1nagios_eventhandler_SpElLuigniunx_sPeolliincuyx(n8a)gios_envaegnitohsa_nedvleenrt_hpalnudglienr_plugin_selinux(8)
2
3
4

NAME

6       nagios_eventhandler_plugin_selinux - Security Enhanced Linux Policy for
7       the nagios_eventhandler_plugin processes
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  nagios_eventhandler_plugin  pro‐
11       cesses via flexible mandatory access control.
12
13       The  nagios_eventhandler_plugin processes execute with the nagios_even‐
14       thandler_plugin_t SELinux type. You can check if you  have  these  pro‐
15       cesses running by executing the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep nagios_eventhandler_plugin_t
20
21
22

ENTRYPOINTS

24       The  nagios_eventhandler_plugin_t  SELinux  type can be entered via the
25       nagios_eventhandler_plugin_exec_t file type.
26
27       The default entrypoint paths for the  nagios_eventhandler_plugin_t  do‐
28       main are the following:
29
30       /usr/lib/icinga/plugins/eventhandlers(/.*),       /usr/lib/nagios/plug‐
31       ins/eventhandlers(/.*)
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       nagios_eventhandler_plugin policy is very flexible  allowing  users  to
41       setup  their nagios_eventhandler_plugin processes in as secure a method
42       as possible.
43
44       The following process types are defined for nagios_eventhandler_plugin:
45
46       nagios_eventhandler_plugin_t
47
48       Note: semanage permissive -a nagios_eventhandler_plugin_t can  be  used
49       to  make  the  process  type  nagios_eventhandler_plugin_t  permissive.
50       SELinux does not deny access to permissive process types, but  the  AVC
51       (SELinux denials) messages are still generated.
52
53

BOOLEANS

55       SELinux  policy  is  customizable  based on least access required.  na‐
56       gios_eventhandler_plugin policy is extremely flexible and  has  several
57       booleans  that  allow you to manipulate the policy and run nagios_even‐
58       thandler_plugin with the tightest access possible.
59
60
61
62       If you want to deny user domains applications to map a memory region as
63       both  executable  and  writable,  this  is dangerous and the executable
64       should be reported in bugzilla, you must turn on the deny_execmem bool‐
65       ean. Enabled by default.
66
67       setsebool -P deny_execmem 1
68
69
70
71       If  you  want  to control the ability to mmap a low area of the address
72       space, as configured by /proc/sys/vm/mmap_min_addr, you  must  turn  on
73       the mmap_low_allowed boolean. Disabled by default.
74
75       setsebool -P mmap_low_allowed 1
76
77
78
79       If  you want to disable kernel module loading, you must turn on the se‐
80       cure_mode_insmod boolean. Enabled by default.
81
82       setsebool -P secure_mode_insmod 1
83
84
85
86       If you want to allow unconfined executables to make their  heap  memory
87       executable.   Doing  this  is  a  really bad idea. Probably indicates a
88       badly coded executable, but could indicate an attack.  This  executable
89       should  be  reported  in bugzilla, you must turn on the selinuxuser_ex‐
90       echeap boolean. Disabled by default.
91
92       setsebool -P selinuxuser_execheap 1
93
94
95
96       If you want to allow unconfined executables to make  their  stack  exe‐
97       cutable.   This  should  never, ever be necessary. Probably indicates a
98       badly coded executable, but could indicate an attack.  This  executable
99       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
100       stack boolean. Enabled by default.
101
102       setsebool -P selinuxuser_execstack 1
103
104
105

MANAGED FILES

107       The SELinux process type nagios_eventhandler_plugin_t can manage  files
108       labeled  with  the  following file types.  The paths listed are the de‐
109       fault paths for these file types.  Note the processes UID still need to
110       have DAC permissions.
111
112       file_type
113
114            all files on the system
115
116

FILE CONTEXTS

118       SELinux requires files to have an extended attribute to define the file
119       type.
120
121       You can see the context of a file using the -Z option to ls
122
123       Policy governs the access  confined  processes  have  to  these  files.
124       SELinux  nagios_eventhandler_plugin  policy  is  very flexible allowing
125       users to setup their nagios_eventhandler_plugin processes in as  secure
126       a method as possible.
127
128       STANDARD FILE CONTEXT
129
130       SELinux   defines   the   file   context  types  for  the  nagios_even‐
131       thandler_plugin, if you wanted to store files with  these  types  in  a
132       diffent paths, you need to execute the semanage command to sepecify al‐
133       ternate labeling and then use restorecon to put the labels on disk.
134
135       semanage fcontext -a  -t  nagios_eventhandler_plugin_tmp_t  '/srv/myna‐
136       gios_eventhandler_plugin_content(/.*)?'
137       restorecon -R -v /srv/mynagios_eventhandler_plugin_content
138
139       Note:  SELinux  often  uses  regular expressions to specify labels that
140       match multiple files.
141
142       The following file types are defined for nagios_eventhandler_plugin:
143
144
145
146       nagios_eventhandler_plugin_exec_t
147
148       - Set files with the  nagios_eventhandler_plugin_exec_t  type,  if  you
149       want  to  transition  an executable to the nagios_eventhandler_plugin_t
150       domain.
151
152
153       Paths:
154            /usr/lib/icinga/plugins/eventhandlers(/.*),  /usr/lib/nagios/plug‐
155            ins/eventhandlers(/.*)
156
157
158       nagios_eventhandler_plugin_tmp_t
159
160       - Set files with the nagios_eventhandler_plugin_tmp_t type, if you want
161       to store nagios eventhandler plugin temporary files in the /tmp  direc‐
162       tories.
163
164
165
166       Note:  File context can be temporarily modified with the chcon command.
167       If you want to permanently change the file context you need to use  the
168       semanage fcontext command.  This will modify the SELinux labeling data‐
169       base.  You will need to use restorecon to apply the labels.
170
171

COMMANDS

173       semanage fcontext can also be used to manipulate default  file  context
174       mappings.
175
176       semanage  permissive  can  also  be used to manipulate whether or not a
177       process type is permissive.
178
179       semanage module can also be used to enable/disable/install/remove  pol‐
180       icy modules.
181
182       semanage boolean can also be used to manipulate the booleans
183
184
185       system-config-selinux is a GUI tool available to customize SELinux pol‐
186       icy settings.
187
188

AUTHOR

190       This manual page was auto-generated using sepolicy manpage .
191
192

SEE ALSO

194       selinux(8), nagios_eventhandler_plugin(8), semanage(8),  restorecon(8),
195       chcon(1), sepolicy(8), setsebool(8)
196
197
198
199nagios_eventhandler_plugin         21-06-0n9agios_eventhandler_plugin_selinux(8)
Impressum