openshift_selinux(8)

1openshift_selinux(8)       SELinux Policy openshift       openshift_selinux(8)
2
3
4

NAME

6       openshift_selinux  -  Security  Enhanced Linux Policy for the openshift
7       processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the openshift  processes  via  flexible
11       mandatory access control.
12
13       The  openshift processes execute with the openshift_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep openshift_t
20
21
22

ENTRYPOINTS

24       The  openshift_t  SELinux  type  can be entered via the crontab_exec_t,
25       user_cron_spool_t file types.
26
27       The default entrypoint paths for the openshift_t domain are the follow‐
28       ing:
29
30       /usr/bin/(f)?crontab,        /usr/bin/at,        /usr/sbin/fcronsighup,
31       /usr/libexec/fcronsighup,     /var/spool/at(/.*)?,     /var/spool/cron,
32       /var/spool/cron/[^/]+
33

PROCESS TYPES

35       SELinux defines process types (domains) for each process running on the
36       system
37
38       You can see the context of a process using the -Z option to ps
39
40       Policy governs the access confined processes have  to  files.   SELinux
41       openshift  policy  is very flexible allowing users to setup their open‐
42       shift processes in as secure a method as possible.
43
44       The following process types are defined for openshift:
45
46       openshift_initrc_t, openshift_cgroup_read_t, openshift_net_read_t, openshift_cron_t, openshift_t, openshift_app_t, openshift_script_t
47
48       Note: semanage permissive -a  openshift_t  can  be  used  to  make  the
49       process  type  openshift_t  permissive. SELinux does not deny access to
50       permissive process types, but the AVC (SELinux  denials)  messages  are
51       still generated.
52
53

MCS Constrained

55       The  SELinux  process  type openshift_t is an MCS (Multi Category Secu‐
56       rity) constrained type.  Sometimes this separation is  referred  to  as
57       sVirt.  These types are usually used for securing multi-tenant environ‐
58       ments, such as virtualization, containers or separation of users.   The
59       tools used to launch MCS types, pick out a different MCS label for each
60       process group.
61
62       For example one process might be  launched  with  openshift_t:s0:c1,c2,
63       and  another  process  launched  with openshift_t:s0:c3,c4. The SELinux
64       kernel only allows these processes can only write  to  content  with  a
65       matching  MCS  label,  or a MCS Label of s0. A process running with the
66       MCS level of s0:c1,c2 is not allowed to write to content with  the  MCS
67       label of s0:c3,c4
68
69

BOOLEANS

71       SELinux  policy  is customizable based on least access required.  open‐
72       shift policy is extremely flexible and has several booleans that  allow
73       you to manipulate the policy and run openshift with the tightest access
74       possible.
75
76
77
78       If you want to determine whether crond can execute  jobs  in  the  user
79       domain  as  opposed to the the generic cronjob domain, you must turn on
80       the cron_userdomain_transition boolean. Enabled by default.
81
82       setsebool -P cron_userdomain_transition 1
83
84
85
86       If you want to deny any process from ptracing or  debugging  any  other
87       processes,  you  must  turn  on  the  deny_ptrace  boolean.  Enabled by
88       default.
89
90       setsebool -P deny_ptrace 1
91
92
93

