1cluster_selinux(8) SELinux Policy cluster cluster_selinux(8)
2
6 cluster_selinux - Security Enhanced Linux Policy for the cluster pro‐
7 cesses
8
10 Security-Enhanced Linux secures the cluster processes via flexible
11 mandatory access control.
12 The cluster processes execute with the cluster_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep cluster_t
20
24 The cluster_t SELinux type can be entered via the cluster_exec_t file
25 type.
26 The default entrypoint paths for the cluster_t domain are the follow‐
28 ing:
29 /usr/sbin/pcsd, /usr/sbin/aisexec, /usr/lib/pcsd/pcsd,
31 /usr/sbin/ccs_tool, /usr/sbin/corosync, /usr/sbin/cpglockd,
32 /usr/sbin/cman_tool, /usr/sbin/rgmanager, /usr/sbin/ldirectord,
33 /usr/sbin/pacemakerd, /usr/bin/corosync-qnetd, /usr/sbin/corosync-noti‐
34 fyd, /usr/sbin/corosync-qdevice, /usr/sbin/pacemaker-remoted,
35 /usr/sbin/pacemaker_remoted, /usr/lib/heartbeat/heartbeat,
36 /usr/share/corosync/corosync, /usr/share/corosync/corosync-qdevice
37
39 SELinux defines process types (domains) for each process running on the
40 system
41 You can see the context of a process using the -Z option to ps
43 Policy governs the access confined processes have to files. SELinux
45 cluster policy is very flexible allowing users to setup their cluster
46 processes in as secure a method as possible.
47 The following process types are defined for cluster:
49 cluster_t
51 Note: semanage permissive -a cluster_t can be used to make the process
53 type cluster_t permissive. SELinux does not deny access to permissive
54 process types, but the AVC (SELinux denials) messages are still gener‐
55 ated.
56
59 SELinux policy is customizable based on least access required. cluster
60 policy is extremely flexible and has several booleans that allow you to
61 manipulate the policy and run cluster with the tightest access possi‐
62 ble.
63 If you want to allow cluster administrative domains to connect to the
67 network using TCP, you must turn on the cluster_can_network_connect
68 boolean. Disabled by default.
69 setsebool -P cluster_can_network_connect 1
71 If you want to allow cluster administrative domains to manage all files
75 on a system, you must turn on the cluster_manage_all_files boolean.
76 Disabled by default.
77 setsebool -P cluster_manage_all_files 1
79 If you want to allow cluster administrative cluster domains memcheck-
83 amd64- to use executable memory, you must turn on the clus‐
84 ter_use_execmem boolean. Disabled by default.
85 setsebool -P cluster_use_execmem 1
87 If you want to allow users to resolve user passwd entries directly from
91 ldap rather then using a sssd server, you must turn on the authlo‐
92 gin_nsswitch_use_ldap boolean. Disabled by default.
93 setsebool -P authlogin_nsswitch_use_ldap 1
95 If you want to deny user domains applications to map a memory region as
99 both executable and writable, this is dangerous and the executable
100 should be reported in bugzilla, you must turn on the deny_execmem bool‐
101 ean. Enabled by default.
102 setsebool -P deny_execmem 1
104 If you want to allow all domains to execute in fips_mode, you must turn
108 on the fips_mode boolean. Enabled by default.
109 setsebool -P fips_mode 1
111 If you want to allow confined applications to run with kerberos, you
115 must turn on the kerberos_enabled boolean. Enabled by default.
116 setsebool -P kerberos_enabled 1
118 If you want to control the ability to mmap a low area of the address
122 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
123 the mmap_low_allowed boolean. Disabled by default.
124 setsebool -P mmap_low_allowed 1
126 If you want to allow system to run with NIS, you must turn on the
130 nis_enabled boolean. Disabled by default.
131 setsebool -P nis_enabled 1
133 If you want to allow confined applications to use nscd shared memory,
137 you must turn on the nscd_use_shm boolean. Disabled by default.
138 setsebool -P nscd_use_shm 1
140 If you want to disable kernel module loading, you must turn on the
144 secure_mode_insmod boolean. Enabled by default.
