1pegasus_selinux(8) SELinux Policy pegasus pegasus_selinux(8)
2
3
4
6 pegasus_selinux - Security Enhanced Linux Policy for the pegasus pro‐
7 cesses
8
10 Security-Enhanced Linux secures the pegasus processes via flexible
11 mandatory access control.
12
13 The pegasus processes execute with the pegasus_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep pegasus_t
20
21
22
24 The pegasus_t SELinux type can be entered via the pegasus_exec_t file
25 type.
26
27 The default entrypoint paths for the pegasus_t domain are the follow‐
28 ing:
29
30 /usr/sbin/cimserver, /usr/sbin/init_repository
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 pegasus policy is very flexible allowing users to setup their pegasus
40 processes in as secure a method as possible.
41
42 The following process types are defined for pegasus:
43
44 pegasus_t, pegasus_openlmi_admin_t, pegasus_openlmi_account_t, pegasus_openlmi_logicalfile_t, pegasus_openlmi_services_t, pegasus_openlmi_storage_t, pegasus_openlmi_system_t, pegasus_openlmi_unconfined_t
45
46 Note: semanage permissive -a pegasus_t can be used to make the process
47 type pegasus_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. pegasus
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run pegasus with the tightest access possi‐
56 ble.
57
58
59
60 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62
63 setsebool -P fips_mode 1
64
65
66
68 SELinux defines port types to represent TCP and UDP ports.
69
70 You can see the types associated with a port by using the following
71 command:
72
73 semanage port -l
74
75
76 Policy governs the access confined processes have to these ports.
77 SELinux pegasus policy is very flexible allowing users to setup their
78 pegasus processes in as secure a method as possible.
79
80 The following port types are defined for pegasus:
81
82
83 pegasus_http_port_t
84
85
86
87 Default Defined Ports:
88 tcp 5988
89
90
91 pegasus_https_port_t
92
93
94
95 Default Defined Ports:
96 tcp 5989
97
99 The SELinux process type pegasus_t can manage files labeled with the
100 following file types. The paths listed are the default paths for these
101 file types. Note the processes UID still need to have DAC permissions.
102
103 cluster_conf_t
104
105 /etc/cluster(/.*)?
106
107 cluster_var_lib_t
108
109 /var/lib/pcsd(/.*)?
110 /var/lib/cluster(/.*)?
111 /var/lib/openais(/.*)?
112 /var/lib/pengine(/.*)?
113 /var/lib/corosync(/.*)?
114 /usr/lib/heartbeat(/.*)?
115 /var/lib/heartbeat(/.*)?
116 /var/lib/pacemaker(/.*)?
117
118 cluster_var_run_t
119
120 /var/run/crm(/.*)?
121 /var/run/cman_.*
122 /var/run/rsctmp(/.*)?
123 /var/run/aisexec.*
124 /var/run/heartbeat(/.*)?
125 /var/run/corosync-qnetd(/.*)?
126 /var/run/corosync-qdevice(/.*)?
127 /var/run/corosync.pid
128 /var/run/cpglockd.pid
129 /var/run/rgmanager.pid
130 /var/run/cluster/rgmanager.sk
131
132 faillog_t
133
134 /var/log/btmp.*
135 /var/log/faillog.*
136 /var/log/tallylog.*
137 /var/run/faillock(/.*)?
138
139 initrc_var_run_t
140
141 /var/run/utmp
142 /var/run/random-seed
143 /var/run/runlevel.dir
144 /var/run/setmixer_flag
145
146 krb5_keytab_t
147
148 /var/kerberos/krb5(/.*)?
149 /etc/krb5.keytab
150 /etc/krb5kdc/kadm5.keytab
151 /var/kerberos/krb5kdc/kadm5.keytab
152
153 pegasus_cache_t
154
155
156 pegasus_data_t
157
158 /var/lib/Pegasus(/.*)?
159 /etc/Pegasus/pegasus_current.conf
160 /etc/Pegasus/cimserver_current.conf
161
162 pegasus_var_run_t
163
164 /var/run/tog-pegasus(/.*)?
165
166 root_t
167
168 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
169 /
170 /initrd
171
172 sysfs_t
173
174 /sys(/.*)?
175
176 virt_etc_rw_t
177
178 /etc/xen/[^/]*
179 /etc/xen/.*/.*
180 /etc/libvirt/[^/]*
181 /etc/libvirt/.*/.*
182
183 virt_etc_t
184
185 /etc/xen/[^/]*
186 /etc/libvirt/[^/]*
187 /etc/xen
188 /etc/libvirt
189
190
192 SELinux requires files to have an extended attribute to define the file
193 type.
194
195 You can see the context of a file using the -Z option to ls
196
197 Policy governs the access confined processes have to these files.
198 SELinux pegasus policy is very flexible allowing users to setup their
199 pegasus processes in as secure a method as possible.
200
201 STANDARD FILE CONTEXT
202
203 SELinux defines the file context types for the pegasus, if you wanted
204 to store files with these types in a diffent paths, you need to execute
205 the semanage command to sepecify alternate labeling and then use
206 restorecon to put the labels on disk.
207
208 semanage fcontext -a -t pegasus_openlmi_storage_var_run_t '/srv/mypega‐
209 sus_content(/.*)?'
210 restorecon -R -v /srv/mypegasus_content
211
212 Note: SELinux often uses regular expressions to specify labels that
213 match multiple files.
214
215 The following file types are defined for pegasus:
216
217
218
219 pegasus_cache_t
220
221 - Set files with the pegasus_cache_t type, if you want to store the
222 files under the /var/cache directory.
223
224
225
226 pegasus_conf_t
227
228 - Set files with the pegasus_conf_t type, if you want to treat the
229 files as pegasus configuration data, usually stored under the /etc
230 directory.
