1innd_selinux(8) SELinux Policy innd innd_selinux(8)
2
6 innd_selinux - Security Enhanced Linux Policy for the innd processes
7
9 Security-Enhanced Linux secures the innd processes via flexible manda‐
10 tory access control.
11 The innd processes execute with the innd_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15 For example:
17 ps -eZ | grep innd_t
19
23 The innd_t SELinux type can be entered via the innd_exec_t file type.
24 The default entrypoint paths for the innd_t domain are the following:
26 /usr/sbin/innd.*, /usr/libexec/news/rc.news, /usr/bin/suck,
28 /etc/news/boot, /usr/bin/inews, /usr/bin/rnews, /usr/bin/rpost,
29 /usr/sbin/in.nnrpd, /usr/libexec/news/sm, /usr/libexec/news/innd,
30 /usr/libexec/news/inews, /usr/libexec/news/inndf,
31 /usr/libexec/news/nnrpd, /usr/libexec/news/rnews,
32 /usr/libexec/news/expire, /usr/libexec/news/fastrm,
33 /usr/libexec/news/shlock, /usr/libexec/news/actsync,
34 /usr/libexec/news/archive, /usr/libexec/news/batcher,
35 /usr/libexec/news/ctlinnd, /usr/libexec/news/getlist,
36 /usr/libexec/news/innfeed, /usr/libexec/news/innxmit,
37 /usr/libexec/news/makedbz, /usr/libexec/news/nntpget,
38 /usr/libexec/news/buffchan, /usr/libexec/news/convdate,
39 /usr/libexec/news/cvtbatch, /usr/libexec/news/filechan,
40 /usr/libexec/news/overchan, /usr/libexec/news/inndstart,
41 /usr/libexec/news/innxbatch, /usr/libexec/newsinnconfval,
42 /usr/libexec/news/expireover, /usr/libexec/news/shrinkfile,
43 /usr/libexec/news/grephistory, /usr/libexec/news/makehistory,
44 /usr/libexec/news/newsrequeue, /usr/libexec/news/ovdb_recover,
45 /usr/libexec/news/prunehistory, /usr/libexec/news/startinnfeed
46
48 SELinux defines process types (domains) for each process running on the
49 system
50 You can see the context of a process using the -Z option to ps
52 Policy governs the access confined processes have to files. SELinux
54 innd policy is very flexible allowing users to setup their innd pro‐
55 cesses in as secure a method as possible.
56 The following process types are defined for innd:
58 innd_t
60 Note: semanage permissive -a innd_t can be used to make the process
62 type innd_t permissive. SELinux does not deny access to permissive
63 process types, but the AVC (SELinux denials) messages are still gener‐
64 ated.
65
68 SELinux policy is customizable based on least access required. innd
69 policy is extremely flexible and has several booleans that allow you to
70 manipulate the policy and run innd with the tightest access possible.
71 If you want to allow users to resolve user passwd entries directly from
75 ldap rather then using a sssd server, you must turn on the authlo‐
76 gin_nsswitch_use_ldap boolean. Disabled by default.
77 setsebool -P authlogin_nsswitch_use_ldap 1
79 If you want to allow all domains to execute in fips_mode, you must turn
83 on the fips_mode boolean. Enabled by default.
84 setsebool -P fips_mode 1
86 If you want to allow confined applications to run with kerberos, you
90 must turn on the kerberos_enabled boolean. Disabled by default.
91 setsebool -P kerberos_enabled 1
93 If you want to allow system to run with NIS, you must turn on the
97 nis_enabled boolean. Disabled by default.
98 setsebool -P nis_enabled 1
100 If you want to allow confined applications to use nscd shared memory,
104 you must turn on the nscd_use_shm boolean. Disabled by default.
105 setsebool -P nscd_use_shm 1
107
111 SELinux defines port types to represent TCP and UDP ports.
112 You can see the types associated with a port by using the following
114 command:
115 semanage port -l
117 Policy governs the access confined processes have to these ports.
120 SELinux innd policy is very flexible allowing users to setup their innd
121 processes in as secure a method as possible.
122 The following port types are defined for innd:
124 innd_port_t
127 Default Defined Ports:
131 tcp 119
132
134 The SELinux process type innd_t can manage files labeled with the fol‐
135 lowing file types. The paths listed are the default paths for these
136 file types. Note the processes UID still need to have DAC permissions.
137 cluster_conf_t
139 /etc/cluster(/.*)?
141 cluster_var_lib_t
143 /var/lib/pcsd(/.*)?
145 /var/lib/cluster(/.*)?
146 /var/lib/openais(/.*)?
147 /var/lib/pengine(/.*)?
148 /var/lib/corosync(/.*)?
149 /usr/lib/heartbeat(/.*)?
150 /var/lib/heartbeat(/.*)?
151 /var/lib/pacemaker(/.*)?
152 cluster_var_run_t
154 /var/run/crm(/.*)?
156 /var/run/cman_.*
157 /var/run/rsctmp(/.*)?
158 /var/run/aisexec.*
159 /var/run/heartbeat(/.*)?
160 /var/run/corosync-qnetd(/.*)?
161 /var/run/corosync-qdevice(/.*)?
162 /var/run/corosync.pid
163 /var/run/cpglockd.pid
164 /var/run/rgmanager.pid
165 /var/run/cluster/rgmanager.sk
166 innd_log_t
168 /var/log/news(/.*)?
170 innd_var_lib_t
172 /var/lib/news(/.*)?
