ipsec_selinux(8)

1ipsec_selinux(8)             SELinux Policy ipsec             ipsec_selinux(8)
2
3
4

NAME

6       ipsec_selinux - Security Enhanced Linux Policy for the ipsec processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the ipsec processes via flexible manda‐
10       tory access control.
11
12       The ipsec processes execute with the  ipsec_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ipsec_t
19
20
21

ENTRYPOINTS

23       The ipsec_t SELinux type can be entered via the ipsec_exec_t file type.
24
25       The default entrypoint paths for the ipsec_t domain are the following:
26
27       /usr/libexec/strongimcv/.*,                 /usr/libexec/strongswan/.*,
28       /usr/lib/ipsec/spi,     /usr/lib/ipsec/pluto,    /usr/lib/ipsec/eroute,
29       /usr/libexec/ipsec/spi, /usr/libexec/ipsec/pluto, /usr/lib/ipsec/klips‐
30       debug,      /usr/libexec/ipsec/eroute,      /usr/libexec/ipsec/addconn,
31       /usr/libexec/ipsec/klipsdebug
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       ipsec policy is very flexible allowing users to setup their ipsec  pro‐
41       cesses in as secure a method as possible.
42
43       The following process types are defined for ipsec:
44
45       ipsec_t, ipsec_mgmt_t
46
47       Note:  semanage  permissive  -a ipsec_t can be used to make the process
48       type ipsec_t permissive. SELinux does not  deny  access  to  permissive
49       process  types, but the AVC (SELinux denials) messages are still gener‐
50       ated.
51
52

BOOLEANS

54       SELinux policy is customizable based on least access  required.   ipsec
55       policy is extremely flexible and has several booleans that allow you to
56       manipulate the policy and run ipsec with the tightest access possible.
57
58
59
60       If you want to allow users to resolve user passwd entries directly from
61       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
62       gin_nsswitch_use_ldap boolean. Disabled by default.
63
64       setsebool -P authlogin_nsswitch_use_ldap 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to allow confined applications to run with kerberos, you
76       must turn on the kerberos_enabled boolean. Enabled by default.
77
78       setsebool -P kerberos_enabled 1
79
80
81
82       If you want to allow system to run with  NIS,  you  must  turn  on  the
83       nis_enabled boolean. Disabled by default.
84
85       setsebool -P nis_enabled 1
86
87
88
89       If  you  want to allow confined applications to use nscd shared memory,
90       you must turn on the nscd_use_shm boolean. Disabled by default.
91
92       setsebool -P nscd_use_shm 1
93
94
95

PORT TYPES

97       SELinux defines port types to represent TCP and UDP ports.
98
99       You can see the types associated with a port  by  using  the  following
100       command:
101
102       semanage port -l
103
104
105       Policy  governs  the  access  confined  processes  have to these ports.
106       SELinux ipsec policy is very flexible allowing  users  to  setup  their
107       ipsec processes in as secure a method as possible.
108
109       The following port types are defined for ipsec:
110
111
112       ipsecnat_port_t
113
114
115
116       Default Defined Ports:
117                 tcp 4500
118                 udp 4500
119