PORT TYPES

95       SELinux defines port types to represent TCP and UDP ports.
96
97       You can see the types associated with a port  by  using  the  following
98       command:
99
100       semanage port -l
101
102
103       Policy  governs  the  access  confined  processes  have to these ports.
104       SELinux openshift policy is very flexible allowing users to setup their
105       openshift processes in as secure a method as possible.
106
107       The following port types are defined for openshift:
108
109
110       openshift_port_t
111
112
113
114       MANAGED FILES
115
116              The  SELinux  process  type openshift_t can manage files labeled
117              with the following file types.  The paths listed are the default
118              paths  for  these file types.  Note the processes UID still need
119              to have DAC permissions.
120
121              anon_inodefs_t
122
123
124              cgroup_t
125
126                   /sys/fs/cgroup
127
128              faillog_t
129
130                   /var/log/btmp.*
131                   /var/log/faillog.*
132                   /var/log/tallylog.*
133                   /var/run/faillock(/.*)?
134
135              hugetlbfs_t
136
137                   /dev/hugepages
138                   /usr/lib/udev/devices/hugepages
139
140              openshift_tmpfs_t
141
142
143              postfix_spool_t
144
145                   /var/spool/postfix.*
146                   /var/spool/postfix/defer(/.*)?
147                   /var/spool/postfix/flush(/.*)?
148                   /var/spool/postfix/deferred(/.*)?
149                   /var/spool/postfix/maildrop(/.*)?
150
151              security_t
152
153                   /selinux
154
155              var_auth_t
156
157                   /var/ace(/.*)?
158                   /var/rsa(/.*)?
159                   /var/lib/abl(/.*)?
160                   /var/lib/rsa(/.*)?
161                   /var/lib/pam_ssh(/.*)?
162                   /var/lib/pam_shield(/.*)?
163                   /var/opt/quest/vas/vasd(/.*)?
164                   /var/lib/google-authenticator(/.*)?
165
166

