1mdadm_selinux(8) SELinux Policy mdadm mdadm_selinux(8)
2
3
4
6 mdadm_selinux - Security Enhanced Linux Policy for the mdadm processes
7
9 Security-Enhanced Linux secures the mdadm processes via flexible manda‐
10 tory access control.
11
12 The mdadm processes execute with the mdadm_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep mdadm_t
19
20
21
23 The mdadm_t SELinux type can be entered via the mdadm_exec_t file type.
24
25 The default entrypoint paths for the mdadm_t domain are the following:
26
27 /sbin/mdadm, /sbin/mdmon, /sbin/mdmpd, /sbin/iprdump, /sbin/iprinit,
28 /sbin/iprupdate, /usr/sbin/mdadm, /usr/sbin/mdmon, /usr/sbin/mdmpd,
29 /sbin/raid-check, /usr/sbin/iprdump, /usr/sbin/iprinit,
30 /usr/sbin/iprupdate, /usr/sbin/raid-check
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 mdadm policy is very flexible allowing users to setup their mdadm pro‐
40 cesses in as secure a method as possible.
41
42 The following process types are defined for mdadm:
43
44 mdadm_t
45
46 Note: semanage permissive -a mdadm_t can be used to make the process
47 type mdadm_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. mdadm
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run mdadm with the tightest access possible.
56
57
58
59 If you want to allow users to resolve user passwd entries directly from
60 ldap rather then using a sssd server, you must turn on the authlo‐
61 gin_nsswitch_use_ldap boolean. Disabled by default.
62
63 setsebool -P authlogin_nsswitch_use_ldap 1
64
65
66
67 If you want to allow all domains to execute in fips_mode, you must turn
68 on the fips_mode boolean. Enabled by default.
69
70 setsebool -P fips_mode 1
71
72
73
74 If you want to allow confined applications to run with kerberos, you
75 must turn on the kerberos_enabled boolean. Enabled by default.
76
77 setsebool -P kerberos_enabled 1
78
79
80
81 If you want to allow system to run with NIS, you must turn on the
82 nis_enabled boolean. Disabled by default.
83
84 setsebool -P nis_enabled 1
85
86
87
88 If you want to allow confined applications to use nscd shared memory,
89 you must turn on the nscd_use_shm boolean. Disabled by default.
90
91 setsebool -P nscd_use_shm 1
92
93
94
96 The SELinux process type mdadm_t can manage files labeled with the fol‐
97 lowing file types. The paths listed are the default paths for these
98 file types. Note the processes UID still need to have DAC permissions.
99
100 cgroup_t
101
102 /sys/fs/cgroup
103
104 cluster_conf_t
105
106 /etc/cluster(/.*)?
107
108 cluster_var_lib_t
109
110 /var/lib/pcsd(/.*)?
111 /var/lib/cluster(/.*)?
112 /var/lib/openais(/.*)?
113 /var/lib/pengine(/.*)?
114 /var/lib/corosync(/.*)?
115 /usr/lib/heartbeat(/.*)?
116 /var/lib/heartbeat(/.*)?
117 /var/lib/pacemaker(/.*)?
118
119 cluster_var_run_t
120
121 /var/run/crm(/.*)?
122 /var/run/cman_.*
123 /var/run/rsctmp(/.*)?
124 /var/run/aisexec.*
125 /var/run/heartbeat(/.*)?
126 /var/run/corosync-qnetd(/.*)?
127 /var/run/corosync-qdevice(/.*)?
128 /var/run/corosync.pid
129 /var/run/cpglockd.pid
130 /var/run/rgmanager.pid
131 /var/run/cluster/rgmanager.sk
132
133 kdump_lock_t
134
135 /var/lock/kdump(/.*)?
136
137 kdumpctl_tmp_t
138
139
140 mdadm_conf_t
141
142 /etc/mdadm.conf
143 /etc/mdadm.conf.anacbak
144
145 mdadm_log_t
146
147 /var/log/iprdump.*
148 /var/log/iprdbg
149
150 mdadm_tmp_t
151
152
153 mdadm_tmpfs_t
154
155
156 mdadm_var_run_t
157
158 /dev/md/.*
159 /var/run/mdadm(/.*)?
160 /dev/.mdadm.map
161
162 root_t
163
164 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
165 /
166 /initrd
167
168 sysfs_t
169
170 /sys(/.*)?
