piranha_web_selinux(8)

1piranha_web_selinux(8)    SELinux Policy piranha_web    piranha_web_selinux(8)
2
3
4

NAME

6       piranha_web_selinux  -  Security  Enhanced  Linux  Policy  for  the pi‐
7       ranha_web processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the piranha_web processes via  flexible
11       mandatory access control.
12
13       The  piranha_web processes execute with the piranha_web_t SELinux type.
14       You can check if you have these processes running by executing  the  ps
15       command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep piranha_web_t
20
21
22

ENTRYPOINTS

24       The   piranha_web_t   SELinux   type   can   be  entered  via  the  pi‐
25       ranha_web_exec_t file type.
26
27       The default entrypoint paths for the piranha_web_t domain are the  fol‐
28       lowing:
29
30       /usr/sbin/piranha_gui
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       piranha_web  policy  is very flexible allowing users to setup their pi‐
40       ranha_web processes in as secure a method as possible.
41
42       The following process types are defined for piranha_web:
43
44       piranha_web_t
45
46       Note: semanage permissive -a piranha_web_t can  be  used  to  make  the
47       process  type piranha_web_t permissive. SELinux does not deny access to
48       permissive process types, but the AVC (SELinux  denials)  messages  are
49       still generated.
50
51

BOOLEANS

53       SELinux  policy  is  customizable  based on least access required.  pi‐
54       ranha_web policy is extremely flexible and has  several  booleans  that
55       allow  you to manipulate the policy and run piranha_web with the tight‐
56       est access possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66

MANAGED FILES

68       The  SELinux  process  type piranha_web_t can manage files labeled with
69       the following file types.  The paths listed are the default  paths  for
70       these  file  types.  Note the processes UID still need to have DAC per‐
71       missions.
72
73       cluster_conf_t
74
75            /etc/cluster(/.*)?
76
77       cluster_var_lib_t
78
79            /var/lib/pcsd(/.*)?
80            /var/lib/cluster(/.*)?
81            /var/lib/openais(/.*)?
82            /var/lib/pengine(/.*)?
83            /var/lib/corosync(/.*)?
84            /usr/lib/heartbeat(/.*)?
85            /var/lib/heartbeat(/.*)?
86            /var/lib/pacemaker(/.*)?
87
88       cluster_var_run_t
89
90            /var/run/crm(/.*)?
91            /var/run/cman_.*
92            /var/run/rsctmp(/.*)?
93            /var/run/aisexec.*
94            /var/run/heartbeat(/.*)?
95            /var/run/pcsd-ruby.socket
96            /var/run/corosync-qnetd(/.*)?
97            /var/run/corosync-qdevice(/.*)?
98            /var/run/corosync.pid
99            /var/run/cpglockd.pid
100            /var/run/rgmanager.pid
101            /var/run/cluster/rgmanager.sk
102
103       krb5_host_rcache_t
104
105            /var/tmp/krb5_0.rcache2
106            /var/cache/krb5rcache(/.*)?
107            /var/tmp/nfs_0
108            /var/tmp/DNS_25
109            /var/tmp/host_0
110            /var/tmp/imap_0
111            /var/tmp/HTTP_23
112            /var/tmp/HTTP_48
113            /var/tmp/ldap_55
114            /var/tmp/ldap_487
115            /var/tmp/ldapmap1_0
116
117       piranha_log_t
118
119            /var/log/piranha(/.*)?
120
121       piranha_web_data_t
122
123            /var/lib/luci(/.*)?
124
125       piranha_web_tmp_t
126
127
128       piranha_web_tmpfs_t
129
130
131       piranha_web_var_run_t
132
133            /var/run/piranha-httpd.pid
134
135       root_t
136
137            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
138            /
139            /initrd
140
141

FILE CONTEXTS

143       SELinux requires files to have an extended attribute to define the file
144       type.
145
146       You can see the context of a file using the -Z option to ls
147
148       Policy  governs  the  access  confined  processes  have to these files.
149       SELinux piranha_web policy is very flexible  allowing  users  to  setup
150       their piranha_web processes in as secure a method as possible.
151
152       EQUIVALENCE DIRECTORIES
153
154
155       piranha_web  policy  stores  data  with multiple different file context
156       types under the /var/lib/luci directory.  If you would  like  to  store
157       the  data  in a different directory you can use the semanage command to
158       create an equivalence mapping.  If you wanted to store this data  under
159       the /srv directory you would execute the following command:
160
161       semanage fcontext -a -e /var/lib/luci /srv/luci
162       restorecon -R -v /srv/luci
163
164       STANDARD FILE CONTEXT
165
166       SELinux  defines  the  file  context  types for the piranha_web, if you
167       wanted to store files with these types in a diffent paths, you need  to
168       execute  the  semanage  command to sepecify alternate labeling and then
169       use restorecon to put the labels on disk.
170
171       semanage  fcontext  -a  -t  piranha_web_tmp_t  '/srv/mypiranha_web_con‐
172       tent(/.*)?'
173       restorecon -R -v /srv/mypiranha_web_content
174
175       Note:  SELinux  often  uses  regular expressions to specify labels that
176       match multiple files.
177
178       The following file types are defined for piranha_web:
179
180
181
182       piranha_web_conf_t
183
184       - Set files with the piranha_web_conf_t type, if you want to treat  the
185       files  as piranha web configuration data, usually stored under the /etc
186       directory.
187
188
189       Paths:
190            /var/lib/luci/etc(/.*)?, /var/lib/luci/cert(/.*)?
191
192
193       piranha_web_data_t
194
195       - Set files with the piranha_web_data_t type, if you want to treat  the
196       files as piranha web content.
197
198
199
200       piranha_web_exec_t
201
202       - Set files with the piranha_web_exec_t type, if you want to transition
203       an executable to the piranha_web_t domain.
204
205
206
207       piranha_web_tmp_t
208
209       - Set files with the piranha_web_tmp_t type, if you want to  store  pi‐
210       ranha web temporary files in the /tmp directories.
211
212
213
214       piranha_web_tmpfs_t
215
216       - Set files with the piranha_web_tmpfs_t type, if you want to store pi‐
217       ranha web files on a tmpfs file system.
218
219
220
221       piranha_web_var_run_t
222
223       - Set files with the piranha_web_var_run_t type, if you want  to  store
224       the piranha web files under the /run or /var/run directory.
225
226
227
228       Note:  File context can be temporarily modified with the chcon command.
229       If you want to permanently change the file context you need to use  the
230       semanage fcontext command.  This will modify the SELinux labeling data‐
231       base.  You will need to use restorecon to apply the labels.
232
233

COMMANDS

235       semanage fcontext can also be used to manipulate default  file  context
236       mappings.
237
238       semanage  permissive  can  also  be used to manipulate whether or not a
239       process type is permissive.
240
241       semanage module can also be used to enable/disable/install/remove  pol‐
242       icy modules.
243
244       semanage boolean can also be used to manipulate the booleans
245
246
247       system-config-selinux is a GUI tool available to customize SELinux pol‐
248       icy settings.
249
250

AUTHOR

252       This manual page was auto-generated using sepolicy manpage .
253
254