1kdumpgui_selinux(8) SELinux Policy kdumpgui kdumpgui_selinux(8)
2
6 kdumpgui_selinux - Security Enhanced Linux Policy for the kdumpgui pro‐
7 cesses
8
10 Security-Enhanced Linux secures the kdumpgui processes via flexible
11 mandatory access control.
12 The kdumpgui processes execute with the kdumpgui_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep kdumpgui_t
20
24 The kdumpgui_t SELinux type can be entered via the kdumpgui_exec_t file
25 type.
26 The default entrypoint paths for the kdumpgui_t domain are the follow‐
28 ing:
29 /usr/share/system-config-kdump/system-config-kdump-backend.py
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 kdumpgui policy is very flexible allowing users to setup their kdumpgui
40 processes in as secure a method as possible.
41 The following process types are defined for kdumpgui:
43 kdumpgui_t
45 Note: semanage permissive -a kdumpgui_t can be used to make the process
47 type kdumpgui_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required.
54 kdumpgui policy is extremely flexible and has several booleans that
55 allow you to manipulate the policy and run kdumpgui with the tightest
56 access possible.
57 If you want to allow s-c-kdump to run bootloader in bootloader_t, you
61 must turn on the kdumpgui_run_bootloader boolean. Enabled by default.
62 setsebool -P kdumpgui_run_bootloader 1
64 If you want to allow users to resolve user passwd entries directly from
68 ldap rather then using a sssd server, you must turn on the authlo‐
69 gin_nsswitch_use_ldap boolean. Disabled by default.
70 setsebool -P authlogin_nsswitch_use_ldap 1
72 If you want to allow all domains to execute in fips_mode, you must turn
76 on the fips_mode boolean. Enabled by default.
77 setsebool -P fips_mode 1
79 If you want to allow confined applications to run with kerberos, you
83 must turn on the kerberos_enabled boolean. Enabled by default.
84 setsebool -P kerberos_enabled 1
86 If you want to allow system to run with NIS, you must turn on the
90 nis_enabled boolean. Disabled by default.
91 setsebool -P nis_enabled 1
93 If you want to allow confined applications to use nscd shared memory,
97 you must turn on the nscd_use_shm boolean. Disabled by default.
98 setsebool -P nscd_use_shm 1
100
104 The SELinux process type kdumpgui_t can manage files labeled with the
105 following file types. The paths listed are the default paths for these
106 file types. Note the processes UID still need to have DAC permissions.
107 boot_t
109 /efi(/.*)?
111 /boot/.*
112 /vmlinuz.*
113 /initrd.img.*
114 /boot
115 bootloader_etc_t
117 /etc/lilo.conf.*
119 /etc/zipl.conf.*
120 /etc/yaboot.conf.*
121 /etc/default/grub
122 cluster_conf_t
124 /etc/cluster(/.*)?
126 cluster_var_lib_t
128 /var/lib/pcsd(/.*)?
130 /var/lib/cluster(/.*)?
131 /var/lib/openais(/.*)?
132 /var/lib/pengine(/.*)?
133 /var/lib/corosync(/.*)?
134 /usr/lib/heartbeat(/.*)?
135 /var/lib/heartbeat(/.*)?
136 /var/lib/pacemaker(/.*)?
137 cluster_var_run_t
139 /var/run/crm(/.*)?
141 /var/run/cman_.*
142 /var/run/rsctmp(/.*)?
143 /var/run/aisexec.*
144 /var/run/heartbeat(/.*)?
145 /var/run/corosync-qnetd(/.*)?
146 /var/run/corosync-qdevice(/.*)?
147 /var/run/corosync.pid
148 /var/run/cpglockd.pid
149 /var/run/rgmanager.pid
150 /var/run/cluster/rgmanager.sk
151 dosfs_t
153 etc_runtime_t
156 /[^/]+
158 /etc/mtab.*
159 /etc/blkid(/.*)?
160 /etc/nologin.*
161 /etc/.fstab.hal..+
162 /halt
163 /fastboot
164 /poweroff
165 /.autofsck
166 /etc/cmtab
167 /forcefsck
168 /.suspended
169 /fsckoptions
170 /.autorelabel
171 /etc/.updated
172 /var/.updated
173 /etc/killpower
174 /etc/nohotplug
175 /etc/securetty
176 /etc/ioctl.save
177 /etc/fstab.REVOKE
178 /etc/network/ifstate
179 /etc/sysconfig/hwconf
180 /etc/ptal/ptal-printd-like
181 /etc/sysconfig/iptables.save
182 /etc/xorg.conf.d/00-system-setup-keyboard.conf
183 /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
184 kdump_etc_t
186 /etc/kdump.conf
188 kdumpgui_tmp_t
190 root_t
193 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
195 /
196 /initrd
197 systemd_passwd_var_run_t
199 /var/run/systemd/ask-password(/.*)?
201 /var/run/systemd/ask-password-block(/.*)?
202
205 SELinux requires files to have an extended attribute to define the file
206 type.
207 You can see the context of a file using the -Z option to ls
209 Policy governs the access confined processes have to these files.
211 SELinux kdumpgui policy is very flexible allowing users to setup their
212 kdumpgui processes in as secure a method as possible.
213 STANDARD FILE CONTEXT
215 SELinux defines the file context types for the kdumpgui, if you wanted
217 to store files with these types in a diffent paths, you need to execute
218 the semanage command to sepecify alternate labeling and then use
219 restorecon to put the labels on disk.
220 semanage fcontext -a -t kdumpgui_tmp_t '/srv/mykdumpgui_content(/.*)?'
222 restorecon -R -v /srv/mykdumpgui_content
223 Note: SELinux often uses regular expressions to specify labels that
225 match multiple files.
226 The following file types are defined for kdumpgui:
228 kdumpgui_exec_t
232 - Set files with the kdumpgui_exec_t type, if you want to transition an
234 executable to the kdumpgui_t domain.
235 kdumpgui_tmp_t
239 - Set files with the kdumpgui_tmp_t type, if you want to store kdumpgui
241 temporary files in the /tmp directories.
242 Note: File context can be temporarily modified with the chcon command.
246 If you want to permanently change the file context you need to use the
247 semanage fcontext command. This will modify the SELinux labeling data‐
248 base. You will need to use restorecon to apply the labels.
249
252 semanage fcontext can also be used to manipulate default file context
253 mappings.
254 semanage permissive can also be used to manipulate whether or not a
256 process type is permissive.
257 semanage module can also be used to enable/disable/install/remove pol‐
259 icy modules.
260 semanage boolean can also be used to manipulate the booleans
262 system-config-selinux is a GUI tool available to customize SELinux pol‐
265 icy settings.
266
269 This manual page was auto-generated using sepolicy manpage .
270
273 selinux(8), kdumpgui(8), semanage(8), restorecon(8), chcon(1), sepol‐
274 icy(8), setsebool(8)
275kdumpgui 19-06-18 kdumpgui_selinux(8)