145 setsebool -P secure_mode_insmod 1
147 If you want to allow unconfined executables to make their heap memory
151 executable. Doing this is a really bad idea. Probably indicates a
152 badly coded executable, but could indicate an attack. This executable
153 should be reported in bugzilla, you must turn on the selin‐
154 uxuser_execheap boolean. Disabled by default.
155 setsebool -P selinuxuser_execheap 1
157 If you want to allow unconfined executables to make their stack exe‐
161 cutable. This should never, ever be necessary. Probably indicates a
162 badly coded executable, but could indicate an attack. This executable
163 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
164 stack boolean. Enabled by default.
165 setsebool -P selinuxuser_execstack 1
167
171 If you want to allow users to resolve user passwd entries directly from
172 ldap rather then using a sssd server for the cluster_t, you must turn
173 on the authlogin_nsswitch_use_ldap boolean.
174 setsebool -P authlogin_nsswitch_use_ldap 1
176 If you want to allow confined applications to run with kerberos for the
179 cluster_t, you must turn on the kerberos_enabled boolean.
180 setsebool -P kerberos_enabled 1
182
185 SELinux defines port types to represent TCP and UDP ports.
186 You can see the types associated with a port by using the following
188 command:
189 semanage port -l
191 Policy governs the access confined processes have to these ports.
194 SELinux cluster policy is very flexible allowing users to setup their
195 cluster processes in as secure a method as possible.
196 The following port types are defined for cluster:
198 cluster_port_t
201 Default Defined Ports:
205 tcp 5149,40040,50006-50008
206 udp 5149,50006-50008
207
209 The SELinux process type cluster_t can manage files labeled with the
210 following file types. The paths listed are the default paths for these
211 file types. Note the processes UID still need to have DAC permissions.
212 file_type
214 all files on the system
216
219 SELinux requires files to have an extended attribute to define the file
220 type.
221 You can see the context of a file using the -Z option to ls
223 Policy governs the access confined processes have to these files.
225 SELinux cluster policy is very flexible allowing users to setup their
226 cluster processes in as secure a method as possible.
227 EQUIVALENCE DIRECTORIES
229 cluster policy stores data with multiple different file context types
232 under the /var/log/pacemaker directory. If you would like to store the
233 data in a different directory you can use the semanage command to cre‐
234 ate an equivalence mapping. If you wanted to store this data under the
235 /srv dirctory you would execute the following command:
236 semanage fcontext -a -e /var/log/pacemaker /srv/pacemaker
238 restorecon -R -v /srv/pacemaker
239 STANDARD FILE CONTEXT
241 SELinux defines the file context types for the cluster, if you wanted
243 to store files with these types in a diffent paths, you need to execute
244 the semanage command to sepecify alternate labeling and then use
245 restorecon to put the labels on disk.
246 semanage fcontext -a -t cluster_unit_file_t '/srv/mycluster_con‐
248 tent(/.*)?'
249 restorecon -R -v /srv/mycluster_content
250 Note: SELinux often uses regular expressions to specify labels that
252 match multiple files.
253 The following file types are defined for cluster:
255 cluster_conf_t
259 - Set files with the cluster_conf_t type, if you want to treat the
261 files as cluster configuration data, usually stored under the /etc
262 directory.
263 cluster_exec_t
267 - Set files with the cluster_exec_t type, if you want to transition an
269 executable to the cluster_t domain.
270 Paths:
273 /usr/sbin/pcsd, /usr/sbin/aisexec, /usr/lib/pcsd/pcsd,
274 /usr/sbin/ccs_tool, /usr/sbin/corosync, /usr/sbin/cpglockd,
275 /usr/sbin/cman_tool, /usr/sbin/rgmanager, /usr/sbin/ldirectord,
276 /usr/sbin/pacemakerd, /usr/bin/corosync-qnetd, /usr/sbin/corosync-
277 notifyd, /usr/sbin/corosync-qdevice, /usr/sbin/pacemaker-remoted,
278 /usr/sbin/pacemaker_remoted, /usr/lib/heartbeat/heartbeat,
279 /usr/share/corosync/corosync, /usr/share/corosync/corosync-qdevice
280 cluster_initrc_exec_t
283 - Set files with the cluster_initrc_exec_t type, if you want to transi‐
285 tion an executable to the cluster_initrc_t domain.
