amanda_selinux(8)

1amanda_selinux(8)            SELinux Policy amanda           amanda_selinux(8)
2
3
4

NAME

6       amanda_selinux  -  Security  Enhanced  Linux Policy for the amanda pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  amanda  processes  via  flexible
11       mandatory access control.
12
13       The  amanda  processes  execute with the amanda_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep amanda_t
20
21
22

ENTRYPOINTS

24       The  amanda_t  SELinux  type can be entered via the amanda_inetd_exec_t
25       file type.
26
27       The default entrypoint paths for the amanda_t domain are the following:
28
29       /usr/sbin/amandad,  /usr/lib/amanda/amandad,  /usr/lib/amanda/amindexd,
30       /usr/lib/amanda/amidxtaped
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       amanda  policy  is  very  flexible allowing users to setup their amanda
40       processes in as secure a method as possible.
41
42       The following process types are defined for amanda:
43
44       amanda_t, amanda_recover_t
45
46       Note: semanage permissive -a amanda_t can be used to make  the  process
47       type  amanda_t  permissive.  SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux  policy is customizable based on least access required.  amanda
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate the policy and run amanda with the tightest access possible.
56
57
58
59       If you want to allow users to resolve user passwd entries directly from
60       ldap rather then using a sssd server, you  must  turn  on  the  authlo‐
61       gin_nsswitch_use_ldap boolean. Disabled by default.
62
63       setsebool -P authlogin_nsswitch_use_ldap 1
64
65
66
67       If you want to allow all domains to execute in fips_mode, you must turn
68       on the fips_mode boolean. Enabled by default.
69
70       setsebool -P fips_mode 1
71
72
73
74       If you want to allow confined applications to run  with  kerberos,  you
75       must turn on the kerberos_enabled boolean. Disabled by default.
76
77       setsebool -P kerberos_enabled 1
78
79
80
81       If  you  want  to  allow  system  to run with NIS, you must turn on the
82       nis_enabled boolean. Disabled by default.
83
84       setsebool -P nis_enabled 1
85
86
87
88       If you want to allow confined applications to use nscd  shared  memory,
89       you must turn on the nscd_use_shm boolean. Disabled by default.
90
91       setsebool -P nscd_use_shm 1
92
93
94

PORT TYPES

96       SELinux defines port types to represent TCP and UDP ports.
97
98       You  can  see  the  types associated with a port by using the following
99       command:
100
101       semanage port -l
102
103
104       Policy governs the access  confined  processes  have  to  these  ports.
105       SELinux  amanda  policy  is very flexible allowing users to setup their
106       amanda processes in as secure a method as possible.
107
108       The following port types are defined for amanda:
109
110
111       amanda_port_t
112
113
114
115       Default Defined Ports:
116                 tcp 10080-10083
117                 udp 10080-10082
118

MANAGED FILES

120       The SELinux process type amanda_t can manage  files  labeled  with  the
121       following file types.  The paths listed are the default paths for these
122       file types.  Note the processes UID still need to have DAC permissions.
123
124       amanda_amandates_t
125
126            /etc/amandates
127
128       amanda_data_t
129
130            /etc/amanda/.*/index(/.*)?
131            /etc/amanda/.*/tapelist(/.*)?
132            /var/lib/amanda/[^/]+(/.*)?
133            /etc/amanda/DailySet1(/.*)?
134
135       amanda_dumpdates_t
136
137            /etc/dumpdates
138
139       amanda_gnutarlists_t
140
141            /var/lib/amanda/gnutar-lists(/.*)?
142
143       amanda_log_t
144
145            /var/log/amanda(/.*)?
146            /var/lib/amanda/[^/]*/log(/.*)?
147
148       amanda_tmp_t
149
150
151       amanda_tmpfs_t
152
153
154       amanda_var_lib_t
155
156            /var/lib/amanda(/.*)?
157            /var/lib/amanda/[^/]+/index(/.*)?
158            /var/lib/xfsdump/inventory(/.*)?
159            /var/lib/amanda
160
161       cluster_conf_t
162
163            /etc/cluster(/.*)?
164
165       cluster_var_lib_t
166
167            /var/lib/pcsd(/.*)?
168            /var/lib/cluster(/.*)?
169            /var/lib/openais(/.*)?
170            /var/lib/pengine(/.*)?
171            /var/lib/corosync(/.*)?
172            /usr/lib/heartbeat(/.*)?
173            /var/lib/heartbeat(/.*)?
174            /var/lib/pacemaker(/.*)?
175
176       cluster_var_run_t
177
178            /var/run/crm(/.*)?
179            /var/run/cman_.*
180            /var/run/rsctmp(/.*)?
181            /var/run/aisexec.*
182            /var/run/heartbeat(/.*)?
183            /var/run/corosync-qnetd(/.*)?
184            /var/run/corosync-qdevice(/.*)?
185            /var/run/corosync.pid
186            /var/run/cpglockd.pid
187            /var/run/rgmanager.pid
188            /var/run/cluster/rgmanager.sk
189
190       root_t
191
192            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
193            /
194            /initrd
195
196

