1ksm_selinux(8) SELinux Policy ksm ksm_selinux(8)
2
3
4
6 ksm_selinux - Security Enhanced Linux Policy for the ksm processes
7
9 Security-Enhanced Linux secures the ksm processes via flexible manda‐
10 tory access control.
11
12 The ksm processes execute with the ksm_t SELinux type. You can check if
13 you have these processes running by executing the ps command with the
14 -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep ksm_t
19
20
21
23 The ksm_t SELinux type can be entered via the ksm_exec_t file type.
24
25 The default entrypoint paths for the ksm_t domain are the following:
26
27 /usr/libexec/ksmctl
28
30 SELinux defines process types (domains) for each process running on the
31 system
32
33 You can see the context of a process using the -Z option to ps
34
35 Policy governs the access confined processes have to files. SELinux
36 ksm policy is very flexible allowing users to setup their ksm processes
37 in as secure a method as possible.
38
39 The following process types are defined for ksm:
40
41 ksmtuned_t, ksm_t
42
43 Note: semanage permissive -a ksm_t can be used to make the process type
44 ksm_t permissive. SELinux does not deny access to permissive process
45 types, but the AVC (SELinux denials) messages are still generated.
46
47
49 SELinux policy is customizable based on least access required. ksm
50 policy is extremely flexible and has several booleans that allow you to
51 manipulate the policy and run ksm with the tightest access possible.
52
53
54
55 If you want to allow all domains to execute in fips_mode, you must turn
56 on the fips_mode boolean. Enabled by default.
57
58 setsebool -P fips_mode 1
59
60
61
63 The SELinux process type ksm_t can manage files labeled with the fol‐
64 lowing file types. The paths listed are the default paths for these
65 file types. Note the processes UID still need to have DAC permissions.
66
67 cluster_conf_t
68
69 /etc/cluster(/.*)?
70
71 cluster_var_lib_t
72
73 /var/lib/pcsd(/.*)?
74 /var/lib/cluster(/.*)?
75 /var/lib/openais(/.*)?
76 /var/lib/pengine(/.*)?
77 /var/lib/corosync(/.*)?
78 /usr/lib/heartbeat(/.*)?
79 /var/lib/heartbeat(/.*)?
80 /var/lib/pacemaker(/.*)?
81
82 cluster_var_run_t
83
84 /var/run/crm(/.*)?
85 /var/run/cman_.*
86 /var/run/rsctmp(/.*)?
87 /var/run/aisexec.*
88 /var/run/heartbeat(/.*)?
89 /var/run/pcsd-ruby.socket
90 /var/run/corosync-qnetd(/.*)?
91 /var/run/corosync-qdevice(/.*)?
92 /var/run/corosync.pid
93 /var/run/cpglockd.pid
94 /var/run/rgmanager.pid
95 /var/run/cluster/rgmanager.sk
96
97 root_t
98
99 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
100 /
101 /initrd
102
103 sysfs_t
104
105 /sys(/.*)?
106
107
109 SELinux requires files to have an extended attribute to define the file
110 type.
111
112 You can see the context of a file using the -Z option to ls
113
114 Policy governs the access confined processes have to these files.
115 SELinux ksm policy is very flexible allowing users to setup their ksm
116 processes in as secure a method as possible.
117
118 STANDARD FILE CONTEXT
119
120 SELinux defines the file context types for the ksm, if you wanted to
121 store files with these types in a diffent paths, you need to execute
122 the semanage command to specify alternate labeling and then use re‐
123 storecon to put the labels on disk.
124
125 semanage fcontext -a -t ksmtuned_var_run_t '/srv/myksm_content(/.*)?'
126 restorecon -R -v /srv/myksm_content
127
128 Note: SELinux often uses regular expressions to specify labels that
129 match multiple files.
130
131 The following file types are defined for ksm:
132
133
134
135 ksm_exec_t
136
137 - Set files with the ksm_exec_t type, if you want to transition an exe‐
138 cutable to the ksm_t domain.
139
140
141
142 ksm_unit_file_t
143
144 - Set files with the ksm_unit_file_t type, if you want to treat the
145 files as ksm unit content.
146
147
148
149 ksmtuned_exec_t
150
151 - Set files with the ksmtuned_exec_t type, if you want to transition an
152 executable to the ksmtuned_t domain.
153
154
155
156 ksmtuned_initrc_exec_t
157
158 - Set files with the ksmtuned_initrc_exec_t type, if you want to tran‐
159 sition an executable to the ksmtuned_initrc_t domain.
160
161
162
163 ksmtuned_log_t
164
165 - Set files with the ksmtuned_log_t type, if you want to treat the data
166 as ksmtuned log data, usually stored under the /var/log directory.
167
168
169
170 ksmtuned_unit_file_t
171
172 - Set files with the ksmtuned_unit_file_t type, if you want to treat
173 the files as ksmtuned unit content.
174
175
176
177 ksmtuned_var_run_t
178
179 - Set files with the ksmtuned_var_run_t type, if you want to store the
180 ksmtuned files under the /run or /var/run directory.
181
182
183
184 Note: File context can be temporarily modified with the chcon command.
185 If you want to permanently change the file context you need to use the
186 semanage fcontext command. This will modify the SELinux labeling data‐
187 base. You will need to use restorecon to apply the labels.
188
189
191 semanage fcontext can also be used to manipulate default file context
192 mappings.
193
194 semanage permissive can also be used to manipulate whether or not a
195 process type is permissive.
196
197 semanage module can also be used to enable/disable/install/remove pol‐
198 icy modules.
199
200 semanage boolean can also be used to manipulate the booleans
201
202
203 system-config-selinux is a GUI tool available to customize SELinux pol‐
204 icy settings.
205
206
208 This manual page was auto-generated using sepolicy manpage .
209
210
212 selinux(8), ksm(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
213 setsebool(8)
214
215
216
217ksm 22-05-27 ksm_selinux(8)