FILE CONTEXTS

168       SELinux requires files to have an extended attribute to define the file
169       type.
170
171       You can see the context of a file using the -Z option to ls
172
173       Policy  governs  the  access  confined  processes  have to these files.
174       SELinux openshift policy is very flexible allowing users to setup their
175       openshift processes in as secure a method as possible.
176
177       EQUIVALENCE DIRECTORIES
178
179
180       openshift policy stores data with multiple different file context types
181       under the /var/lib/openshift directory.  If you would like to store the
182       data  in a different directory you can use the semanage command to cre‐
183       ate an equivalence mapping.  If you wanted to store this data under the
184       /srv directory you would execute the following command:
185
186       semanage fcontext -a -e /var/lib/openshift /srv/openshift
187       restorecon -R -v /srv/openshift
188
189       openshift policy stores data with multiple different file context types
190       under the /var/lib/stickshift directory.  If you would  like  to  store
191       the  data  in a different directory you can use the semanage command to
192       create an equivalence mapping.  If you wanted to store this data  under
193       the /srv directory you would execute the following command:
194
195       semanage fcontext -a -e /var/lib/stickshift /srv/stickshift
196       restorecon -R -v /srv/stickshift
197
198       STANDARD FILE CONTEXT
199
200       SELinux defines the file context types for the openshift, if you wanted
201       to store files with these types in a diffent paths, you need to execute
202       the  semanage  command  to  sepecify  alternate  labeling  and then use
203       restorecon to put the labels on disk.
204
205       semanage fcontext -a -t  openshift_ra_content_t  '/srv/myopenshift_con‐
206       tent(/.*)?'
207       restorecon -R -v /srv/myopenshift_content
208
209       Note:  SELinux  often  uses  regular expressions to specify labels that
210       match multiple files.
211
212       The following file types are defined for openshift:
213
214
215
216       openshift_app_tmp_t
217
218       - Set files with the openshift_app_tmp_t type, if  you  want  to  store
219       openshift app temporary files in the /tmp directories.
220
221
222
223       openshift_cgroup_read_exec_t
224
225       -  Set files with the openshift_cgroup_read_exec_t type, if you want to
226       transition an executable to the openshift_cgroup_read_t domain.
227
228
229
230       openshift_cgroup_read_tmp_t
231
232       - Set files with the openshift_cgroup_read_tmp_t type, if you  want  to
233       store openshift cgroup read temporary files in the /tmp directories.
234
235
236
237       openshift_content_t
238
239       - Set files with the openshift_content_t type, if you want to treat the
240       files as openshift content.
241
242
243
244       openshift_cron_exec_t
245
246       - Set files with the openshift_cron_exec_t type, if you want to transi‐
247       tion an executable to the openshift_cron_t domain.
248
249
250
251       openshift_cron_tmp_t
252
253       -  Set  files  with the openshift_cron_tmp_t type, if you want to store
254       openshift cron temporary files in the /tmp directories.
255
256
257
258       openshift_htaccess_t
259
260       - Set files with the openshift_htaccess_t type, if you  want  to  treat
261       the file as a openshift access file.
262
263
264
265       openshift_initrc_exec_t
266
267       - Set files with the openshift_initrc_exec_t type, if you want to tran‐
268       sition an executable to the openshift_initrc_t domain.
269
270
271       Paths:
272            /usr/s?bin/mcollectived,             /usr/s?bin/(oo|rhc)-restorer,
273            /usr/s?bin/oo-admin-ctl-gears,  /usr/s?bin/(oo|rhc)-restorer-wrap‐
274            per.sh, /etc/rc.d/init.d/libra, /etc/rc.d/init.d/mcollective
275
276
277       openshift_initrc_tmp_t
278
279       - Set files with the openshift_initrc_tmp_t type, if you want to  store
280       openshift initrc temporary files in the /tmp directories.
281
282
283
284       openshift_log_t
285
286       -  Set  files  with  the openshift_log_t type, if you want to treat the
287       data as openshift log data, usually stored under  the  /var/log  direc‐
288       tory.
289
290
291       Paths:
292            /var/log/openshift(/.*)?, /var/log/mcollective.log.*
293
294
295       openshift_net_read_exec_t
296
297       -  Set  files  with  the openshift_net_read_exec_t type, if you want to
298       transition an executable to the openshift_net_read_t domain.
299
300
301
302       openshift_ra_content_t
303
304       - Set files with the openshift_ra_content_t type, if you want to  treat
305       the files as openshift read/append content.
306
307
308
309       openshift_rw_content_t
310
311       -  Set files with the openshift_rw_content_t type, if you want to treat
312       the files as openshift read/write content.
313
314
315
316       openshift_rw_file_t
317
318       - Set files with the openshift_rw_file_t type, if you want to treat the
319       files as openshift rw content.
320
321
322       Paths:
323            /var/lib/openshift/.*/data(/.*)?,                  /var/lib/stick‐
324            shift/.*/data(/.*)?
325
326
327       openshift_script_exec_t
328
329       - Set files with the openshift_script_exec_t type, if you want to tran‐
330       sition an executable to the openshift_script_t domain.
331
332
333
334       openshift_tmp_t
335
336       -  Set  files with the openshift_tmp_t type, if you want to store open‐
337       shift temporary files in the /tmp directories.
338
339
340       Paths:
341            /var/lib/openshift/.*/.tmp(/.*)?,     /var/lib/openshift/.*/.sand‐
342            box(/.*)?,    /var/lib/stickshift/.*/.tmp(/.*)?,   /var/lib/stick‐
343            shift/.*/.sandbox(/.*)?
344
345
346       openshift_tmpfs_t
347
348       - Set files with the openshift_tmpfs_t type, if you want to store open‐
349       shift files on a tmpfs file system.
350
351
352
353       openshift_var_lib_t
354
355       - Set files with the openshift_var_lib_t type, if you want to store the
356       openshift files under the /var/lib directory.
357
358
359       Paths:
360            /var/lib/openshift(/.*)?, /var/lib/stickshift(/.*)?, /var/lib/con‐
361            tainers/home(/.*)?
362
363
364       openshift_var_run_t
365
366       - Set files with the openshift_var_run_t type, if you want to store the
367       openshift files under the /run or /var/run directory.
368
369
370       Paths:
371            /var/run/openshift(/.*)?, /var/run/stickshift(/.*)?
372
373
374       Note: File context can be temporarily modified with the chcon  command.
375       If  you want to permanently change the file context you need to use the
376       semanage fcontext command.  This will modify the SELinux labeling data‐
377       base.  You will need to use restorecon to apply the labels.
378
379

COMMANDS

381       semanage  fcontext  can also be used to manipulate default file context
382       mappings.
383
384       semanage permissive can also be used to manipulate  whether  or  not  a
385       process type is permissive.
386
387       semanage  module can also be used to enable/disable/install/remove pol‐
388       icy modules.
389
390       semanage port can also be used to manipulate the port definitions
391
392       semanage boolean can also be used to manipulate the booleans
393
394
395       system-config-selinux is a GUI tool available to customize SELinux pol‐
396       icy settings.
397
398

AUTHOR

400       This manual page was auto-generated using sepolicy manpage .
401
402