the following:
28
29       /usr/sbin/lsassd, /opt/likewise/sbin/lsassd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       lsassd policy is very flexible allowing users  to  setup  their  lsassd
39       processes in as secure a method as possible.
40
41       The following process types are defined for lsassd:
42
43       lsassd_t
44
45       Note:  semanage  permissive -a lsassd_t can be used to make the process
46       type lsassd_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   lsassd
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run lsassd with the tightest access possible.
55
56
57
58       If you want to allow all domains to execute in fips_mode, you must turn
59       on the fips_mode boolean. Enabled by default.
60
61       setsebool -P fips_mode 1
62
63
64
65       If  you  want  to allow confined applications to run with kerberos, you
66       must turn on the kerberos_enabled boolean. Enabled by default.
67
68       setsebool -P kerberos_enabled 1
69
70
71

MANAGED FILES

73       The SELinux process type lsassd_t can manage  files  labeled  with  the
74       following file types.  The paths listed are the default paths for these
75       file types.  Note the processes UID still need to have DAC permissions.
76
77       cluster_conf_t
78
79            /etc/cluster(/.*)?
80
81       cluster_var_lib_t
82
83            /var/lib/pcsd(/.*)?
84            /var/lib/cluster(/.*)?
85            /var/lib/openais(/.*)?
86            /var/lib/pengine(/.*)?
87            /var/lib/corosync(/.*)?
88            /usr/lib/heartbeat(/.*)?
89            /var/lib/heartbeat(/.*)?
90            /var/lib/pacemaker(/.*)?
91
92       cluster_var_run_t
93
94            /var/run/crm(/.*)?
95            /var/run/cman_.*
96            /var/run/rsctmp(/.*)?
97            /var/run/aisexec.*
98            /var/run/heartbeat(/.*)?
99            /var/run/corosync-qnetd(/.*)?
100            /var/run/corosync-qdevice(/.*)?
101            /var/run/corosync.pid
102            /var/run/cpglockd.pid
103            /var/run/rgmanager.pid
104            /var/run/cluster/rgmanager.sk
105
106       etc_runtime_t
107
108            /[^/]+
109            /etc/mtab.*
110            /etc/blkid(/.*)?
111            /etc/nologin.*
112            /etc/.fstab.hal..+
113            /halt
114            /fastboot
115            /poweroff
116            /.autofsck
117            /etc/cmtab
118            /forcefsck
119            /.suspended
120            /fsckoptions
121            /.autorelabel
122            /etc/.updated
123            /var/.updated
124            /etc/killpower
125            /etc/nohotplug
126            /etc/securetty
127            /etc/ioctl.save
128            /etc/fstab.REVOKE
129            /etc/network/ifstate
130            /etc/sysconfig/hwconf
131            /etc/ptal/ptal-printd-like
132            /etc/sysconfig/iptables.save
133            /etc/xorg.conf.d/00-system-setup-keyboard.conf
134            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
135
136       etc_t
137
138            /etc/.*
139            /usr/etc(/.*)?
140            /var/ftp/etc(/.*)?
141            /var/lib/openshift/.limits.d(/.*)?
142            /var/lib/openshift/.openshift-proxy.d(/.*)?
143            /var/lib/openshift/.stickshift-proxy.d(/.*)?
144            /var/lib/stickshift/.limits.d(/.*)?
145            /var/lib/stickshift/.stickshift-proxy.d(/.*)?
146            /etc/ipsec.d/examples(/.*)?
147            /var/named/chroot/etc(/.*)?
148            /var/spool/postfix/etc(/.*)?
149            /etc
150            /run/cockpit/motd
151            /etc/cups/client.conf
152
153       krb5_keytab_t
154
155            /etc/krb5.keytab
156            /etc/krb5kdc/kadm5.keytab
157            /var/kerberos/krb5kdc/kadm5.keytab
158
159       likewise_etc_t
160
161            /etc/likewise-open(/.*)?
162
163       lsassd_tmp_t
164
165
166       lsassd_var_lib_t
167
168            /var/lib/likewise/krb5cc.*
169            /var/lib/likewise-open/krb5cc.*
170            /var/lib/likewise/krb5ccr_lsass..*
171            /var/lib/likewise-open/krb5ccr_lsass..*
172            /var/lib/likewise/db/lsass-adcache.filedb..*
173            /var/lib/likewise-open/db/lsass-adcache.filedb..*
174            /var/lib/likewise/db/sam.db
175            /var/lib/likewise/lsasd.err
176            /var/lib/likewise/krb5ccr_lsass
177            /var/lib/likewise-open/db/sam.db
178            /var/lib/likewise-open/lsasd.err
179            /var/lib/likewise-open/krb5ccr_lsass
180            /var/lib/likewise/db/lsass-adcache.db
181            /var/lib/likewise/db/lsass-adstate.filedb
182            /var/lib/likewise-open/db/lsass-adcache.db
183            /var/lib/likewise-open/db/lsass-adstate.filedb
184
185       lsassd_var_run_t
186
187            /var/run/lsassd.pid
188
189       root_t
190
191            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
192            /
193            /initrd
194
195       security_t
196
197            /selinux
198
199       user_home_t
200
201            /home/[^/]+/.+
202
203

