1chronyd_selinux(8) SELinux Policy chronyd chronyd_selinux(8)
2
6 chronyd_selinux - Security Enhanced Linux Policy for the chronyd pro‐
7 cesses
8
10 Security-Enhanced Linux secures the chronyd processes via flexible
11 mandatory access control.
12 The chronyd processes execute with the chronyd_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep chronyd_t
20
24 The chronyd_t SELinux type can be entered via the chronyd_exec_t file
25 type.
26 The default entrypoint paths for the chronyd_t domain are the follow‐
28 ing:
29 /usr/sbin/chronyd, /usr/libexec/chrony-helper
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 chronyd policy is very flexible allowing users to setup their chronyd
40 processes in as secure a method as possible.
41 The following process types are defined for chronyd:
43 chronyd_t
45 Note: semanage permissive -a chronyd_t can be used to make the process
47 type chronyd_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required. chronyd
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run chronyd with the tightest access possi‐
56 ble.
57 If you want to allow users to resolve user passwd entries directly from
61 ldap rather then using a sssd server, you must turn on the authlo‐
62 gin_nsswitch_use_ldap boolean. Disabled by default.
63 setsebool -P authlogin_nsswitch_use_ldap 1
65 If you want to allow all domains to execute in fips_mode, you must turn
69 on the fips_mode boolean. Enabled by default.
70 setsebool -P fips_mode 1
72 If you want to allow confined applications to run with kerberos, you
76 must turn on the kerberos_enabled boolean. Disabled by default.
77 setsebool -P kerberos_enabled 1
79 If you want to allow system to run with NIS, you must turn on the
83 nis_enabled boolean. Disabled by default.
84 setsebool -P nis_enabled 1
86 If you want to allow confined applications to use nscd shared memory,
90 you must turn on the nscd_use_shm boolean. Disabled by default.
91 setsebool -P nscd_use_shm 1
93
97 SELinux defines port types to represent TCP and UDP ports.
98 You can see the types associated with a port by using the following
100 command:
101 semanage port -l
103 Policy governs the access confined processes have to these ports.
106 SELinux chronyd policy is very flexible allowing users to setup their
107 chronyd processes in as secure a method as possible.
108 The following port types are defined for chronyd:
110 chronyd_port_t
113 Default Defined Ports:
117 udp 323
118
120 The SELinux process type chronyd_t can manage files labeled with the
121 following file types. The paths listed are the default paths for these
122 file types. Note the processes UID still need to have DAC permissions.
123 chronyd_tmp_t
125 chronyd_tmpfs_t
128 chronyd_var_lib_t
131 /var/lib/chrony(/.*)?
133 chronyd_var_run_t
135 /var/run/chrony(/.*)?
137 /var/run/chronyd(/.*)?
138 /var/run/chrony-helper(/.*)?
139 /var/run/chronyd.pid
140 /var/run/chronyd.sock
141 cluster_conf_t
143 /etc/cluster(/.*)?
145 cluster_var_lib_t
147 /var/lib/pcsd(/.*)?
149 /var/lib/cluster(/.*)?
150 /var/lib/openais(/.*)?
151 /var/lib/pengine(/.*)?
152 /var/lib/corosync(/.*)?
153 /usr/lib/heartbeat(/.*)?
154 /var/lib/heartbeat(/.*)?
155 /var/lib/pacemaker(/.*)?
156 cluster_var_run_t
158 /var/run/crm(/.*)?
160 /var/run/cman_.*
161 /var/run/rsctmp(/.*)?
162 /var/run/aisexec.*
163 /var/run/heartbeat(/.*)?
164 /var/run/corosync-qnetd(/.*)?
165 /var/run/corosync-qdevice(/.*)?
166 /var/run/corosync.pid
167 /var/run/cpglockd.pid
168 /var/run/rgmanager.pid
169 /var/run/cluster/rgmanager.sk
170 gpsd_tmpfs_t
172 root_t
175 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
177 /
178 /initrd
179 systemd_passwd_var_run_t
181 /var/run/systemd/ask-password(/.*)?