FILE CONTEXTS

198       SELinux requires files to have an extended attribute to define the file
199       type.
200
201       You can see the context of a file using the -Z option to ls
202
203       Policy  governs  the  access  confined  processes  have to these files.
204       SELinux amanda policy is very flexible allowing users  to  setup  their
205       amanda processes in as secure a method as possible.
206
207       EQUIVALENCE DIRECTORIES
208
209
210       amanda  policy  stores  data with multiple different file context types
211       under the /var/lib/amanda directory.  If you would like  to  store  the
212       data  in a different directory you can use the semanage command to cre‐
213       ate an equivalence mapping.  If you wanted to store this data under the
214       /srv dirctory you would execute the following command:
215
216       semanage fcontext -a -e /var/lib/amanda /srv/amanda
217       restorecon -R -v /srv/amanda
218
219       STANDARD FILE CONTEXT
220
221       SELinux defines the file context types for the amanda, if you wanted to
222       store files with these types in a diffent paths, you  need  to  execute
223       the  semanage  command  to  sepecify  alternate  labeling  and then use
224       restorecon to put the labels on disk.
225
226       semanage  fcontext  -a  -t   amanda_recover_dir_t   '/srv/myamanda_con‐
227       tent(/.*)?'
228       restorecon -R -v /srv/myamanda_content
229
230       Note:  SELinux  often  uses  regular expressions to specify labels that
231       match multiple files.
232
233       The following file types are defined for amanda:
234
235
236
237       amanda_amandates_t
238
239       - Set files with the amanda_amandates_t type, if you want to treat  the
240       files as amanda amandates data.
241
242
243
244       amanda_config_t
245
246       -  Set  files  with  the amanda_config_t type, if you want to treat the
247       files as amanda configuration  data,  usually  stored  under  the  /etc
248       directory.
249
250
251       Paths:
252            /etc/amanda(/.*)?, /var/lib/amanda/.amandahosts
253
254
255       amanda_data_t
256
257       - Set files with the amanda_data_t type, if you want to treat the files
258       as amanda content.
259
260
261       Paths:
262            /etc/amanda/.*/index(/.*)?,         /etc/amanda/.*/tapelist(/.*)?,
263            /var/lib/amanda/[^/]+(/.*)?, /etc/amanda/DailySet1(/.*)?
264
265
266       amanda_dumpdates_t
267
268       -  Set files with the amanda_dumpdates_t type, if you want to treat the
269       files as amanda dumpdates data.
270
271
272
273       amanda_exec_t
274
275       - Set files with the amanda_exec_t type, if you want to  transition  an
276       executable to the amanda_t domain.
277
278
279
280       amanda_gnutarlists_t
281
282       -  Set  files  with the amanda_gnutarlists_t type, if you want to treat
283       the files as amanda gnutarlists data.
284
285
286
287       amanda_inetd_exec_t
288
289       - Set files with the amanda_inetd_exec_t type, if you want  to  transi‐
290       tion an executable to the amanda_inetd_t domain.
291
292
293       Paths:
294            /usr/sbin/amandad,  /usr/lib/amanda/amandad, /usr/lib/amanda/amin‐
295            dexd, /usr/lib/amanda/amidxtaped
296
297
298       amanda_log_t
299
300       - Set files with the amanda_log_t type, if you want to treat  the  data
301       as amanda log data, usually stored under the /var/log directory.
302
303
304       Paths:
305            /var/log/amanda(/.*)?, /var/lib/amanda/[^/]*/log(/.*)?
306
307
308       amanda_recover_dir_t
309
310       -  Set  files  with the amanda_recover_dir_t type, if you want to treat
311       the files as amanda recover dir data.
312
313
314
315       amanda_recover_exec_t
316
317       - Set files with the amanda_recover_exec_t type, if you want to transi‐
318       tion an executable to the amanda_recover_t domain.
319
320
321
322       amanda_tmp_t
323
324       -  Set  files  with  the amanda_tmp_t type, if you want to store amanda
325       temporary files in the /tmp directories.
326
327
328
329       amanda_tmpfs_t
330
331       - Set files with the amanda_tmpfs_t type, if you want to  store  amanda
332       files on a tmpfs file system.
333
334
335
336       amanda_unit_file_t
337
338       -  Set files with the amanda_unit_file_t type, if you want to treat the
339       files as amanda unit content.
340
341
342
343       amanda_usr_lib_t
344
345       - Set files with the amanda_usr_lib_t type, if you want  to  treat  the
346       files as amanda usr lib data.
347
348
349
350       amanda_var_lib_t
351
352       -  Set  files  with the amanda_var_lib_t type, if you want to store the
353       amanda files under the /var/lib directory.
354
355
356       Paths:
357            /var/lib/amanda(/.*)?,          /var/lib/amanda/[^/]+/index(/.*)?,
358            /var/lib/xfsdump/inventory(/.*)?, /var/lib/amanda
359
360
361       Note:  File context can be temporarily modified with the chcon command.
362       If you want to permanently change the file context you need to use  the
363       semanage fcontext command.  This will modify the SELinux labeling data‐
364       base.  You will need to use restorecon to apply the labels.
365
366

COMMANDS

368       semanage fcontext can also be used to manipulate default  file  context
369       mappings.
370
371       semanage  permissive  can  also  be used to manipulate whether or not a
372       process type is permissive.
373
374       semanage module can also be used to enable/disable/install/remove  pol‐
375       icy modules.
376
377       semanage port can also be used to manipulate the port definitions
378
379       semanage boolean can also be used to manipulate the booleans
380
381
382       system-config-selinux is a GUI tool available to customize SELinux pol‐
383       icy settings.
384
385

AUTHOR

387       This manual page was auto-generated using sepolicy manpage .
388
389