1zabbix_agent_selinux(8) SELinux Policy zabbix_agent zabbix_agent_selinux(8)
2
6 zabbix_agent_selinux - Security Enhanced Linux Policy for the zab‐
7 bix_agent processes
8
10 Security-Enhanced Linux secures the zabbix_agent processes via flexible
11 mandatory access control.
12 The zabbix_agent processes execute with the zabbix_agent_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep zabbix_agent_t
20
24 The zabbix_agent_t SELinux type can be entered via the zab‐
25 bix_agent_exec_t file type.
26 The default entrypoint paths for the zabbix_agent_t domain are the fol‐
28 lowing:
29 /usr/bin/zabbix_agentd, /usr/sbin/zabbix_agentd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 zabbix_agent policy is very flexible allowing users to setup their zab‐
40 bix_agent processes in as secure a method as possible.
41 The following process types are defined for zabbix_agent:
43 zabbix_agent_t
45 Note: semanage permissive -a zabbix_agent_t can be used to make the
47 process type zabbix_agent_t permissive. SELinux does not deny access to
48 permissive process types, but the AVC (SELinux denials) messages are
49 still generated.
50
53 SELinux policy is customizable based on least access required. zab‐
54 bix_agent policy is extremely flexible and has several booleans that
55 allow you to manipulate the policy and run zabbix_agent with the tight‐
56 est access possible.
57 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62 setsebool -P fips_mode 1
64 If you want to allow Zabbix to run su/sudo, you must turn on the zab‐
68 bix_run_sudo boolean. Disabled by default.
69 setsebool -P zabbix_run_sudo 1
71
75 SELinux defines port types to represent TCP and UDP ports.
76 You can see the types associated with a port by using the following
78 command:
79 semanage port -l
81 Policy governs the access confined processes have to these ports.
84 SELinux zabbix_agent policy is very flexible allowing users to setup
85 their zabbix_agent processes in as secure a method as possible.
86 The following port types are defined for zabbix_agent:
88 zabbix_agent_port_t
91 Default Defined Ports:
95 tcp 10050
96
98 The SELinux process type zabbix_agent_t can manage files labeled with
99 the following file types. The paths listed are the default paths for
100 these file types. Note the processes UID still need to have DAC per‐
101 missions.
102 cluster_conf_t
104 /etc/cluster(/.*)?
106 cluster_var_lib_t
108 /var/lib/pcsd(/.*)?
110 /var/lib/cluster(/.*)?
111 /var/lib/openais(/.*)?
112 /var/lib/pengine(/.*)?
113 /var/lib/corosync(/.*)?
114 /usr/lib/heartbeat(/.*)?
115 /var/lib/heartbeat(/.*)?
116 /var/lib/pacemaker(/.*)?
117 cluster_var_run_t
119 /var/run/crm(/.*)?
121 /var/run/cman_.*
122 /var/run/rsctmp(/.*)?
123 /var/run/aisexec.*
124 /var/run/heartbeat(/.*)?
125 /var/run/corosync-qnetd(/.*)?
126 /var/run/corosync-qdevice(/.*)?
127 /var/run/corosync.pid
128 /var/run/cpglockd.pid
129 /var/run/rgmanager.pid
130 /var/run/cluster/rgmanager.sk
131 faillog_t
133 /var/log/btmp.*
135 /var/log/faillog.*
136 /var/log/tallylog.*
137 /var/run/faillock(/.*)?
138 lastlog_t
140 /var/log/lastlog.*
142 root_t
144 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
146 /
147 /initrd
148 security_t
150 /selinux
152 zabbix_log_t
154 /var/log/zabbix.*
156 zabbix_tmpfs_t
158 zabbix_var_run_t
161 /var/run/zabbix(/.*)?
163
166 SELinux requires files to have an extended attribute to define the file
167 type.
168 You can see the context of a file using the -Z option to ls
170 Policy governs the access confined processes have to these files.
172 SELinux zabbix_agent policy is very flexible allowing users to setup
173 their zabbix_agent processes in as secure a method as possible.
174 The following file types are defined for zabbix_agent:
176 zabbix_agent_exec_t
180 - Set files with the zabbix_agent_exec_t type, if you want to transi‐
182 tion an executable to the zabbix_agent_t domain.
183 Paths:
186 /usr/bin/zabbix_agentd, /usr/sbin/zabbix_agentd
187 zabbix_agent_initrc_exec_t
190 - Set files with the zabbix_agent_initrc_exec_t type, if you want to
192 transition an executable to the zabbix_agent_initrc_t domain.
193 Note: File context can be temporarily modified with the chcon command.
197 If you want to permanently change the file context you need to use the
198 semanage fcontext command. This will modify the SELinux labeling data‐
199 base. You will need to use restorecon to apply the labels.
200
203 semanage fcontext can also be used to manipulate default file context
204 mappings.
205 semanage permissive can also be used to manipulate whether or not a
207 process type is permissive.
208 semanage module can also be used to enable/disable/install/remove pol‐
210 icy modules.
211 semanage port can also be used to manipulate the port definitions
213 semanage boolean can also be used to manipulate the booleans
215 system-config-selinux is a GUI tool available to customize SELinux pol‐
218 icy settings.
219
222 This manual page was auto-generated using sepolicy manpage .
223
226 selinux(8), zabbix_agent(8), semanage(8), restorecon(8), chcon(1),
227 sepolicy(8), setsebool(8)
228zabbix_agent 21-03-26 zabbix_agent_selinux(8)