183 /var/run/systemd/ask-password-block(/.*)?
184 timemaster_tmpfs_t
186
190 SELinux requires files to have an extended attribute to define the file
191 type.
192 You can see the context of a file using the -Z option to ls
194 Policy governs the access confined processes have to these files.
196 SELinux chronyd policy is very flexible allowing users to setup their
197 chronyd processes in as secure a method as possible.
198 EQUIVALENCE DIRECTORIES
200 chronyd policy stores data with multiple different file context types
203 under the /var/run/chrony directory. If you would like to store the
204 data in a different directory you can use the semanage command to cre‐
205 ate an equivalence mapping. If you wanted to store this data under the
206 /srv dirctory you would execute the following command:
207 semanage fcontext -a -e /var/run/chrony /srv/chrony
209 restorecon -R -v /srv/chrony
210 STANDARD FILE CONTEXT
212 SELinux defines the file context types for the chronyd, if you wanted
214 to store files with these types in a diffent paths, you need to execute
215 the semanage command to sepecify alternate labeling and then use
216 restorecon to put the labels on disk.
217 semanage fcontext -a -t chronyd_tmp_t '/srv/mychronyd_content(/.*)?'
219 restorecon -R -v /srv/mychronyd_content
220 Note: SELinux often uses regular expressions to specify labels that
222 match multiple files.
223 The following file types are defined for chronyd:
225 chronyd_exec_t
229 - Set files with the chronyd_exec_t type, if you want to transition an
231 executable to the chronyd_t domain.
232 Paths:
235 /usr/sbin/chronyd, /usr/libexec/chrony-helper
236 chronyd_initrc_exec_t
239 - Set files with the chronyd_initrc_exec_t type, if you want to transi‐
241 tion an executable to the chronyd_initrc_t domain.
242 chronyd_keys_t
246 - Set files with the chronyd_keys_t type, if you want to treat the
248 files as chronyd keys data.
249 chronyd_tmp_t
253 - Set files with the chronyd_tmp_t type, if you want to store chronyd
255 temporary files in the /tmp directories.
256 chronyd_tmpfs_t
260 - Set files with the chronyd_tmpfs_t type, if you want to store chronyd
262 files on a tmpfs file system.
263 chronyd_unit_file_t
267 - Set files with the chronyd_unit_file_t type, if you want to treat the
269 files as chronyd unit content.
270 chronyd_var_lib_t
274 - Set files with the chronyd_var_lib_t type, if you want to store the
276 chronyd files under the /var/lib directory.
277 chronyd_var_log_t
281 - Set files with the chronyd_var_log_t type, if you want to treat the
283 data as chronyd var log data, usually stored under the /var/log direc‐
284 tory.
285 chronyd_var_run_t
289 - Set files with the chronyd_var_run_t type, if you want to store the
291 chronyd files under the /run or /var/run directory.
292 Paths:
295 /var/run/chrony(/.*)?, /var/run/chronyd(/.*)?, /var/run/chrony-
296 helper(/.*)?, /var/run/chronyd.pid, /var/run/chronyd.sock
297 Note: File context can be temporarily modified with the chcon command.
300 If you want to permanently change the file context you need to use the
301 semanage fcontext command. This will modify the SELinux labeling data‐
302 base. You will need to use restorecon to apply the labels.
303
306 semanage fcontext can also be used to manipulate default file context
307 mappings.
308 semanage permissive can also be used to manipulate whether or not a
310 process type is permissive.
311 semanage module can also be used to enable/disable/install/remove pol‐
313 icy modules.
314 semanage port can also be used to manipulate the port definitions
316 semanage boolean can also be used to manipulate the booleans
318 system-config-selinux is a GUI tool available to customize SELinux pol‐
321 icy settings.
322
325 This manual page was auto-generated using sepolicy manpage .
326
329 selinux(8), chronyd(8), semanage(8), restorecon(8), chcon(1), sepol‐
330 icy(8), setsebool(8)
331chronyd 19-12-02 chronyd_selinux(8)