1shorewall_selinux(8) SELinux Policy shorewall shorewall_selinux(8)
2
6 shorewall_selinux - Security Enhanced Linux Policy for the shorewall
7 processes
8
10 Security-Enhanced Linux secures the shorewall processes via flexible
11 mandatory access control.
12 The shorewall processes execute with the shorewall_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep shorewall_t
20
24 The shorewall_t SELinux type can be entered via the shorewall_exec_t,
25 shorewall_var_lib_t file types.
26 The default entrypoint paths for the shorewall_t domain are the follow‐
28 ing:
29 /sbin/shorewall6?, /usr/sbin/shorewall6?, /sbin/shorewall-lite,
31 /usr/sbin/shorewall-lite, /var/lib/shorewall(/.*)?, /var/lib/shore‐
32 wall6(/.*)?, /var/lib/shorewall-lite(/.*)?
33
35 SELinux defines process types (domains) for each process running on the
36 system
37 You can see the context of a process using the -Z option to ps
39 Policy governs the access confined processes have to files. SELinux
41 shorewall policy is very flexible allowing users to setup their shore‐
42 wall processes in as secure a method as possible.
43 The following process types are defined for shorewall:
45 shorewall_t
47 Note: semanage permissive -a shorewall_t can be used to make the
49 process type shorewall_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
55 SELinux policy is customizable based on least access required. shore‐
56 wall policy is extremely flexible and has several booleans that allow
57 you to manipulate the policy and run shorewall with the tightest access
58 possible.
59 If you want to allow all domains to execute in fips_mode, you must turn
63 on the fips_mode boolean. Enabled by default.
64 setsebool -P fips_mode 1
66 If you want to allow system to run with NIS, you must turn on the
70 nis_enabled boolean. Disabled by default.
71 setsebool -P nis_enabled 1
73
77 The SELinux process type shorewall_t can manage files labeled with the
78 following file types. The paths listed are the default paths for these
79 file types. Note the processes UID still need to have DAC permissions.
80 cluster_conf_t
82 /etc/cluster(/.*)?
84 cluster_var_lib_t
86 /var/lib/pcsd(/.*)?
88 /var/lib/cluster(/.*)?
89 /var/lib/openais(/.*)?
90 /var/lib/pengine(/.*)?
91 /var/lib/corosync(/.*)?
92 /usr/lib/heartbeat(/.*)?
93 /var/lib/heartbeat(/.*)?
94 /var/lib/pacemaker(/.*)?
95 cluster_var_run_t
97 /var/run/crm(/.*)?
99 /var/run/cman_.*
100 /var/run/rsctmp(/.*)?
101 /var/run/aisexec.*
102 /var/run/heartbeat(/.*)?
103 /var/run/pcsd-ruby.socket
104 /var/run/corosync-qnetd(/.*)?
105 /var/run/corosync-qdevice(/.*)?
106 /var/run/corosync.pid
107 /var/run/cpglockd.pid
108 /var/run/rgmanager.pid
109 /var/run/cluster/rgmanager.sk
110 initrc_var_run_t
112 /var/run/utmp
114 /var/run/random-seed
115 /var/run/runlevel.dir
116 /var/run/setmixer_flag
117 krb5_host_rcache_t
119 /var/tmp/krb5_0.rcache2
121 /var/cache/krb5rcache(/.*)?
122 /var/tmp/nfs_0
123 /var/tmp/DNS_25
124 /var/tmp/host_0
125 /var/tmp/imap_0
126 /var/tmp/HTTP_23
127 /var/tmp/HTTP_48
128 /var/tmp/ldap_55
129 /var/tmp/ldap_487
130 /var/tmp/ldapmap1_0
131 root_t
133 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
135 /
136 /initrd
137 shorewall_lock_t
139 /var/lock/subsys/shorewall
141 shorewall_log_t
143 /var/log/shorewall.*
145 shorewall_tmp_t
147 shorewall_var_lib_t
150 /var/lib/shorewall(/.*)?