FILE CONTEXTS

205       SELinux requires files to have an extended attribute to define the file
206       type.
207
208       You can see the context of a file using the -Z option to ls
209
210       Policy  governs  the  access  confined  processes  have to these files.
211       SELinux lsassd policy is very flexible allowing users  to  setup  their
212       lsassd processes in as secure a method as possible.
213
214       STANDARD FILE CONTEXT
215
216       SELinux defines the file context types for the lsassd, if you wanted to
217       store files with these types in a diffent paths, you  need  to  execute
218       the  semanage  command  to  sepecify  alternate  labeling  and then use
219       restorecon to put the labels on disk.
220
221       semanage fcontext -a -t lsassd_tmp_t '/srv/mylsassd_content(/.*)?'
222       restorecon -R -v /srv/mylsassd_content
223
224       Note: SELinux often uses regular expressions  to  specify  labels  that
225       match multiple files.
226
227       The following file types are defined for lsassd:
228
229
230
231       lsassd_exec_t
232
233       -  Set  files with the lsassd_exec_t type, if you want to transition an
234       executable to the lsassd_t domain.
235
236
237       Paths:
238            /usr/sbin/lsassd, /opt/likewise/sbin/lsassd
239
240
241       lsassd_tmp_t
242
243       - Set files with the lsassd_tmp_t type, if you  want  to  store  lsassd
244       temporary files in the /tmp directories.
245
246
247
248       lsassd_var_lib_t
249
250       -  Set  files  with the lsassd_var_lib_t type, if you want to store the
251       lsassd files under the /var/lib directory.
252
253
254       Paths:
255            /var/lib/likewise/krb5cc.*,       /var/lib/likewise-open/krb5cc.*,
256            /var/lib/likewise/krb5ccr_lsass..*,             /var/lib/likewise-
257            open/krb5ccr_lsass..*,                 /var/lib/likewise/db/lsass-
258            adcache.filedb..*,                /var/lib/likewise-open/db/lsass-
259            adcache.filedb..*,   /var/lib/likewise/db/sam.db,   /var/lib/like‐
260            wise/lsasd.err,   /var/lib/likewise/krb5ccr_lsass,  /var/lib/like‐
261            wise-open/db/sam.db,             /var/lib/likewise-open/lsasd.err,
262            /var/lib/likewise-open/krb5ccr_lsass,  /var/lib/likewise/db/lsass-
263            adcache.db,             /var/lib/likewise/db/lsass-adstate.filedb,
264            /var/lib/likewise-open/db/lsass-adcache.db,     /var/lib/likewise-
265            open/db/lsass-adstate.filedb
266
267
268       lsassd_var_run_t
269
270       - Set files with the lsassd_var_run_t type, if you want  to  store  the
271       lsassd files under the /run or /var/run directory.
272
273
274
275       lsassd_var_socket_t
276
277       - Set files with the lsassd_var_socket_t type, if you want to treat the
278       files as lsassd var socket data.
279
280
281       Paths:
282            /var/lib/likewise/.ntlmd,               /var/lib/likewise/.lsassd,
283            /var/lib/likewise/rpc/lsass,        /var/lib/likewise-open/.ntlmd,
284            /var/lib/likewise-open/.lsassd, /var/lib/likewise-open/rpc/lsass
285
286
287       Note: File context can be temporarily modified with the chcon  command.
288       If  you want to permanently change the file context you need to use the
289       semanage fcontext command.  This will modify the SELinux labeling data‐
290       base.  You will need to use restorecon to apply the labels.
291
292

COMMANDS

294       semanage  fcontext  can also be used to manipulate default file context
295       mappings.
296
297       semanage permissive can also be used to manipulate  whether  or  not  a
298       process type is permissive.
299
300       semanage  module can also be used to enable/disable/install/remove pol‐
301       icy modules.
302
303       semanage boolean can also be used to manipulate the booleans
304
305
306       system-config-selinux is a GUI tool available to customize SELinux pol‐
307       icy settings.
308
309

AUTHOR

311       This manual page was auto-generated using sepolicy manpage .
312
313