286 Paths:
289 /etc/rc.d/init.d/openais, /etc/rc.d/init.d/corosync,
290 /etc/rc.d/init.d/cpglockd, /etc/rc.d/init.d/heartbeat,
291 /etc/rc.d/init.d/pacemaker, /etc/rc.d/init.d/rgmanager
292 cluster_tmp_t
295 - Set files with the cluster_tmp_t type, if you want to store cluster
297 temporary files in the /tmp directories.
298 cluster_tmpfs_t
302 - Set files with the cluster_tmpfs_t type, if you want to store cluster
304 files on a tmpfs file system.
305 cluster_unit_file_t
309 - Set files with the cluster_unit_file_t type, if you want to treat the
311 files as cluster unit content.
312 Paths:
315 /usr/lib/systemd/system/pcsd.*, /usr/lib/systemd/sys‐
316 tem/corosync.*, /usr/lib/systemd/system/pacemaker.*, /usr/lib/sys‐
317 temd/system/corosync-qnetd.*, /usr/lib/systemd/system/corosync-
318 qdevice.*
319 cluster_var_lib_t
322 - Set files with the cluster_var_lib_t type, if you want to store the
324 cluster files under the /var/lib directory.
325 Paths:
328 /var/lib/pcsd(/.*)?, /var/lib/cluster(/.*)?, /var/lib/ope‐
329 nais(/.*)?, /var/lib/pengine(/.*)?, /var/lib/corosync(/.*)?,
330 /usr/lib/heartbeat(/.*)?, /var/lib/heartbeat(/.*)?, /var/lib/pace‐
331 maker(/.*)?
332 cluster_var_log_t
335 - Set files with the cluster_var_log_t type, if you want to treat the
337 data as cluster var log data, usually stored under the /var/log direc‐
338 tory.
339 Paths:
342 /var/log/pcsd(/.*)?, /var/log/pacemaker(/.*)?, /var/log/pace‐
343 maker.log.*, /var/log/cluster/aisexec.log.*, /var/log/clus‐
344 ter/corosync.log.*, /var/log/cluster/cpglockd.log.*,
345 /var/log/cluster/rgmanager.log.*
346 cluster_var_run_t
349 - Set files with the cluster_var_run_t type, if you want to store the
351 cluster files under the /run or /var/run directory.
352 Paths:
355 /var/run/crm(/.*)?, /var/run/cman_.*, /var/run/rsctmp(/.*)?,
356 /var/run/aisexec.*, /var/run/heartbeat(/.*)?, /var/run/corosync-
357 qnetd(/.*)?, /var/run/corosync-qdevice(/.*)?,
358 /var/run/corosync.pid, /var/run/cpglockd.pid, /var/run/rgman‐
359 ager.pid, /var/run/cluster/rgmanager.sk
360 Note: File context can be temporarily modified with the chcon command.
363 If you want to permanently change the file context you need to use the
364 semanage fcontext command. This will modify the SELinux labeling data‐
365 base. You will need to use restorecon to apply the labels.
366
369 semanage fcontext can also be used to manipulate default file context
370 mappings.
371 semanage permissive can also be used to manipulate whether or not a
373 process type is permissive.
374 semanage module can also be used to enable/disable/install/remove pol‐
376 icy modules.
377 semanage port can also be used to manipulate the port definitions
379 semanage boolean can also be used to manipulate the booleans
381 system-config-selinux is a GUI tool available to customize SELinux pol‐
384 icy settings.
385
388 This manual page was auto-generated using sepolicy manpage .
389
392 selinux(8), cluster(8), semanage(8), restorecon(8), chcon(1), sepol‐
393 icy(8), setsebool(8)
394cluster 19-06-18 cluster_selinux(8)