1cluster_selinux(8) SELinux Policy cluster cluster_selinux(8)
2
6 cluster_selinux - Security Enhanced Linux Policy for the cluster pro‐
7 cesses
8
10 Security-Enhanced Linux secures the cluster processes via flexible
11 mandatory access control.
12 The cluster processes execute with the cluster_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep cluster_t
20
24 The cluster_t SELinux type can be entered via the cluster_exec_t file
25 type.
26 The default entrypoint paths for the cluster_t domain are the follow‐
28 ing:
29 /usr/sbin/pcsd, /usr/sbin/aisexec, /usr/lib/pcsd/pcsd,
31 /usr/sbin/ccs_tool, /usr/sbin/corosync, /usr/sbin/cpglockd,
32 /usr/sbin/cman_tool, /usr/sbin/rgmanager, /usr/sbin/ldirectord,
33 /usr/sbin/pacemakerd, /usr/bin/corosync-qnetd, /usr/sbin/corosync-noti‐
34 fyd, /usr/sbin/corosync-qdevice, /usr/sbin/pacemaker-remoted,
35 /usr/sbin/pacemaker_remoted, /usr/lib/heartbeat/heartbeat,
36 /usr/share/corosync/corosync, /usr/share/corosync/corosync-qdevice
37
39 SELinux defines process types (domains) for each process running on the
40 system
41 You can see the context of a process using the -Z option to ps
43 Policy governs the access confined processes have to files. SELinux
45 cluster policy is very flexible allowing users to setup their cluster
46 processes in as secure a method as possible.
47 The following process types are defined for cluster:
49 cluster_t
51 Note: semanage permissive -a cluster_t can be used to make the process
53 type cluster_t permissive. SELinux does not deny access to permissive
54 process types, but the AVC (SELinux denials) messages are still gener‐
55 ated.
56
59 SELinux policy is customizable based on least access required. cluster
60 policy is extremely flexible and has several booleans that allow you to
61 manipulate the policy and run cluster with the tightest access possi‐
62 ble.
63 If you want to allow cluster administrative cluster domains memcheck-
67 amd64- to use executable memory, you must turn on the cluster_use_ex‐
68 ecmem boolean. Disabled by default.
69 setsebool -P cluster_use_execmem 1
71 If you want to deny user domains applications to map a memory region as
75 both executable and writable, this is dangerous and the executable
76 should be reported in bugzilla, you must turn on the deny_execmem bool‐
77 ean. Enabled by default.
78 setsebool -P deny_execmem 1
80 If you want to control the ability to mmap a low area of the address
84 space, as configured by /proc/sys/vm/mmap_min_addr, you must turn on
85 the mmap_low_allowed boolean. Disabled by default.
86 setsebool -P mmap_low_allowed 1
88 If you want to disable kernel module loading, you must turn on the se‐
92 cure_mode_insmod boolean. Enabled by default.
93 setsebool -P secure_mode_insmod 1
95 If you want to allow unconfined executables to make their heap memory
99 executable. Doing this is a really bad idea. Probably indicates a
100 badly coded executable, but could indicate an attack. This executable
101 should be reported in bugzilla, you must turn on the selinuxuser_ex‐
102 echeap boolean. Disabled by default.
103 setsebool -P selinuxuser_execheap 1
105 If you want to allow unconfined executables to make their stack exe‐
109 cutable. This should never, ever be necessary. Probably indicates a
110 badly coded executable, but could indicate an attack. This executable
111 should be reported in bugzilla, you must turn on the selinuxuser_exec‐
112 stack boolean. Enabled by default.
113 setsebool -P selinuxuser_execstack 1
115
119 If you want to allow users to resolve user passwd entries directly from
120 ldap rather then using a sssd server for the cluster_t, you must turn
121 on the authlogin_nsswitch_use_ldap boolean.
122 setsebool -P authlogin_nsswitch_use_ldap 1
124 If you want to allow confined applications to run with kerberos for the
127 cluster_t, you must turn on the kerberos_enabled boolean.
128 setsebool -P kerberos_enabled 1
130
133 SELinux defines port types to represent TCP and UDP ports.
134 You can see the types associated with a port by using the following
136 command:
137 semanage port -l
139 Policy governs the access confined processes have to these ports.
142 SELinux cluster policy is very flexible allowing users to setup their
143 cluster processes in as secure a method as possible.
144 The following port types are defined for cluster:
146 cluster_port_t
149 Default Defined Ports:
153 tcp 5149,40040,50006-50008
154 udp 5149,50006-50008
155
157 The SELinux process type cluster_t can manage files labeled with the
158 following file types. The paths listed are the default paths for these
159 file types. Note the processes UID still need to have DAC permissions.
160 file_type
162 all files on the system
164
167 SELinux requires files to have an extended attribute to define the file
168 type.
169 You can see the context of a file using the -Z option to ls
171 Policy governs the access confined processes have to these files.
173 SELinux cluster policy is very flexible allowing users to setup their
174 cluster processes in as secure a method as possible.
175 EQUIVALENCE DIRECTORIES
177 cluster policy stores data with multiple different file context types
180 under the /var/log/pacemaker directory. If you would like to store the
181 data in a different directory you can use the semanage command to cre‐
182 ate an equivalence mapping. If you wanted to store this data under the
183 /srv directory you would execute the following command:
184 semanage fcontext -a -e /var/log/pacemaker /srv/pacemaker
186 restorecon -R -v /srv/pacemaker
187 STANDARD FILE CONTEXT
189 SELinux defines the file context types for the cluster, if you wanted
191 to store files with these types in a diffent paths, you need to execute
192 the semanage command to sepecify alternate labeling and then use re‐
193 storecon to put the labels on disk.