231
232
233
234 pegasus_data_t
235
236 - Set files with the pegasus_data_t type, if you want to treat the
237 files as pegasus content.
238
239
240 Paths:
241 /var/lib/Pegasus(/.*)?, /etc/Pegasus/pegasus_current.conf,
242 /etc/Pegasus/cimserver_current.conf
243
244
245 pegasus_exec_t
246
247 - Set files with the pegasus_exec_t type, if you want to transition an
248 executable to the pegasus_t domain.
249
250
251 Paths:
252 /usr/sbin/cimserver, /usr/sbin/init_repository
253
254
255 pegasus_mof_t
256
257 - Set files with the pegasus_mof_t type, if you want to treat the files
258 as pegasus mof data.
259
260
261
262 pegasus_openlmi_account_exec_t
263
264 - Set files with the pegasus_openlmi_account_exec_t type, if you want
265 to transition an executable to the pegasus_openlmi_account_t domain.
266
267
268
269 pegasus_openlmi_admin_exec_t
270
271 - Set files with the pegasus_openlmi_admin_exec_t type, if you want to
272 transition an executable to the pegasus_openlmi_admin_t domain.
273
274
275 Paths:
276 /usr/libexec/pegasus/cmpiLMI_Service-cimprovagt,
277 /usr/libexec/pegasus/cmpiLMI_Journald-cimprovagt
278
279
280 pegasus_openlmi_logicalfile_exec_t
281
282 - Set files with the pegasus_openlmi_logicalfile_exec_t type, if you
283 want to transition an executable to the pegasus_openlmi_logicalfile_t
284 domain.
285
286
287
288 pegasus_openlmi_services_exec_t
289
290 - Set files with the pegasus_openlmi_services_exec_t type, if you want
291 to transition an executable to the pegasus_openlmi_services_t domain.
292
293
294
295 pegasus_openlmi_storage_exec_t
296
297 - Set files with the pegasus_openlmi_storage_exec_t type, if you want
298 to transition an executable to the pegasus_openlmi_storage_t domain.
299
300
301 Paths:
302 /usr/libexec/pegasus/cmpiLMI_Hardware-cimprovagt,
303 /usr/libexec/pegasus/pycmpiLMI_Storage-cimprovagt
304
305
306 pegasus_openlmi_storage_lib_t
307
308 - Set files with the pegasus_openlmi_storage_lib_t type, if you want to
309 treat the files as pegasus openlmi storage lib data.
310
311
312
313 pegasus_openlmi_storage_tmp_t
314
315 - Set files with the pegasus_openlmi_storage_tmp_t type, if you want to
316 store pegasus openlmi storage temporary files in the /tmp directories.
317
318
319
320 pegasus_openlmi_storage_var_run_t
321
322 - Set files with the pegasus_openlmi_storage_var_run_t type, if you
323 want to store the pegasus openlmi storage files under the /run or
324 /var/run directory.
325
326
327
328 pegasus_openlmi_system_exec_t
329
330 - Set files with the pegasus_openlmi_system_exec_t type, if you want to
331 transition an executable to the pegasus_openlmi_system_t domain.
332
333
334 Paths:
335 /usr/libexec/pegasus/cmpiLMI_Fan-cimprovagt, /usr/libexec/pega‐
336 sus/cmpiLMI_Networking-cimprovagt, /usr/libexec/pega‐
337 sus/cmpiLMI_PowerManagement-cimprovagt
338
339
340 pegasus_openlmi_unconfined_exec_t
341
342 - Set files with the pegasus_openlmi_unconfined_exec_t type, if you
343 want to transition an executable to the pegasus_openlmi_unconfined_t
344 domain.
345
346
347
348 pegasus_tmp_t
349
350 - Set files with the pegasus_tmp_t type, if you want to store pegasus
351 temporary files in the /tmp directories.
352
353
354
355 pegasus_var_run_t
356
357 - Set files with the pegasus_var_run_t type, if you want to store the
358 pegasus files under the /run or /var/run directory.
359
360
361
362 Note: File context can be temporarily modified with the chcon command.
363 If you want to permanently change the file context you need to use the
364 semanage fcontext command. This will modify the SELinux labeling data‐
365 base. You will need to use restorecon to apply the labels.
366
367
369 semanage fcontext can also be used to manipulate default file context
370 mappings.
371
372 semanage permissive can also be used to manipulate whether or not a
373 process type is permissive.
374
375 semanage module can also be used to enable/disable/install/remove pol‐
376 icy modules.
377
378 semanage port can also be used to manipulate the port definitions
379
380 semanage boolean can also be used to manipulate the booleans
381
382
383 system-config-selinux is a GUI tool available to customize SELinux pol‐
384 icy settings.
385
386
388 This manual page was auto-generated using sepolicy manpage .
389
390
392 selinux(8), pegasus(8), semanage(8), restorecon(8), chcon(1), sepol‐
393 icy(8), setsebool(8), pegasus_openlmi_account_selinux(8), pega‐
394 sus_openlmi_account_selinux(8), pegasus_openlmi_admin_selinux(8), pega‐
395 sus_openlmi_admin_selinux(8), pegasus_openlmi_logicalfile_selinux(8),
396 pegasus_openlmi_logicalfile_selinux(8), pegasus_openlmi_ser‐
397 vices_selinux(8), pegasus_openlmi_services_selinux(8), pega‐
398 sus_openlmi_storage_selinux(8), pegasus_openlmi_storage_selinux(8),
399 pegasus_openlmi_system_selinux(8), pegasus_openlmi_system_selinux(8),
400 pegasus_openlmi_unconfined_selinux(8), pegasus_openlmi_uncon‐
401 fined_selinux(8)
402
403
404
405pegasus 20-05-05 pegasus_selinux(8)