1shorewall_selinux(8) SELinux Policy shorewall shorewall_selinux(8)
2
6 shorewall_selinux - Security Enhanced Linux Policy for the shorewall
7 processes
8
10 Security-Enhanced Linux secures the shorewall processes via flexible
11 mandatory access control.
12 The shorewall processes execute with the shorewall_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep shorewall_t
20
24 The shorewall_t SELinux type can be entered via the shore‐
25 wall_var_lib_t, shorewall_exec_t file types.
26 The default entrypoint paths for the shorewall_t domain are the follow‐
28 ing:
29 /var/lib/shorewall(/.*)?, /var/lib/shorewall6(/.*)?, /var/lib/shore‐
31 wall-lite(/.*)?, /var/lib/shorewall6-lite(/.*)?, /sbin/shorewall6?,
32 /usr/sbin/shorewall6?, /sbin/shorewall-lite, /usr/sbin/shorewall-lite
33
35 SELinux defines process types (domains) for each process running on the
36 system
37 You can see the context of a process using the -Z option to ps
39 Policy governs the access confined processes have to files. SELinux
41 shorewall policy is very flexible allowing users to setup their shore‐
42 wall processes in as secure a method as possible.
43 The following process types are defined for shorewall:
45 shorewall_t
47 Note: semanage permissive -a shorewall_t can be used to make the
49 process type shorewall_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
55 SELinux policy is customizable based on least access required. shore‐
56 wall policy is extremely flexible and has several booleans that allow
57 you to manipulate the policy and run shorewall with the tightest access
58 possible.
59 If you want to allow all domains to execute in fips_mode, you must turn
63 on the fips_mode boolean. Enabled by default.
64 setsebool -P fips_mode 1
66 If you want to allow system to run with NIS, you must turn on the
70 nis_enabled boolean. Disabled by default.
71 setsebool -P nis_enabled 1
73
77 The SELinux process type shorewall_t can manage files labeled with the
78 following file types. The paths listed are the default paths for these
79 file types. Note the processes UID still need to have DAC permissions.
80 cluster_conf_t
82 /etc/cluster(/.*)?
84 cluster_var_lib_t
86 /var/lib/pcsd(/.*)?
88 /var/lib/cluster(/.*)?
89 /var/lib/openais(/.*)?
90 /var/lib/pengine(/.*)?
91 /var/lib/corosync(/.*)?
92 /usr/lib/heartbeat(/.*)?
93 /var/lib/heartbeat(/.*)?
94 /var/lib/pacemaker(/.*)?
95 cluster_var_run_t
97 /var/run/crm(/.*)?
99 /var/run/cman_.*
100 /var/run/rsctmp(/.*)?
101 /var/run/aisexec.*
102 /var/run/heartbeat(/.*)?
103 /var/run/pcsd-ruby.socket
104 /var/run/corosync-qnetd(/.*)?
105 /var/run/corosync-qdevice(/.*)?
106 /var/run/corosync.pid
107 /var/run/cpglockd.pid
108 /var/run/rgmanager.pid
109 /var/run/cluster/rgmanager.sk
110 initrc_var_run_t
112 /var/run/utmp
114 /var/run/random-seed
115 /var/run/runlevel.dir
116 /var/run/setmixer_flag
117 krb5_host_rcache_t
119 /var/tmp/krb5_0.rcache2
121 /var/cache/krb5rcache(/.*)?
122 /var/tmp/nfs_0
123 /var/tmp/DNS_25
124 /var/tmp/host_0
125 /var/tmp/imap_0
126 /var/tmp/HTTP_23
127 /var/tmp/HTTP_48
128 /var/tmp/ldap_55
129 /var/tmp/ldap_487
130 /var/tmp/ldapmap1_0
131 root_t
133 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
135 /
136 /initrd
137 shorewall_lock_t
139 /var/lock/subsys/shorewall
141 shorewall_log_t
143 /var/log/shorewall.*
145 shorewall_tmp_t
147 shorewall_var_lib_t
150 /var/lib/shorewall(/.*)?