MANAGED FILES

121       The SELinux process type ipsec_t can manage files labeled with the fol‐
122       lowing file types.  The paths listed are the default  paths  for  these
123       file types.  Note the processes UID still need to have DAC permissions.
124
125       cluster_conf_t
126
127            /etc/cluster(/.*)?
128
129       cluster_var_lib_t
130
131            /var/lib/pcsd(/.*)?
132            /var/lib/cluster(/.*)?
133            /var/lib/openais(/.*)?
134            /var/lib/pengine(/.*)?
135            /var/lib/corosync(/.*)?
136            /usr/lib/heartbeat(/.*)?
137            /var/lib/heartbeat(/.*)?
138            /var/lib/pacemaker(/.*)?
139
140       cluster_var_run_t
141
142            /var/run/crm(/.*)?
143            /var/run/cman_.*
144            /var/run/rsctmp(/.*)?
145            /var/run/aisexec.*
146            /var/run/heartbeat(/.*)?
147            /var/run/corosync-qnetd(/.*)?
148            /var/run/corosync-qdevice(/.*)?
149            /var/run/corosync.pid
150            /var/run/cpglockd.pid
151            /var/run/rgmanager.pid
152            /var/run/cluster/rgmanager.sk
153
154       faillog_t
155
156            /var/log/btmp.*
157            /var/log/faillog.*
158            /var/log/tallylog.*
159            /var/run/faillock(/.*)?
160
161       ipsec_conf_file_t
162
163            /etc/racoon(/.*)?
164            /etc/strongimcv(/.*)?
165            /etc/strongswan(/.*)?
166            /etc/ipsec.conf
167            /etc/strongswan/ipsec.conf
168
169       ipsec_key_file_t
170
171            /etc/ipsec.d(/.*)?
172            /etc/racoon/certs(/.*)?
173            /etc/ipsec.secrets.*
174            /etc/strongswan/ipsec.d(/.*)?
175            /etc/strongswan/ipsec.secrets.*
176            /etc/racoon/psk.txt
177
178       ipsec_log_t
179
180            /var/log/pluto.log.*
181
182       ipsec_tmp_t
183
184
185       ipsec_var_run_t
186
187            /var/racoon(/.*)?
188            /var/run/pluto(/.*)?
189            /var/run/charon.*
190            /var/run/racoon.pid
191            /var/run/charon.ctl
192            /var/run/charon.vici
193
194       krb5_host_rcache_t
195
196            /var/cache/krb5rcache(/.*)?
197            /var/tmp/nfs_0
198            /var/tmp/DNS_25
199            /var/tmp/host_0
200            /var/tmp/imap_0
201            /var/tmp/HTTP_23
202            /var/tmp/HTTP_48
203            /var/tmp/ldap_55
204            /var/tmp/ldap_487
205            /var/tmp/ldapmap1_0
206
207       lastlog_t
208
209            /var/log/lastlog.*
210
211       net_conf_t
212
213            /etc/hosts[^/]*
214            /etc/yp.conf.*
215            /etc/denyhosts.*
216            /etc/hosts.deny.*
217            /etc/resolv.conf.*
218            /etc/.resolv.conf.*
219            /etc/resolv-secure.conf.*
220            /var/run/cloud-init(/.*)?
221            /var/run/systemd/network(/.*)?
222            /etc/sysconfig/networking(/.*)?
223            /etc/sysconfig/network-scripts(/.*)?
224            /etc/sysconfig/network-scripts/.*resolv.conf
225            /var/run/NetworkManager/resolv.conf.*
226            /etc/ethers
227            /etc/ntp.conf
228            /var/run/systemd/resolve/resolv.conf
229            /var/run/systemd/resolve/stub-resolv.conf
230
231       root_t
232
233            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
234            /
235            /initrd
236
237       security_t
238
239            /selinux
240
241

