1pki_tps_selinux(8) SELinux Policy pki_tps pki_tps_selinux(8)
2
6 pki_tps_selinux - Security Enhanced Linux Policy for the pki_tps pro‐
7 cesses
8
10 Security-Enhanced Linux secures the pki_tps processes via flexible
11 mandatory access control.
12 The pki_tps processes execute with the pki_tps_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16 For example:
18 ps -eZ | grep pki_tps_t
20
24 The pki_tps_t SELinux type can be entered via the pki_tps_exec_t file
25 type.
26 The default entrypoint paths for the pki_tps_t domain are the follow‐
28 ing:
29 /var/lib/pki-tps/pki-tps
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 pki_tps policy is very flexible allowing users to setup their pki_tps
40 processes in as secure a method as possible.
41 The following process types are defined for pki_tps:
43 pki_tps_t
45 Note: semanage permissive -a pki_tps_t can be used to make the process
47 type pki_tps_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required. pki_tps
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run pki_tps with the tightest access possi‐
56 ble.
57 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62 setsebool -P fips_mode 1
64
68 SELinux defines port types to represent TCP and UDP ports.
69 You can see the types associated with a port by using the following
71 command:
72 semanage port -l
74 Policy governs the access confined processes have to these ports.
77 SELinux pki_tps policy is very flexible allowing users to setup their
78 pki_tps processes in as secure a method as possible.
79 The following port types are defined for pki_tps:
81 pki_tps_port_t
84 Default Defined Ports:
88 tcp 7888-7889
89
91 The SELinux process type pki_tps_t can manage files labeled with the
92 following file types. The paths listed are the default paths for these
93 file types. Note the processes UID still need to have DAC permissions.
94 cluster_conf_t
96 /etc/cluster(/.*)?
98 cluster_var_lib_t
100 /var/lib/pcsd(/.*)?
102 /var/lib/cluster(/.*)?
103 /var/lib/openais(/.*)?
104 /var/lib/pengine(/.*)?
105 /var/lib/corosync(/.*)?
106 /usr/lib/heartbeat(/.*)?
107 /var/lib/heartbeat(/.*)?
108 /var/lib/pacemaker(/.*)?
109 cluster_var_run_t
111 /var/run/crm(/.*)?
113 /var/run/cman_.*
114 /var/run/rsctmp(/.*)?
115 /var/run/aisexec.*
116 /var/run/heartbeat(/.*)?
117 /var/run/pcsd-ruby.socket
118 /var/run/corosync-qnetd(/.*)?
119 /var/run/corosync-qdevice(/.*)?
120 /var/run/corosync.pid
121 /var/run/cpglockd.pid
122 /var/run/rgmanager.pid
123 /var/run/cluster/rgmanager.sk
124 krb5_host_rcache_t
126 /var/tmp/krb5_0.rcache2
128 /var/cache/krb5rcache(/.*)?
129 /var/tmp/nfs_0
130 /var/tmp/DNS_25
131 /var/tmp/host_0
132 /var/tmp/imap_0
133 /var/tmp/HTTP_23
134 /var/tmp/HTTP_48
135 /var/tmp/ldap_55
136 /var/tmp/ldap_487
137 /var/tmp/ldapmap1_0
138 pki_common_t
140 /opt/nfast(/.*)?
142 pki_tps_etc_rw_t
144 /etc/pki-tps(/.*)?
146 /etc/sysconfig/pki/tps(/.*)?
147 pki_tps_lock_t
149 pki_tps_log_t
152 /var/log/pki-tps(/.*)?
154 pki_tps_tmp_t
156 pki_tps_var_lib_t
159 /var/lib/pki-tps(/.*)?
161 pki_tps_var_run_t
163 /var/run/pki/tps(/.*)?
165 root_t
167 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
169 /
170 /initrd
171
174 SELinux requires files to have an extended attribute to define the file
175 type.
176 You can see the context of a file using the -Z option to ls
178 Policy governs the access confined processes have to these files.
180 SELinux pki_tps policy is very flexible allowing users to setup their
181 pki_tps processes in as secure a method as possible.
182 EQUIVALENCE DIRECTORIES
184 pki_tps policy stores data with multiple different file context types
187 under the /var/lib/pki-tps directory. If you would like to store the
188 data in a different directory you can use the semanage command to cre‐
189 ate an equivalence mapping. If you wanted to store this data under the
190 /srv directory you would execute the following command:
191 semanage fcontext -a -e /var/lib/pki-tps /srv/pki-tps
193 restorecon -R -v /srv/pki-tps
194 STANDARD FILE CONTEXT
196 SELinux defines the file context types for the pki_tps, if you wanted
198 to store files with these types in a diffent paths, you need to execute
199 the semanage command to sepecify alternate labeling and then use re‐
200 storecon to put the labels on disk.
201 semanage fcontext -a -t pki_tps_tmp_t '/srv/mypki_tps_content(/.*)?'
203 restorecon -R -v /srv/mypki_tps_content
204 Note: SELinux often uses regular expressions to specify labels that
206 match multiple files.
207 The following file types are defined for pki_tps:
209 pki_tps_etc_rw_t
213 - Set files with the pki_tps_etc_rw_t type, if you want to treat the
215 files as pki tps etc read/write content.
216 Paths:
219 /etc/pki-tps(/.*)?, /etc/sysconfig/pki/tps(/.*)?
220 pki_tps_exec_t
223 - Set files with the pki_tps_exec_t type, if you want to transition an
225 executable to the pki_tps_t domain.
226 pki_tps_lock_t
230 - Set files with the pki_tps_lock_t type, if you want to treat the
232 files as pki tps lock data, stored under the /var/lock directory
233 pki_tps_log_t
237 - Set files with the pki_tps_log_t type, if you want to treat the data
239 as pki tps log data, usually stored under the /var/log directory.
240 pki_tps_script_exec_t
244 - Set files with the pki_tps_script_exec_t type, if you want to transi‐
246 tion an executable to the pki_tps_script_t domain.
247 pki_tps_tmp_t
251 - Set files with the pki_tps_tmp_t type, if you want to store pki tps
253 temporary files in the /tmp directories.
254 pki_tps_tomcat_exec_t
258 - Set files with the pki_tps_tomcat_exec_t type, if you want to transi‐
260 tion an executable to the pki_tps_tomcat_t domain.
261 pki_tps_var_lib_t
265 - Set files with the pki_tps_var_lib_t type, if you want to store the
267 pki tps files under the /var/lib directory.
268 pki_tps_var_run_t
272 - Set files with the pki_tps_var_run_t type, if you want to store the
274 pki tps files under the /run or /var/run directory.
275 Note: File context can be temporarily modified with the chcon command.
279 If you want to permanently change the file context you need to use the
280 semanage fcontext command. This will modify the SELinux labeling data‐
281 base. You will need to use restorecon to apply the labels.
282
285 semanage fcontext can also be used to manipulate default file context
286 mappings.
287 semanage permissive can also be used to manipulate whether or not a
289 process type is permissive.
290 semanage module can also be used to enable/disable/install/remove pol‐
292 icy modules.
293 semanage port can also be used to manipulate the port definitions
295 semanage boolean can also be used to manipulate the booleans
297 system-config-selinux is a GUI tool available to customize SELinux pol‐
300 icy settings.
301
304 This manual page was auto-generated using sepolicy manpage .
305
308 selinux(8), pki_tps(8), semanage(8), restorecon(8), chcon(1), sepol‐
309 icy(8), setsebool(8)
310pki_tps 21-06-09 pki_tps_selinux(8)