asterisk_selinux(8)

1asterisk_selinux(8)         SELinux Policy asterisk        asterisk_selinux(8)
2
3
4

NAME

6       asterisk_selinux - Security Enhanced Linux Policy for the asterisk pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  asterisk  processes  via  flexible
11       mandatory access control.
12
13       The  asterisk  processes  execute with the asterisk_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep asterisk_t
20
21
22

ENTRYPOINTS

24       The asterisk_t SELinux type can be entered via the asterisk_exec_t file
25       type.
26
27       The default entrypoint paths for the asterisk_t domain are the  follow‐
28       ing:
29
30       /usr/sbin/asterisk
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       asterisk policy is very flexible allowing users to setup their asterisk
40       processes in as secure a method as possible.
41
42       The following process types are defined for asterisk:
43
44       asterisk_t
45
46       Note: semanage permissive -a asterisk_t can be used to make the process
47       type  asterisk_t permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux  policy is customizable based on least access required.  aster‐
54       isk policy is extremely flexible and has several  booleans  that  allow
55       you  to manipulate the policy and run asterisk with the tightest access
56       possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66

PORT TYPES

68       SELinux defines port types to represent TCP and UDP ports.
69
70       You  can  see  the  types associated with a port by using the following
71       command:
72
73       semanage port -l
74
75
76       Policy governs the access  confined  processes  have  to  these  ports.
77       SELinux  asterisk policy is very flexible allowing users to setup their
78       asterisk processes in as secure a method as possible.
79
80       The following port types are defined for asterisk:
81
82
83       asterisk_port_t
84
85
86
87       Default Defined Ports:
88                 tcp 1720
89                 udp 2427,2727,4569
90

MANAGED FILES

92       The SELinux process type asterisk_t can manage files labeled  with  the
93       following file types.  The paths listed are the default paths for these
94       file types.  Note the processes UID still need to have DAC permissions.
95
96       asterisk_log_t
97
98            /var/log/asterisk(/.*)?
99
100       asterisk_spool_t
101
102            /var/spool/asterisk(/.*)?
103
104       asterisk_tmp_t
105
106
107       asterisk_tmpfs_t
108
109
110       asterisk_var_lib_t
111
112            /var/lib/asterisk(/.*)?
113
114       asterisk_var_run_t
115
116            /var/run/asterisk.*
117
118       cluster_conf_t
119
120            /etc/cluster(/.*)?
121
122       cluster_var_lib_t
123
124            /var/lib/pcsd(/.*)?
125            /var/lib/cluster(/.*)?
126            /var/lib/openais(/.*)?
127            /var/lib/pengine(/.*)?
128            /var/lib/corosync(/.*)?
129            /usr/lib/heartbeat(/.*)?
130            /var/lib/heartbeat(/.*)?
131            /var/lib/pacemaker(/.*)?
132
133       cluster_var_run_t
134
135            /var/run/crm(/.*)?
136            /var/run/cman_.*
137            /var/run/rsctmp(/.*)?
138            /var/run/aisexec.*
139            /var/run/heartbeat(/.*)?
140            /var/run/pcsd-ruby.socket
141            /var/run/corosync-qnetd(/.*)?
142            /var/run/corosync-qdevice(/.*)?
143            /var/run/corosync.pid
144            /var/run/cpglockd.pid
145            /var/run/rgmanager.pid
146            /var/run/cluster/rgmanager.sk
147
148       krb5_host_rcache_t
149
150            /var/tmp/krb5_0.rcache2
151            /var/cache/krb5rcache(/.*)?
152            /var/tmp/nfs_0
153            /var/tmp/DNS_25
154            /var/tmp/host_0
155            /var/tmp/imap_0
156            /var/tmp/HTTP_23
157            /var/tmp/HTTP_48
158            /var/tmp/ldap_55
159            /var/tmp/ldap_487
160            /var/tmp/ldapmap1_0
161
162       root_t
163
164            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
165            /
166            /initrd
167
168

FILE CONTEXTS

170       SELinux requires files to have an extended attribute to define the file
171       type.
172
173       You can see the context of a file using the -Z option to ls
174
175       Policy  governs  the  access  confined  processes  have to these files.
176       SELinux asterisk policy is very flexible allowing users to setup  their
177       asterisk processes in as secure a method as possible.
178
179       STANDARD FILE CONTEXT
180
181       SELinux  defines the file context types for the asterisk, if you wanted
182       to store files with these types in a diffent paths, you need to execute
183       the  semanage  command  to sepecify alternate labeling and then use re‐
184       storecon to put the labels on disk.
185
186       semanage  fcontext  -a  -t   asterisk_var_run_t   '/srv/myasterisk_con‐
187       tent(/.*)?'
188       restorecon -R -v /srv/myasterisk_content
189
190       Note:  SELinux  often  uses  regular expressions to specify labels that
191       match multiple files.
192
193       The following file types are defined for asterisk:
194
195
196
197       asterisk_etc_t
198
199       - Set files with the asterisk_etc_t type, if you want to store asterisk
200       files in the /etc directories.
201
202
203
204       asterisk_exec_t
205
206       - Set files with the asterisk_exec_t type, if you want to transition an
207       executable to the asterisk_t domain.
208
209
210
211       asterisk_initrc_exec_t
212
213       - Set files with the asterisk_initrc_exec_t type, if you want to  tran‐
214       sition an executable to the asterisk_initrc_t domain.
215
216
217
218       asterisk_log_t
219
220       - Set files with the asterisk_log_t type, if you want to treat the data
221       as asterisk log data, usually stored under the /var/log directory.
222
223
224
225       asterisk_spool_t
226
227       - Set files with the asterisk_spool_t type, if you want  to  store  the
228       asterisk files under the /var/spool directory.
229
230
231
232       asterisk_tmp_t
233
234       - Set files with the asterisk_tmp_t type, if you want to store asterisk
235       temporary files in the /tmp directories.
236
237
238
239       asterisk_tmpfs_t
240
241       - Set files with the asterisk_tmpfs_t type, if you want to store aster‐
242       isk files on a tmpfs file system.
243
244
245
246       asterisk_var_lib_t
247
248       -  Set files with the asterisk_var_lib_t type, if you want to store the
249       asterisk files under the /var/lib directory.
250
251
252
253       asterisk_var_run_t
254
255       - Set files with the asterisk_var_run_t type, if you want to store  the
256       asterisk files under the /run or /var/run directory.
257
258
259
260       Note:  File context can be temporarily modified with the chcon command.
261       If you want to permanently change the file context you need to use  the
262       semanage fcontext command.  This will modify the SELinux labeling data‐
263       base.  You will need to use restorecon to apply the labels.
264
265

COMMANDS

267       semanage fcontext can also be used to manipulate default  file  context
268       mappings.
269
270       semanage  permissive  can  also  be used to manipulate whether or not a
271       process type is permissive.
272
273       semanage module can also be used to enable/disable/install/remove  pol‐
274       icy modules.
275
276       semanage port can also be used to manipulate the port definitions
277
278       semanage boolean can also be used to manipulate the booleans
279
280
281       system-config-selinux is a GUI tool available to customize SELinux pol‐
282       icy settings.
283
284

AUTHOR

286       This manual page was auto-generated using sepolicy manpage .
287
288