194 semanage fcontext -a -t cluster_unit_file_t '/srv/mycluster_con‐
196 tent(/.*)?'
197 restorecon -R -v /srv/mycluster_content
198 Note: SELinux often uses regular expressions to specify labels that
200 match multiple files.
201 The following file types are defined for cluster:
203 cluster_conf_t
207 - Set files with the cluster_conf_t type, if you want to treat the
209 files as cluster configuration data, usually stored under the /etc di‐
210 rectory.
211 cluster_exec_t
215 - Set files with the cluster_exec_t type, if you want to transition an
217 executable to the cluster_t domain.
218 Paths:
221 /usr/sbin/pcsd, /usr/sbin/aisexec, /usr/lib/pcsd/pcsd,
222 /usr/sbin/ccs_tool, /usr/sbin/corosync, /usr/sbin/cpglockd,
223 /usr/sbin/cman_tool, /usr/sbin/rgmanager, /usr/sbin/ldirectord,
224 /usr/sbin/pacemakerd, /usr/bin/corosync-qnetd, /usr/sbin/corosync-
225 notifyd, /usr/sbin/corosync-qdevice, /usr/sbin/pacemaker-remoted,
226 /usr/sbin/pacemaker_remoted, /usr/lib/heartbeat/heartbeat,
227 /usr/share/corosync/corosync, /usr/share/corosync/corosync-qdevice
228 cluster_initrc_exec_t
231 - Set files with the cluster_initrc_exec_t type, if you want to transi‐
233 tion an executable to the cluster_initrc_t domain.
234 Paths:
237 /etc/rc.d/init.d/openais, /etc/rc.d/init.d/corosync,
238 /etc/rc.d/init.d/cpglockd, /etc/rc.d/init.d/heartbeat,
239 /etc/rc.d/init.d/pacemaker, /etc/rc.d/init.d/rgmanager
240 cluster_tmp_t
243 - Set files with the cluster_tmp_t type, if you want to store cluster
245 temporary files in the /tmp directories.
246 cluster_tmpfs_t
250 - Set files with the cluster_tmpfs_t type, if you want to store cluster
252 files on a tmpfs file system.
253 cluster_unit_file_t
257 - Set files with the cluster_unit_file_t type, if you want to treat the
259 files as cluster unit content.
260 Paths:
263 /usr/lib/systemd/system/pcsd.*, /usr/lib/systemd/sys‐
264 tem/corosync.*, /usr/lib/systemd/system/pacemaker.*, /usr/lib/sys‐
265 temd/system/corosync-qnetd.*, /usr/lib/systemd/system/corosync-
266 qdevice.*
267 cluster_var_lib_t
270 - Set files with the cluster_var_lib_t type, if you want to store the
272 cluster files under the /var/lib directory.
273 Paths:
276 /var/lib/pcsd(/.*)?, /var/lib/cluster(/.*)?, /var/lib/ope‐
277 nais(/.*)?, /var/lib/pengine(/.*)?, /var/lib/corosync(/.*)?,
278 /usr/lib/heartbeat(/.*)?, /var/lib/heartbeat(/.*)?, /var/lib/pace‐
279 maker(/.*)?
280 cluster_var_log_t
283 - Set files with the cluster_var_log_t type, if you want to treat the
285 data as cluster var log data, usually stored under the /var/log direc‐
286 tory.
287 Paths:
290 /var/log/pcsd(/.*)?, /var/log/pacemaker(/.*)?, /var/log/pace‐
291 maker.log.*, /var/log/cluster/aisexec.log.*, /var/log/clus‐
292 ter/corosync.log.*, /var/log/cluster/cpglockd.log.*,
293 /var/log/cluster/rgmanager.log.*
294 cluster_var_run_t
297 - Set files with the cluster_var_run_t type, if you want to store the
299 cluster files under the /run or /var/run directory.
300 Paths:
303 /var/run/crm(/.*)?, /var/run/cman_.*, /var/run/rsctmp(/.*)?,
304 /var/run/aisexec.*, /var/run/heartbeat(/.*)?, /var/run/pcsd-
305 ruby.socket, /var/run/corosync-qnetd(/.*)?, /var/run/corosync-qde‐
306 vice(/.*)?, /var/run/corosync.pid, /var/run/cpglockd.pid,
307 /var/run/rgmanager.pid, /var/run/cluster/rgmanager.sk
308 Note: File context can be temporarily modified with the chcon command.
311 If you want to permanently change the file context you need to use the
312 semanage fcontext command. This will modify the SELinux labeling data‐
313 base. You will need to use restorecon to apply the labels.
314
317 semanage fcontext can also be used to manipulate default file context
318 mappings.
319 semanage permissive can also be used to manipulate whether or not a
321 process type is permissive.
322 semanage module can also be used to enable/disable/install/remove pol‐
324 icy modules.
325 semanage port can also be used to manipulate the port definitions
327 semanage boolean can also be used to manipulate the booleans
329 system-config-selinux is a GUI tool available to customize SELinux pol‐
332 icy settings.
333
336 This manual page was auto-generated using sepolicy manpage .
337
340 selinux(8), cluster(8), semanage(8), restorecon(8), chcon(1), sepol‐
341 icy(8), setsebool(8)
342cluster 21-06-09 cluster_selinux(8)