152 /var/lib/shorewall6(/.*)?
153 /var/lib/shorewall-lite(/.*)?
154
157 SELinux requires files to have an extended attribute to define the file
158 type.
159 You can see the context of a file using the -Z option to ls
161 Policy governs the access confined processes have to these files.
163 SELinux shorewall policy is very flexible allowing users to setup their
164 shorewall processes in as secure a method as possible.
165 EQUIVALENCE DIRECTORIES
167 shorewall policy stores data with multiple different file context types
170 under the /var/lib/shorewall directory. If you would like to store the
171 data in a different directory you can use the semanage command to cre‐
172 ate an equivalence mapping. If you wanted to store this data under the
173 /srv directory you would execute the following command:
174 semanage fcontext -a -e /var/lib/shorewall /srv/shorewall
176 restorecon -R -v /srv/shorewall
177 STANDARD FILE CONTEXT
179 SELinux defines the file context types for the shorewall, if you wanted
181 to store files with these types in a diffent paths, you need to execute
182 the semanage command to specify alternate labeling and then use re‐
183 storecon to put the labels on disk.
184 semanage fcontext -a -t shorewall_log_t '/srv/myshorewall_con‐
186 tent(/.*)?'
187 restorecon -R -v /srv/myshorewall_content
188 Note: SELinux often uses regular expressions to specify labels that
190 match multiple files.
191 The following file types are defined for shorewall:
193 shorewall_etc_t
197 - Set files with the shorewall_etc_t type, if you want to store shore‐
199 wall files in the /etc directories.
200 Paths:
203 /etc/shorewall(/.*)?, /etc/shorewall6(/.*)?, /etc/shorewall-
204 lite(/.*)?
205 shorewall_exec_t
208 - Set files with the shorewall_exec_t type, if you want to transition
210 an executable to the shorewall_t domain.
211 Paths:
214 /sbin/shorewall6?, /usr/sbin/shorewall6?, /sbin/shorewall-lite,
215 /usr/sbin/shorewall-lite
216 shorewall_initrc_exec_t
219 - Set files with the shorewall_initrc_exec_t type, if you want to tran‐
221 sition an executable to the shorewall_initrc_t domain.
222 shorewall_lock_t
226 - Set files with the shorewall_lock_t type, if you want to treat the
228 files as shorewall lock data, stored under the /var/lock directory
229 shorewall_log_t
233 - Set files with the shorewall_log_t type, if you want to treat the
235 data as shorewall log data, usually stored under the /var/log direc‐
236 tory.
237 shorewall_tmp_t
241 - Set files with the shorewall_tmp_t type, if you want to store shore‐
243 wall temporary files in the /tmp directories.
244 shorewall_var_lib_t
248 - Set files with the shorewall_var_lib_t type, if you want to store the
250 shorewall files under the /var/lib directory.
251 Paths:
254 /var/lib/shorewall(/.*)?, /var/lib/shorewall6(/.*)?,
255 /var/lib/shorewall-lite(/.*)?
256 Note: File context can be temporarily modified with the chcon command.
259 If you want to permanently change the file context you need to use the
260 semanage fcontext command. This will modify the SELinux labeling data‐
261 base. You will need to use restorecon to apply the labels.
262
265 semanage fcontext can also be used to manipulate default file context
266 mappings.
267 semanage permissive can also be used to manipulate whether or not a
269 process type is permissive.
270 semanage module can also be used to enable/disable/install/remove pol‐
272 icy modules.
273 semanage boolean can also be used to manipulate the booleans
275 system-config-selinux is a GUI tool available to customize SELinux pol‐
278 icy settings.
279
282 This manual page was auto-generated using sepolicy manpage .
283
286 selinux(8), shorewall(8), semanage(8), restorecon(8), chcon(1), sepol‐
287 icy(8), setsebool(8)
288shorewall 21-11-19 shorewall_selinux(8)