1systemd_resolved_selinux(S8E)Linux Policy systemd_resolsvyesdtemd_resolved_selinux(8)
2
3
4

NAME

6       systemd_resolved_selinux  - Security Enhanced Linux Policy for the sys‐
7       temd_resolved processes
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  systemd_resolved  processes  via
11       flexible mandatory access control.
12
13       The  systemd_resolved  processes  execute  with  the systemd_resolved_t
14       SELinux type. You can check if you have these processes running by exe‐
15       cuting the ps command with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep systemd_resolved_t
20
21
22

ENTRYPOINTS

24       The  systemd_resolved_t SELinux type can be entered via the systemd_re‐
25       solved_exec_t file type.
26
27       The default entrypoint paths for the systemd_resolved_t domain are  the
28       following:
29
30       /usr/lib/systemd/systemd-resolve(d|-host)
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       systemd_resolved  policy is very flexible allowing users to setup their
40       systemd_resolved processes in as secure a method as possible.
41
42       The following process types are defined for systemd_resolved:
43
44       systemd_resolved_t
45
46       Note: semanage permissive -a systemd_resolved_t can be used to make the
47       process  type  systemd_resolved_t permissive. SELinux does not deny ac‐
48       cess to permissive process types, but the AVC  (SELinux  denials)  mes‐
49       sages are still generated.
50
51

BOOLEANS

53       SELinux  policy  is  customizable based on least access required.  sys‐
54       temd_resolved policy is extremely flexible  and  has  several  booleans
55       that  allow  you to manipulate the policy and run systemd_resolved with
56       the tightest access possible.
57
58
59
60       If you want to allow all domains to execute in fips_mode, you must turn
61       on the fips_mode boolean. Enabled by default.
62
63       setsebool -P fips_mode 1
64
65
66

MANAGED FILES

68       The  SELinux  process  type systemd_resolved_t can manage files labeled
69       with the following file types.  The paths listed are the default  paths
70       for  these  file  types.  Note the processes UID still need to have DAC
71       permissions.
72
73       cluster_conf_t
74
75            /etc/cluster(/.*)?
76
77       cluster_var_lib_t
78
79            /var/lib/pcsd(/.*)?
80            /var/lib/cluster(/.*)?
81            /var/lib/openais(/.*)?
82            /var/lib/pengine(/.*)?
83            /var/lib/corosync(/.*)?
84            /usr/lib/heartbeat(/.*)?
85            /var/lib/heartbeat(/.*)?
86            /var/lib/pacemaker(/.*)?
87
88       cluster_var_run_t
89
90            /var/run/crm(/.*)?
91            /var/run/cman_.*
92            /var/run/rsctmp(/.*)?
93            /var/run/aisexec.*
94            /var/run/heartbeat(/.*)?
95            /var/run/pcsd-ruby.socket
96            /var/run/corosync-qnetd(/.*)?
97            /var/run/corosync-qdevice(/.*)?
98            /var/run/corosync.pid
99            /var/run/cpglockd.pid
100            /var/run/rgmanager.pid
101            /var/run/cluster/rgmanager.sk
102
103       krb5_host_rcache_t
104
105            /var/tmp/krb5_0.rcache2
106            /var/cache/krb5rcache(/.*)?
107            /var/tmp/nfs_0
108            /var/tmp/DNS_25
109            /var/tmp/host_0
110            /var/tmp/imap_0
111            /var/tmp/HTTP_23
112            /var/tmp/HTTP_48
113            /var/tmp/ldap_55
114            /var/tmp/ldap_487
115            /var/tmp/ldapmap1_0
116
117       root_t
118
119            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
120            /
121            /initrd
122
123       systemd_resolved_var_run_t
124
125            /var/run/systemd/resolve(/.*)?
126
127

FILE CONTEXTS

129       SELinux requires files to have an extended attribute to define the file
130       type.
131
132       You can see the context of a file using the -Z option to ls
133
134       Policy  governs  the  access  confined  processes  have to these files.
135       SELinux systemd_resolved policy is  very  flexible  allowing  users  to
136       setup  their systemd_resolved processes in as secure a method as possi‐
137       ble.
138
139       STANDARD FILE CONTEXT
140
141       SELinux defines the file context types for the systemd_resolved, if you
142       wanted  to store files with these types in a diffent paths, you need to
143       execute the semanage command to sepecify alternate  labeling  and  then
144       use restorecon to put the labels on disk.
145
146       semanage   fcontext  -a  -t  systemd_resolved_unit_file_t  '/srv/mysys‐
147       temd_resolved_content(/.*)?'
148       restorecon -R -v /srv/mysystemd_resolved_content
149
150       Note: SELinux often uses regular expressions  to  specify  labels  that
151       match multiple files.
152
153       The following file types are defined for systemd_resolved:
154
155
156
157       systemd_resolved_exec_t
158
159       - Set files with the systemd_resolved_exec_t type, if you want to tran‐
160       sition an executable to the systemd_resolved_t domain.
161
162
163
164       systemd_resolved_unit_file_t
165
166       - Set files with the systemd_resolved_unit_file_t type, if you want  to
167       treat the files as systemd resolved unit content.
168
169
170
171       systemd_resolved_var_run_t
172
173       -  Set  files  with the systemd_resolved_var_run_t type, if you want to
174       store the systemd resolved files under the /run or /var/run directory.
175
176
177
178       Note: File context can be temporarily modified with the chcon  command.
179       If  you want to permanently change the file context you need to use the
180       semanage fcontext command.  This will modify the SELinux labeling data‐
181       base.  You will need to use restorecon to apply the labels.
182
183

COMMANDS

185       semanage  fcontext  can also be used to manipulate default file context
186       mappings.
187
188       semanage permissive can also be used to manipulate  whether  or  not  a
189       process type is permissive.
190
191       semanage  module can also be used to enable/disable/install/remove pol‐
192       icy modules.
193
194       semanage boolean can also be used to manipulate the booleans
195
196
197       system-config-selinux is a GUI tool available to customize SELinux pol‐
198       icy settings.
199
200

AUTHOR

202       This manual page was auto-generated using sepolicy manpage .
203
204

SEE ALSO

206       selinux(8),  systemd_resolved(8), semanage(8), restorecon(8), chcon(1),
207       sepolicy(8), setsebool(8)
208
209
210
211systemd_resolved                   21-06-09        systemd_resolved_selinux(8)
Impressum