1sssd_selinux(8) SELinux Policy sssd sssd_selinux(8)
2
6 sssd_selinux - Security Enhanced Linux Policy for the sssd processes
7
9 Security-Enhanced Linux secures the sssd processes via flexible manda‐
10 tory access control.
11 The sssd processes execute with the sssd_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15 For example:
17 ps -eZ | grep sssd_t
19
23 The sssd_t SELinux type can be entered via the sssd_exec_t file type.
24 The default entrypoint paths for the sssd_t domain are the following:
26 /usr/sbin/sssd, /usr/libexec/sssd/sssd_ifp, /usr/libexec/sssd/sssd_kcm,
28 /usr/libexec/sssd/sssd_nss, /usr/libexec/sssd/sssd_pac,
29 /usr/libexec/sssd/sssd_pam, /usr/libexec/sssd/sssd_ssh,
30 /usr/libexec/sssd/sssd_sudo, /usr/libexec/sssd/sssd_autofs,
31 /usr/libexec/sssd/sssd_secrets
32
34 SELinux defines process types (domains) for each process running on the
35 system
36 You can see the context of a process using the -Z option to ps
38 Policy governs the access confined processes have to files. SELinux
40 sssd policy is very flexible allowing users to setup their sssd pro‐
41 cesses in as secure a method as possible.
42 The following process types are defined for sssd:
44 sssd_t, sssd_selinux_manager_t
46 Note: semanage permissive -a sssd_t can be used to make the process
48 type sssd_t permissive. SELinux does not deny access to permissive
49 process types, but the AVC (SELinux denials) messages are still gener‐
50 ated.
51
54 SELinux policy is customizable based on least access required. sssd
55 policy is extremely flexible and has several booleans that allow you to
56 manipulate the policy and run sssd with the tightest access possible.
57 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62 setsebool -P fips_mode 1
64 If you want to allow Apache to communicate with sssd service via dbus,
68 you must turn on the httpd_dbus_sssd boolean. Disabled by default.
69 setsebool -P httpd_dbus_sssd 1
71 If you want to allow system to run with NIS, you must turn on the
75 nis_enabled boolean. Disabled by default.
76 setsebool -P nis_enabled 1
78
82 The SELinux process type sssd_t can manage files labeled with the fol‐
83 lowing file types. The paths listed are the default paths for these
84 file types. Note the processes UID still need to have DAC permissions.
85 auth_cache_t
87 /var/cache/coolkey(/.*)?
89 cluster_conf_t
91 /etc/cluster(/.*)?
93 cluster_var_lib_t
95 /var/lib/pcsd(/.*)?
97 /var/lib/cluster(/.*)?
98 /var/lib/openais(/.*)?
99 /var/lib/pengine(/.*)?
100 /var/lib/corosync(/.*)?
101 /usr/lib/heartbeat(/.*)?
102 /var/lib/heartbeat(/.*)?
103 /var/lib/pacemaker(/.*)?
104 cluster_var_run_t
106 /var/run/crm(/.*)?
108 /var/run/cman_.*
109 /var/run/rsctmp(/.*)?
110 /var/run/aisexec.*
111 /var/run/heartbeat(/.*)?
112 /var/run/corosync-qnetd(/.*)?
113 /var/run/corosync-qdevice(/.*)?
114 /var/run/corosync.pid
115 /var/run/cpglockd.pid
116 /var/run/rgmanager.pid
117 /var/run/cluster/rgmanager.sk
118 faillog_t
120 /var/log/btmp.*
122 /var/log/faillog.*
123 /var/log/tallylog.*
124 /var/run/faillock(/.*)?
125 krb5_keytab_t
127 /var/kerberos/krb5(/.*)?
129 /etc/krb5.keytab
130 /etc/krb5kdc/kadm5.keytab
131 /var/kerberos/krb5kdc/kadm5.keytab
132 root_t
134 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
136 /
137 /initrd
138 security_t
140 /selinux
142 selinux_login_config_t
144 /etc/selinux/([^/]*/)?logins(/.*)?
146 sssd_var_log_t
148 /var/log/sssd(/.*)?
150 sssd_var_run_t
152 /var/run/sssd.pid
154 /var/run/secrets.socket
155 /var/run/.heim_org.h5l.kcm-socket
156
159 SELinux requires files to have an extended attribute to define the file
160 type.