152 /var/lib/shorewall6(/.*)?
153 /var/lib/shorewall-lite(/.*)?
154 /var/lib/shorewall6-lite(/.*)?
155
158 SELinux requires files to have an extended attribute to define the file
159 type.
160 You can see the context of a file using the -Z option to ls
162 Policy governs the access confined processes have to these files.
164 SELinux shorewall policy is very flexible allowing users to setup their
165 shorewall processes in as secure a method as possible.
166 EQUIVALENCE DIRECTORIES
168 shorewall policy stores data with multiple different file context types
171 under the /var/lib/shorewall directory. If you would like to store the
172 data in a different directory you can use the semanage command to cre‐
173 ate an equivalence mapping. If you wanted to store this data under the
174 /srv directory you would execute the following command:
175 semanage fcontext -a -e /var/lib/shorewall /srv/shorewall
177 restorecon -R -v /srv/shorewall
178 STANDARD FILE CONTEXT
180 SELinux defines the file context types for the shorewall, if you wanted
182 to store files with these types in a diffent paths, you need to execute
183 the semanage command to specify alternate labeling and then use re‐
184 storecon to put the labels on disk.
185 semanage fcontext -a -t shorewall_log_t '/srv/myshorewall_con‐
187 tent(/.*)?'
188 restorecon -R -v /srv/myshorewall_content
189 Note: SELinux often uses regular expressions to specify labels that
191 match multiple files.
192 The following file types are defined for shorewall:
194 shorewall_etc_t
198 - Set files with the shorewall_etc_t type, if you want to store shore‐
200 wall files in the /etc directories.
201 Paths:
204 /etc/shorewall(/.*)?, /etc/shorewall6(/.*)?, /etc/shorewall-
205 lite(/.*)?
206 shorewall_exec_t
209 - Set files with the shorewall_exec_t type, if you want to transition
211 an executable to the shorewall_t domain.
212 Paths:
215 /sbin/shorewall6?, /usr/sbin/shorewall6?, /sbin/shorewall-lite,
216 /usr/sbin/shorewall-lite
217 shorewall_initrc_exec_t
220 - Set files with the shorewall_initrc_exec_t type, if you want to tran‐
222 sition an executable to the shorewall_initrc_t domain.
223 shorewall_lock_t
227 - Set files with the shorewall_lock_t type, if you want to treat the
229 files as shorewall lock data, stored under the /var/lock directory
230 shorewall_log_t
234 - Set files with the shorewall_log_t type, if you want to treat the
236 data as shorewall log data, usually stored under the /var/log direc‐
237 tory.
238 shorewall_tmp_t
242 - Set files with the shorewall_tmp_t type, if you want to store shore‐
244 wall temporary files in the /tmp directories.
245 shorewall_var_lib_t
249 - Set files with the shorewall_var_lib_t type, if you want to store the
251 shorewall files under the /var/lib directory.
252 Paths:
255 /var/lib/shorewall(/.*)?, /var/lib/shorewall6(/.*)?,
256 /var/lib/shorewall-lite(/.*)?, /var/lib/shorewall6-lite(/.*)?
257 Note: File context can be temporarily modified with the chcon command.
260 If you want to permanently change the file context you need to use the
261 semanage fcontext command. This will modify the SELinux labeling data‐
262 base. You will need to use restorecon to apply the labels.
263
266 semanage fcontext can also be used to manipulate default file context
267 mappings.
268 semanage permissive can also be used to manipulate whether or not a
270 process type is permissive.
271 semanage module can also be used to enable/disable/install/remove pol‐
273 icy modules.
274 semanage boolean can also be used to manipulate the booleans
276 system-config-selinux is a GUI tool available to customize SELinux pol‐
279 icy settings.
280
283 This manual page was auto-generated using sepolicy manpage .
284
287 selinux(8), shorewall(8), semanage(8), restorecon(8), chcon(1), sepol‐
288 icy(8), setsebool(8)
289shorewall 23-02-03 shorewall_selinux(8)