FILE CONTEXTS

243       SELinux requires files to have an extended attribute to define the file
244       type.
245
246       You can see the context of a file using the -Z option to ls
247
248       Policy governs the access  confined  processes  have  to  these  files.
249       SELinux  ipsec  policy  is  very flexible allowing users to setup their
250       ipsec processes in as secure a method as possible.
251
252       EQUIVALENCE DIRECTORIES
253
254
255       ipsec policy stores data with multiple  different  file  context  types
256       under  the  /var/run/pluto  directory.   If you would like to store the
257       data in a different directory you can use the semanage command to  cre‐
258       ate an equivalence mapping.  If you wanted to store this data under the
259       /srv dirctory you would execute the following command:
260
261       semanage fcontext -a -e /var/run/pluto /srv/pluto
262       restorecon -R -v /srv/pluto
263
264       STANDARD FILE CONTEXT
265
266       SELinux defines the file context types for the ipsec, if you wanted  to
267       store  files  with  these types in a diffent paths, you need to execute
268       the semanage command  to  sepecify  alternate  labeling  and  then  use
269       restorecon to put the labels on disk.
270
271       semanage   fcontext   -a   -t   ipsec_mgmt_devpts_t  '/srv/myipsec_con‐
272       tent(/.*)?'
273       restorecon -R -v /srv/myipsec_content
274
275       Note: SELinux often uses regular expressions  to  specify  labels  that
276       match multiple files.
277
278       The following file types are defined for ipsec:
279
280
281
282       ipsec_conf_file_t
283
284       -  Set  files with the ipsec_conf_file_t type, if you want to treat the
285       files as ipsec conf content.
286
287
288       Paths:
289            /etc/racoon(/.*)?,  /etc/strongimcv(/.*)?,  /etc/strongswan(/.*)?,
290            /etc/ipsec.conf, /etc/strongswan/ipsec.conf
291
292
293       ipsec_exec_t
294
295       -  Set  files  with the ipsec_exec_t type, if you want to transition an
296       executable to the ipsec_t domain.
297
298
299       Paths:
300            /usr/libexec/strongimcv/.*,            /usr/libexec/strongswan/.*,
301            /usr/lib/ipsec/spi,  /usr/lib/ipsec/pluto,  /usr/lib/ipsec/eroute,
302            /usr/libexec/ipsec/spi,                  /usr/libexec/ipsec/pluto,
303            /usr/lib/ipsec/klipsdebug,              /usr/libexec/ipsec/eroute,
304            /usr/libexec/ipsec/addconn, /usr/libexec/ipsec/klipsdebug
305
306
307       ipsec_initrc_exec_t
308
309       - Set files with the ipsec_initrc_exec_t type, if you want  to  transi‐
310       tion an executable to the ipsec_initrc_t domain.
311
312
313       Paths:
314            /etc/rc.d/init.d/ipsec,                   /etc/rc.d/init.d/racoon,
315            /etc/rc.d/init.d/strongswan
316
317
318       ipsec_key_file_t
319
320       - Set files with the ipsec_key_file_t type, if you want  to  treat  the
321       files as ipsec key content.
322
323
324       Paths:
325            /etc/ipsec.d(/.*)?, /etc/racoon/certs(/.*)?, /etc/ipsec.secrets.*,
326            /etc/strongswan/ipsec.d(/.*)?,    /etc/strongswan/ipsec.secrets.*,
327            /etc/racoon/psk.txt
328
329
330       ipsec_log_t
331
332       - Set files with the ipsec_log_t type, if you want to treat the data as
333       ipsec log data, usually stored under the /var/log directory.
334
335
336
337       ipsec_mgmt_devpts_t
338
339       - Set files with the ipsec_mgmt_devpts_t type, if you want to treat the
340       files as ipsec mgmt devpts data.
341
342
343
344       ipsec_mgmt_exec_t
345
346       -  Set files with the ipsec_mgmt_exec_t type, if you want to transition
347       an executable to the ipsec_mgmt_t domain.
348
349
350       Paths:
351            /usr/sbin/ipsec,     /usr/sbin/swanctl,      /usr/sbin/strongimcv,
352            /usr/sbin/strongswan,                    /usr/lib/ipsec/_plutorun,
353            /usr/lib/ipsec/_plutoload,           /usr/libexec/ipsec/_plutorun,
354            /usr/libexec/ipsec/_plutoload,   /usr/libexec/nm-openswan-service,
355            /usr/libexec/nm-libreswan-service
356
357
358       ipsec_mgmt_lock_t
359
360       - Set files with the ipsec_mgmt_lock_t type, if you want to  treat  the
361       files as ipsec mgmt lock data, stored under the /var/lock directory
362
363
364       Paths:
365            /var/lock/subsys/ipsec, /var/lock/subsys/strongswan
366
367
368       ipsec_mgmt_unit_file_t
369
370       -  Set files with the ipsec_mgmt_unit_file_t type, if you want to treat
371       the files as ipsec mgmt unit content.
372
373
374       Paths:
375            /usr/lib/systemd/system/ipsec.*,             /usr/lib/systemd/sys‐
376            tem/strongimcv.*,            /usr/lib/systemd/system/strongswan.*,
377            /usr/lib/systemd/system/strongswan-swanctl.*
378
379
380       ipsec_mgmt_var_run_t
381
382       - Set files with the ipsec_mgmt_var_run_t type, if you  want  to  store
383       the ipsec mgmt files under the /run or /var/run directory.
384
385
386       Paths:
387            /var/run/pluto/ipsec.info, /var/run/pluto/ipsec_setup.pid
388
389
390       ipsec_tmp_t
391
392       -  Set files with the ipsec_tmp_t type, if you want to store ipsec tem‐
393       porary files in the /tmp directories.
394
395
396
397       ipsec_var_run_t
398
399       - Set files with the ipsec_var_run_t type, if you  want  to  store  the
400       ipsec files under the /run or /var/run directory.
401
402
403       Paths:
404            /var/racoon(/.*)?,     /var/run/pluto(/.*)?,    /var/run/charon.*,
405            /var/run/racoon.pid, /var/run/charon.ctl, /var/run/charon.vici
406
407
408       Note: File context can be temporarily modified with the chcon  command.
409       If  you want to permanently change the file context you need to use the
410       semanage fcontext command.  This will modify the SELinux labeling data‐
411       base.  You will need to use restorecon to apply the labels.
412
413

COMMANDS

415       semanage  fcontext  can also be used to manipulate default file context
416       mappings.
417
418       semanage permissive can also be used to manipulate  whether  or  not  a
419       process type is permissive.
420
421       semanage  module can also be used to enable/disable/install/remove pol‐
422       icy modules.
423
424       semanage port can also be used to manipulate the port definitions
425
426       semanage boolean can also be used to manipulate the booleans
427
428
429       system-config-selinux is a GUI tool available to customize SELinux pol‐
430       icy settings.
431
432

AUTHOR

434       This manual page was auto-generated using sepolicy manpage .
435
436