161 You can see the context of a file using the -Z option to ls
163 Policy governs the access confined processes have to these files.
165 SELinux sssd policy is very flexible allowing users to setup their sssd
166 processes in as secure a method as possible.
167 EQUIVALENCE DIRECTORIES
169 sssd policy stores data with multiple different file context types
172 under the /var/lib/sss directory. If you would like to store the data
173 in a different directory you can use the semanage command to create an
174 equivalence mapping. If you wanted to store this data under the /srv
175 directory you would execute the following command:
176 semanage fcontext -a -e /var/lib/sss /srv/sss
178 restorecon -R -v /srv/sss
179 STANDARD FILE CONTEXT
181 SELinux defines the file context types for the sssd, if you wanted to
183 store files with these types in a diffent paths, you need to execute
184 the semanage command to sepecify alternate labeling and then use
185 restorecon to put the labels on disk.
186 semanage fcontext -a -t sssd_unit_file_t '/srv/mysssd_content(/.*)?'
188 restorecon -R -v /srv/mysssd_content
189 Note: SELinux often uses regular expressions to specify labels that
191 match multiple files.
192 The following file types are defined for sssd:
194 sssd_conf_t
198 - Set files with the sssd_conf_t type, if you want to treat the files
200 as sssd configuration data, usually stored under the /etc directory.
201 sssd_exec_t
205 - Set files with the sssd_exec_t type, if you want to transition an
207 executable to the sssd_t domain.
208 Paths:
211 /usr/sbin/sssd, /usr/libexec/sssd/sssd_ifp,
212 /usr/libexec/sssd/sssd_kcm, /usr/libexec/sssd/sssd_nss,
213 /usr/libexec/sssd/sssd_pac, /usr/libexec/sssd/sssd_pam,
214 /usr/libexec/sssd/sssd_ssh, /usr/libexec/sssd/sssd_sudo,
215 /usr/libexec/sssd/sssd_autofs, /usr/libexec/sssd/sssd_secrets
216 sssd_initrc_exec_t
219 - Set files with the sssd_initrc_exec_t type, if you want to transition
221 an executable to the sssd_initrc_t domain.
222 sssd_public_t
226 - Set files with the sssd_public_t type, if you want to treat the files
228 as sssd public data.
229 Paths:
232 /var/lib/sss/mc(/.*)?, /var/lib/sss/pubconf(/.*)?
233 sssd_selinux_manager_exec_t
236 - Set files with the sssd_selinux_manager_exec_t type, if you want to
238 transition an executable to the sssd_selinux_manager_t domain.
239 sssd_unit_file_t
243 - Set files with the sssd_unit_file_t type, if you want to treat the
245 files as sssd unit content.
246 sssd_var_lib_t
250 - Set files with the sssd_var_lib_t type, if you want to store the sssd
252 files under the /var/lib directory.
253 sssd_var_log_t
257 - Set files with the sssd_var_log_t type, if you want to treat the data
259 as sssd var log data, usually stored under the /var/log directory.
260 sssd_var_run_t
264 - Set files with the sssd_var_run_t type, if you want to store the sssd
266 files under the /run or /var/run directory.
267 Paths:
270 /var/run/sssd.pid, /var/run/secrets.socket,
271 /var/run/.heim_org.h5l.kcm-socket
272 Note: File context can be temporarily modified with the chcon command.
275 If you want to permanently change the file context you need to use the
276 semanage fcontext command. This will modify the SELinux labeling data‐
277 base. You will need to use restorecon to apply the labels.
278
281 semanage fcontext can also be used to manipulate default file context
282 mappings.
283 semanage permissive can also be used to manipulate whether or not a
285 process type is permissive.
286 semanage module can also be used to enable/disable/install/remove pol‐
288 icy modules.
289 semanage boolean can also be used to manipulate the booleans
291 system-config-selinux is a GUI tool available to customize SELinux pol‐
294 icy settings.
295
298 This manual page was auto-generated using sepolicy manpage .
299
302 selinux(8), sssd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
303 setsebool(8), sssd_selinux_manager_selinux(8)
304sssd 20-05-05 sssd_selinux(8)