piranha_web_selinux(8)

1piranha_web_selinux(8)    SELinux Policy piranha_web    piranha_web_selinux(8)
2
3
4

NAME

6       piranha_web_selinux   -   Security   Enhanced   Linux  Policy  for  the
7       piranha_web processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the piranha_web processes via  flexible
11       mandatory access control.
12
13       The  piranha_web processes execute with the piranha_web_t SELinux type.
14       You can check if you have these processes running by executing  the  ps
15       command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep piranha_web_t
20
21
22

ENTRYPOINTS

24       The    piranha_web_t    SELinux   type   can   be   entered   via   the
25       piranha_web_exec_t file type.
26
27       The default entrypoint paths for the piranha_web_t domain are the  fol‐
28       lowing:
29
30       /usr/sbin/piranha_gui
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       piranha_web  policy  is  very  flexible  allowing  users to setup their
40       piranha_web processes in as secure a method as possible.
41
42       The following process types are defined for piranha_web:
43
44       piranha_web_t
45
46       Note: semanage permissive -a piranha_web_t can  be  used  to  make  the
47       process  type piranha_web_t permissive. SELinux does not deny access to
48       permissive process types, but the AVC (SELinux  denials)  messages  are
49       still generated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       piranha_web policy is extremely flexible and has several booleans  that
55       allow  you to manipulate the policy and run piranha_web with the tight‐
56       est access possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66

MANAGED FILES

68       The  SELinux  process  type piranha_web_t can manage files labeled with
69       the following file types.  The paths listed are the default  paths  for
70       these  file  types.  Note the processes UID still need to have DAC per‐
71       missions.
72
73       cluster_conf_t
74
75            /etc/cluster(/.*)?
76
77       cluster_var_lib_t
78
79            /var/lib/pcsd(/.*)?
80            /var/lib/cluster(/.*)?
81            /var/lib/openais(/.*)?
82            /var/lib/pengine(/.*)?
83            /var/lib/corosync(/.*)?
84            /usr/lib/heartbeat(/.*)?
85            /var/lib/heartbeat(/.*)?
86            /var/lib/pacemaker(/.*)?
87
88       cluster_var_run_t
89
90            /var/run/crm(/.*)?
91            /var/run/cman_.*
92            /var/run/rsctmp(/.*)?
93            /var/run/aisexec.*
94            /var/run/heartbeat(/.*)?
95            /var/run/corosync-qnetd(/.*)?
96            /var/run/corosync-qdevice(/.*)?
97            /var/run/corosync.pid
98            /var/run/cpglockd.pid
99            /var/run/rgmanager.pid
100            /var/run/cluster/rgmanager.sk
101
102       piranha_log_t
103
104            /var/log/piranha(/.*)?
105
106       piranha_web_data_t
107
108            /var/lib/luci(/.*)?
109
110       piranha_web_tmpfs_t
111
112
113       piranha_web_var_run_t
114
115            /var/run/piranha-httpd.pid
116
117       root_t
118
119            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
120            /
121            /initrd
122
123

FILE CONTEXTS

125       SELinux requires files to have an extended attribute to define the file
126       type.
127
128       You can see the context of a file using the -Z option to ls
129
130       Policy  governs  the  access  confined  processes  have to these files.
131       SELinux piranha_web policy is very flexible  allowing  users  to  setup
132       their piranha_web processes in as secure a method as possible.
133
134       EQUIVALENCE DIRECTORIES
135
136
137       piranha_web  policy  stores  data  with multiple different file context
138       types under the /var/lib/luci directory.  If you would  like  to  store
139       the  data  in a different directory you can use the semanage command to
140       create an equivalence mapping.  If you wanted to store this data  under
141       the /srv directory you would execute the following command:
142
143       semanage fcontext -a -e /var/lib/luci /srv/luci
144       restorecon -R -v /srv/luci
145
146       STANDARD FILE CONTEXT
147
148       SELinux  defines  the  file  context  types for the piranha_web, if you
149       wanted to store files with these types in a diffent paths, you need  to
150       execute  the  semanage  command to sepecify alternate labeling and then
151       use restorecon to put the labels on disk.
152
153       semanage  fcontext  -a  -t  piranha_web_tmp_t  '/srv/mypiranha_web_con‐
154       tent(/.*)?'
155       restorecon -R -v /srv/mypiranha_web_content
156
157       Note:  SELinux  often  uses  regular expressions to specify labels that
158       match multiple files.
159
160       The following file types are defined for piranha_web:
161
162
163
164       piranha_web_conf_t
165
166       - Set files with the piranha_web_conf_t type, if you want to treat  the
167       files  as piranha web configuration data, usually stored under the /etc
168       directory.
169
170
171       Paths:
172            /var/lib/luci/etc(/.*)?, /var/lib/luci/cert(/.*)?
173
174
175       piranha_web_data_t
176
177       - Set files with the piranha_web_data_t type, if you want to treat  the
178       files as piranha web content.
179
180
181
182       piranha_web_exec_t
183
184       - Set files with the piranha_web_exec_t type, if you want to transition
185       an executable to the piranha_web_t domain.
186
187
188
189       piranha_web_tmp_t
190
191       - Set files with the piranha_web_tmp_t  type,  if  you  want  to  store
192       piranha web temporary files in the /tmp directories.
193
194
195
196       piranha_web_tmpfs_t
197
198       -  Set  files  with  the piranha_web_tmpfs_t type, if you want to store
199       piranha web files on a tmpfs file system.
200
201
202
203       piranha_web_var_run_t
204
205       - Set files with the piranha_web_var_run_t type, if you want  to  store
206       the piranha web files under the /run or /var/run directory.
207
208
209
210       Note:  File context can be temporarily modified with the chcon command.
211       If you want to permanently change the file context you need to use  the
212       semanage fcontext command.  This will modify the SELinux labeling data‐
213       base.  You will need to use restorecon to apply the labels.
214
215

COMMANDS

217       semanage fcontext can also be used to manipulate default  file  context
218       mappings.
219
220       semanage  permissive  can  also  be used to manipulate whether or not a
221       process type is permissive.
222
223       semanage module can also be used to enable/disable/install/remove  pol‐
224       icy modules.
225
226       semanage boolean can also be used to manipulate the booleans
227
228
229       system-config-selinux is a GUI tool available to customize SELinux pol‐
230       icy settings.
231
232

AUTHOR

234       This manual page was auto-generated using sepolicy manpage .
235
236