174 innd_var_run_t
176 /var/run/innd(/.*)?
178 /var/run/news(/.*)?
179 /var/run/innd.pid
180 /var/run/news.pid
181 news_spool_t
183 /var/spool/news(/.*)?
185 root_t
187 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
189 /
190 /initrd
191
194 SELinux requires files to have an extended attribute to define the file
195 type.
196 You can see the context of a file using the -Z option to ls
198 Policy governs the access confined processes have to these files.
200 SELinux innd policy is very flexible allowing users to setup their innd
201 processes in as secure a method as possible.
202 EQUIVALENCE DIRECTORIES
204 innd policy stores data with multiple different file context types
207 under the /var/run/innd directory. If you would like to store the data
208 in a different directory you can use the semanage command to create an
209 equivalence mapping. If you wanted to store this data under the /srv
210 dirctory you would execute the following command:
211 semanage fcontext -a -e /var/run/innd /srv/innd
213 restorecon -R -v /srv/innd
214 innd policy stores data with multiple different file context types
216 under the /var/run/news directory. If you would like to store the data
217 in a different directory you can use the semanage command to create an
218 equivalence mapping. If you wanted to store this data under the /srv
219 dirctory you would execute the following command:
220 semanage fcontext -a -e /var/run/news /srv/news
222 restorecon -R -v /srv/news
223 STANDARD FILE CONTEXT
225 SELinux defines the file context types for the innd, if you wanted to
227 store files with these types in a diffent paths, you need to execute
228 the semanage command to sepecify alternate labeling and then use
229 restorecon to put the labels on disk.
230 semanage fcontext -a -t innd_var_run_t '/srv/myinnd_content(/.*)?'
232 restorecon -R -v /srv/myinnd_content
233 Note: SELinux often uses regular expressions to specify labels that
235 match multiple files.
236 The following file types are defined for innd:
238 innd_etc_t
242 - Set files with the innd_etc_t type, if you want to store innd files
244 in the /etc directories.
245 innd_exec_t
249 - Set files with the innd_exec_t type, if you want to transition an
251 executable to the innd_t domain.
252 Paths:
255 /usr/sbin/innd.*, /usr/libexec/news/rc.news, /usr/bin/suck,
256 /etc/news/boot, /usr/bin/inews, /usr/bin/rnews, /usr/bin/rpost,
257 /usr/sbin/in.nnrpd, /usr/libexec/news/sm, /usr/libexec/news/innd,
258 /usr/libexec/news/inews, /usr/libexec/news/inndf,
259 /usr/libexec/news/nnrpd, /usr/libexec/news/rnews,
260 /usr/libexec/news/expire, /usr/libexec/news/fastrm,
261 /usr/libexec/news/shlock, /usr/libexec/news/actsync,
262 /usr/libexec/news/archive, /usr/libexec/news/batcher,
263 /usr/libexec/news/ctlinnd, /usr/libexec/news/getlist,
264 /usr/libexec/news/innfeed, /usr/libexec/news/innxmit,
265 /usr/libexec/news/makedbz, /usr/libexec/news/nntpget,
266 /usr/libexec/news/buffchan, /usr/libexec/news/convdate,
267 /usr/libexec/news/cvtbatch, /usr/libexec/news/filechan,
268 /usr/libexec/news/overchan, /usr/libexec/news/inndstart,
269 /usr/libexec/news/innxbatch, /usr/libexec/newsinnconfval,
270 /usr/libexec/news/expireover, /usr/libexec/news/shrinkfile,
271 /usr/libexec/news/grephistory, /usr/libexec/news/makehistory,
272 /usr/libexec/news/newsrequeue, /usr/libexec/news/ovdb_recover,
273 /usr/libexec/news/prunehistory, /usr/libexec/news/startinnfeed
274 innd_initrc_exec_t
277 - Set files with the innd_initrc_exec_t type, if you want to transition
279 an executable to the innd_initrc_t domain.
280 innd_log_t
284 - Set files with the innd_log_t type, if you want to treat the data as
286 innd log data, usually stored under the /var/log directory.
287 innd_unit_file_t
291 - Set files with the innd_unit_file_t type, if you want to treat the
293 files as innd unit content.
294 innd_var_lib_t
298 - Set files with the innd_var_lib_t type, if you want to store the innd
300 files under the /var/lib directory.
301 innd_var_run_t
305 - Set files with the innd_var_run_t type, if you want to store the innd
307 files under the /run or /var/run directory.
308 Paths:
311 /var/run/innd(/.*)?, /var/run/news(/.*)?, /var/run/innd.pid,
312 /var/run/news.pid
313 Note: File context can be temporarily modified with the chcon command.
316 If you want to permanently change the file context you need to use the
317 semanage fcontext command. This will modify the SELinux labeling data‐
318 base. You will need to use restorecon to apply the labels.
319
322 semanage fcontext can also be used to manipulate default file context
323 mappings.
324 semanage permissive can also be used to manipulate whether or not a
326 process type is permissive.
327 semanage module can also be used to enable/disable/install/remove pol‐
329 icy modules.
330 semanage port can also be used to manipulate the port definitions
332 semanage boolean can also be used to manipulate the booleans
334 system-config-selinux is a GUI tool available to customize SELinux pol‐
337 icy settings.
338
341 This manual page was auto-generated using sepolicy manpage .
342
345 selinux(8), innd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
346 setsebool(8)
347innd 19-12-02 innd_selinux(8)