1fsdaemon_selinux(8) SELinux Policy fsdaemon fsdaemon_selinux(8)
2
3
4
6 fsdaemon_selinux - Security Enhanced Linux Policy for the fsdaemon pro‐
7 cesses
8
10 Security-Enhanced Linux secures the fsdaemon processes via flexible
11 mandatory access control.
12
13 The fsdaemon processes execute with the fsdaemon_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep fsdaemon_t
20
21
22
24 The fsdaemon_t SELinux type can be entered via the fsdaemon_exec_t file
25 type.
26
27 The default entrypoint paths for the fsdaemon_t domain are the follow‐
28 ing:
29
30 /usr/sbin/smartd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 fsdaemon policy is very flexible allowing users to setup their fsdaemon
40 processes in as secure a method as possible.
41
42 The following process types are defined for fsdaemon:
43
44 fsdaemon_t
45
46 Note: semanage permissive -a fsdaemon_t can be used to make the process
47 type fsdaemon_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. fsdae‐
54 mon policy is extremely flexible and has several booleans that allow
55 you to manipulate the policy and run fsdaemon with the tightest access
56 possible.
57
58
59
60 If you want to allow all domains to execute in fips_mode, you must turn
61 on the fips_mode boolean. Enabled by default.
62
63 setsebool -P fips_mode 1
64
65
66
67 If you want to allow system to run with NIS, you must turn on the
68 nis_enabled boolean. Disabled by default.
69
70 setsebool -P nis_enabled 1
71
72
73
74 If you want to determine whether smartmon can support devices on 3ware
75 controllers, you must turn on the smartmon_3ware boolean. Disabled by
76 default.
77
78 setsebool -P smartmon_3ware 1
79
80
81
82 If you want to allow confined virtual guests to manage nfs files, you
83 must turn on the virt_use_nfs boolean. Disabled by default.
84
85 setsebool -P virt_use_nfs 1
86
87
88
89 If you want to allow confined virtual guests to manage cifs files, you
90 must turn on the virt_use_samba boolean. Disabled by default.
91
92 setsebool -P virt_use_samba 1
93
94
95
97 The SELinux process type fsdaemon_t can manage files labeled with the
98 following file types. The paths listed are the default paths for these
99 file types. Note the processes UID still need to have DAC permissions.
100
101 cluster_conf_t
102
103 /etc/cluster(/.*)?
104
105 cluster_var_lib_t
106
107 /var/lib/pcsd(/.*)?
108 /var/lib/cluster(/.*)?
109 /var/lib/openais(/.*)?
110 /var/lib/pengine(/.*)?
111 /var/lib/corosync(/.*)?
112 /usr/lib/heartbeat(/.*)?
113 /var/lib/heartbeat(/.*)?
114 /var/lib/pacemaker(/.*)?
115
116 cluster_var_run_t
117
118 /var/run/crm(/.*)?
119 /var/run/cman_.*
120 /var/run/rsctmp(/.*)?
121 /var/run/aisexec.*
122 /var/run/heartbeat(/.*)?
123 /var/run/pcsd-ruby.socket
124 /var/run/corosync-qnetd(/.*)?
125 /var/run/corosync-qdevice(/.*)?
126 /var/run/corosync.pid
127 /var/run/cpglockd.pid
128 /var/run/rgmanager.pid
129 /var/run/cluster/rgmanager.sk
130
131 fsdaemon_tmp_t
132
133
134 fsdaemon_var_lib_t
135
136 /var/lib/smartmontools(/.*)?
137
138 fsdaemon_var_run_t
139
140 /var/run/smartd.pid
141
142 krb5_host_rcache_t
143
144 /var/tmp/krb5_0.rcache2
145 /var/cache/krb5rcache(/.*)?
146 /var/tmp/nfs_0
147 /var/tmp/DNS_25
148 /var/tmp/host_0
149 /var/tmp/imap_0
150 /var/tmp/HTTP_23
151 /var/tmp/HTTP_48
152 /var/tmp/ldap_55
153 /var/tmp/ldap_487
154 /var/tmp/ldapmap1_0
155
156 mail_home_rw_t
157
158 /root/Maildir(/.*)?
159 /root/.esmtp_queue(/.*)?
160 /var/lib/arpwatch/.esmtp_queue(/.*)?
161 /home/[^/]+/.maildir(/.*)?
162 /home/[^/]+/Maildir(/.*)?
163 /home/[^/]+/.esmtp_queue(/.*)?
164
165 root_t
166
167 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
168 /
169 /initrd
170
171 security_t
172
173 /selinux
174
175
177 SELinux requires files to have an extended attribute to define the file
178 type.
179
180 You can see the context of a file using the -Z option to ls
181
182 Policy governs the access confined processes have to these files.
183 SELinux fsdaemon policy is very flexible allowing users to setup their
184 fsdaemon processes in as secure a method as possible.
185
186 STANDARD FILE CONTEXT
187
188 SELinux defines the file context types for the fsdaemon, if you wanted
189 to store files with these types in a diffent paths, you need to execute
190 the semanage command to specify alternate labeling and then use re‐
191 storecon to put the labels on disk.
192
193 semanage fcontext -a -t fsdaemon_tmp_t '/srv/myfsdaemon_content(/.*)?'
194 restorecon -R -v /srv/myfsdaemon_content
195
196 Note: SELinux often uses regular expressions to specify labels that
197 match multiple files.
198
199 The following file types are defined for fsdaemon:
200
201
202
203 fsdaemon_exec_t
204
205 - Set files with the fsdaemon_exec_t type, if you want to transition an
206 executable to the fsdaemon_t domain.
207
208
209
210 fsdaemon_initrc_exec_t
211
212 - Set files with the fsdaemon_initrc_exec_t type, if you want to tran‐
213 sition an executable to the fsdaemon_initrc_t domain.
214
215
216
217 fsdaemon_tmp_t
218
219 - Set files with the fsdaemon_tmp_t type, if you want to store fsdaemon
220 temporary files in the /tmp directories.
221
222
223
224 fsdaemon_var_lib_t
225
226 - Set files with the fsdaemon_var_lib_t type, if you want to store the
227 fsdaemon files under the /var/lib directory.
228
229
230
231 fsdaemon_var_run_t
232
233 - Set files with the fsdaemon_var_run_t type, if you want to store the
234 fsdaemon files under the /run or /var/run directory.
235
236
237
238 Note: File context can be temporarily modified with the chcon command.
239 If you want to permanently change the file context you need to use the
240 semanage fcontext command. This will modify the SELinux labeling data‐
241 base. You will need to use restorecon to apply the labels.
242
243
245 semanage fcontext can also be used to manipulate default file context
246 mappings.
247
248 semanage permissive can also be used to manipulate whether or not a
249 process type is permissive.
250
251 semanage module can also be used to enable/disable/install/remove pol‐
252 icy modules.
253
254 semanage boolean can also be used to manipulate the booleans
255
256
257 system-config-selinux is a GUI tool available to customize SELinux pol‐
258 icy settings.
259
260
262 This manual page was auto-generated using sepolicy manpage .
263
264
266 selinux(8), fsdaemon(8), semanage(8), restorecon(8), chcon(1), sepol‐
267 icy(8), setsebool(8)
268
269
270
271fsdaemon 22-05-27 fsdaemon_selinux(8)