171
172 systemd_passwd_var_run_t
173
174 /var/run/systemd/ask-password(/.*)?
175 /var/run/systemd/ask-password-block(/.*)?
176
177
179 SELinux requires files to have an extended attribute to define the file
180 type.
181
182 You can see the context of a file using the -Z option to ls
183
184 Policy governs the access confined processes have to these files.
185 SELinux mdadm policy is very flexible allowing users to setup their
186 mdadm processes in as secure a method as possible.
187
188 STANDARD FILE CONTEXT
189
190 SELinux defines the file context types for the mdadm, if you wanted to
191 store files with these types in a diffent paths, you need to execute
192 the semanage command to sepecify alternate labeling and then use
193 restorecon to put the labels on disk.
194
195 semanage fcontext -a -t mdadm_log_t '/srv/mymdadm_content(/.*)?'
196 restorecon -R -v /srv/mymdadm_content
197
198 Note: SELinux often uses regular expressions to specify labels that
199 match multiple files.
200
201 The following file types are defined for mdadm:
202
203
204
205 mdadm_conf_t
206
207 - Set files with the mdadm_conf_t type, if you want to treat the files
208 as mdadm configuration data, usually stored under the /etc directory.
209
210
211 Paths:
212 /etc/mdadm.conf, /etc/mdadm.conf.anacbak
213
214
215 mdadm_exec_t
216
217 - Set files with the mdadm_exec_t type, if you want to transition an
218 executable to the mdadm_t domain.
219
220
221 Paths:
222 /sbin/mdadm, /sbin/mdmon, /sbin/mdmpd, /sbin/iprdump,
223 /sbin/iprinit, /sbin/iprupdate, /usr/sbin/mdadm, /usr/sbin/mdmon,
224 /usr/sbin/mdmpd, /sbin/raid-check, /usr/sbin/iprdump,
225 /usr/sbin/iprinit, /usr/sbin/iprupdate, /usr/sbin/raid-check
226
227
228 mdadm_initrc_exec_t
229
230 - Set files with the mdadm_initrc_exec_t type, if you want to transi‐
231 tion an executable to the mdadm_initrc_t domain.
232
233
234
235 mdadm_log_t
236
237 - Set files with the mdadm_log_t type, if you want to treat the data as
238 mdadm log data, usually stored under the /var/log directory.
239
240
241 Paths:
242 /var/log/iprdump.*, /var/log/iprdbg
243
244
245 mdadm_tmp_t
246
247 - Set files with the mdadm_tmp_t type, if you want to store mdadm tem‐
248 porary files in the /tmp directories.
249
250
251
252 mdadm_tmpfs_t
253
254 - Set files with the mdadm_tmpfs_t type, if you want to store mdadm
255 files on a tmpfs file system.
256
257
258
259 mdadm_unit_file_t
260
261 - Set files with the mdadm_unit_file_t type, if you want to treat the
262 files as mdadm unit content.
263
264
265 Paths:
266 /usr/lib/systemd/system/mdmon@.*, /usr/lib/systemd/system/mdmoni‐
267 tor.*
268
269
270 mdadm_var_run_t
271
272 - Set files with the mdadm_var_run_t type, if you want to store the
273 mdadm files under the /run or /var/run directory.
274
275
276 Paths:
277 /dev/md/.*, /var/run/mdadm(/.*)?, /dev/.mdadm.map
278
279
280 Note: File context can be temporarily modified with the chcon command.
281 If you want to permanently change the file context you need to use the
282 semanage fcontext command. This will modify the SELinux labeling data‐
283 base. You will need to use restorecon to apply the labels.
284
285
287 semanage fcontext can also be used to manipulate default file context
288 mappings.
289
290 semanage permissive can also be used to manipulate whether or not a
291 process type is permissive.
292
293 semanage module can also be used to enable/disable/install/remove pol‐
294 icy modules.
295
296 semanage boolean can also be used to manipulate the booleans
297
298
299 system-config-selinux is a GUI tool available to customize SELinux pol‐
300 icy settings.
301
302
304 This manual page was auto-generated using sepolicy manpage .
305
306
308 selinux(8), mdadm(8), semanage(8), restorecon(8), chcon(1), sepol‐
309 icy(8), setsebool(8)
310
311
312
313mdadm 19-05-30 mdadm_selinux(8)