1glusterd_selinux(8) SELinux Policy glusterd glusterd_selinux(8)
2
6 glusterd_selinux - Security Enhanced Linux Policy for the glusterd pro‐
7 cesses
8
10 Security-Enhanced Linux secures the glusterd processes via flexible
11 mandatory access control.
12 The glusterd processes execute with the glusterd_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16 For example:
18 ps -eZ | grep glusterd_t
20
24 The glusterd_t SELinux type can be entered via the glusterd_exec_t file
25 type.
26 The default entrypoint paths for the glusterd_t domain are the follow‐
28 ing:
29 /opt/glusterfs/[^/]+/sbin/glusterfsd, /usr/libexec/glus‐
31 terfs/peer_eventsapi.py, /usr/libexec/glusterfs/events/glus‐
32 tereventsd.py, /usr/sbin/glusterfsd, /usr/sbin/glustereventsd,
33 /usr/sbin/gluster-eventsapi
34
36 SELinux defines process types (domains) for each process running on the
37 system
38 You can see the context of a process using the -Z option to ps
40 Policy governs the access confined processes have to files. SELinux
42 glusterd policy is very flexible allowing users to setup their glusterd
43 processes in as secure a method as possible.
44 The following process types are defined for glusterd:
46 glusterd_t
48 Note: semanage permissive -a glusterd_t can be used to make the process
50 type glusterd_t permissive. SELinux does not deny access to permissive
51 process types, but the AVC (SELinux denials) messages are still gener‐
52 ated.
53
56 SELinux policy is customizable based on least access required. glus‐
57 terd policy is extremely flexible and has several booleans that allow
58 you to manipulate the policy and run glusterd with the tightest access
59 possible.
60 If you want to allow glusterfsd to share any file/directory read only,
64 you must turn on the gluster_export_all_ro boolean. Disabled by de‐
65 fault.
66 setsebool -P gluster_export_all_ro 1
68 If you want to allow glusterfsd to share any file/directory read/write,
72 you must turn on the gluster_export_all_rw boolean. Enabled by default.
73 setsebool -P gluster_export_all_rw 1
75 If you want to allow glusterd_t domain to use executable memory, you
79 must turn on the gluster_use_execmem boolean. Disabled by default.
80 setsebool -P gluster_use_execmem 1
82 If you want to allow all domains to execute in fips_mode, you must turn
86 on the fips_mode boolean. Enabled by default.
87 setsebool -P fips_mode 1
89
93 SELinux defines port types to represent TCP and UDP ports.
94 You can see the types associated with a port by using the following
96 command:
97 semanage port -l
99 Policy governs the access confined processes have to these ports.
102 SELinux glusterd policy is very flexible allowing users to setup their
103 glusterd processes in as secure a method as possible.
104 The following port types are defined for glusterd:
106 gluster_port_t
109 Default Defined Ports:
113 tcp 38465-38469,24007-24027
114
116 The SELinux process type glusterd_t can manage files labeled with the
117 following file types. The paths listed are the default paths for these
118 file types. Note the processes UID still need to have DAC permissions.
119 cluster_conf_t
121 /etc/cluster(/.*)?
123 cluster_var_lib_t
125 /var/lib/pcsd(/.*)?
127 /var/lib/cluster(/.*)?
128 /var/lib/openais(/.*)?
129 /var/lib/pengine(/.*)?
130 /var/lib/corosync(/.*)?
131 /usr/lib/heartbeat(/.*)?
132 /var/lib/heartbeat(/.*)?
133 /var/lib/pacemaker(/.*)?
134 cluster_var_run_t
136 /var/run/crm(/.*)?
138 /var/run/cman_.*
139 /var/run/rsctmp(/.*)?
140 /var/run/aisexec.*
141 /var/run/heartbeat(/.*)?
142 /var/run/pcsd-ruby.socket
143 /var/run/corosync-qnetd(/.*)?
144 /var/run/corosync-qdevice(/.*)?
145 /var/run/corosync.pid
146 /var/run/cpglockd.pid
147 /var/run/rgmanager.pid
148 /var/run/cluster/rgmanager.sk
149 glusterd_brick_t
151 glusterd_conf_t
154 /etc/glusterd(/.*)?
156 /etc/glusterfs(/.*)?
157 glusterd_log_t
159 /var/log/glusterfs(/.*)?
161 glusterd_tmp_t
163 glusterd_tmpfs_t
166 glusterd_var_lib_t
169 /var/lib/glusterd(/.*)?
171 glusterd_var_run_t
173 /var/run/gluster(/.*)?
175 /var/run/glusterd.*
176 /var/run/glusterd.*
177 /var/run/glusterd(/.*)?
178 initrc_state_t
180 krb5_host_rcache_t
183 /var/tmp/krb5_0.rcache2
185 /var/cache/krb5rcache(/.*)?
186 /var/tmp/nfs_0
187 /var/tmp/DNS_25
188 /var/tmp/host_0
189 /var/tmp/imap_0
190 /var/tmp/HTTP_23
191 /var/tmp/HTTP_48
192 /var/tmp/ldap_55
193 /var/tmp/ldap_487
194 /var/tmp/ldapmap1_0
195 non_security_file_type
197 noxattrfs
200 all files on file systems which do not support extended attributes
202 root_t
204 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
206 /
207 /initrd
208 systemd_passwd_var_run_t
210 /var/run/systemd/ask-password(/.*)?
212 /var/run/systemd/ask-password-block(/.*)?
213 var_lib_nfs_t
215 /var/lib/nfs(/.*)?
217
220 SELinux requires files to have an extended attribute to define the file
221 type.
222 You can see the context of a file using the -Z option to ls
224 Policy governs the access confined processes have to these files.
226 SELinux glusterd policy is very flexible allowing users to setup their
227 glusterd processes in as secure a method as possible.
228 EQUIVALENCE DIRECTORIES
230 glusterd policy stores data with multiple different file context types
233 under the /var/run/gluster directory. If you would like to store the
234 data in a different directory you can use the semanage command to cre‐
235 ate an equivalence mapping. If you wanted to store this data under the
236 /srv directory you would execute the following command:
237 semanage fcontext -a -e /var/run/gluster /srv/gluster
239 restorecon -R -v /srv/gluster
240 STANDARD FILE CONTEXT
242 SELinux defines the file context types for the glusterd, if you wanted
244 to store files with these types in a diffent paths, you need to execute
245 the semanage command to specify alternate labeling and then use re‐
246 storecon to put the labels on disk.
247 semanage fcontext -a -t glusterd_brick_t '/srv/myglusterd_con‐
249 tent(/.*)?'
250 restorecon -R -v /srv/myglusterd_content
251 Note: SELinux often uses regular expressions to specify labels that
253 match multiple files.
254 The following file types are defined for glusterd:
256 glusterd_brick_t
260 - Set files with the glusterd_brick_t type, if you want to treat the
262 files as glusterd brick data.
263 glusterd_conf_t
267 - Set files with the glusterd_conf_t type, if you want to treat the
269 files as glusterd configuration data, usually stored under the /etc di‐
270 rectory.
271 Paths:
274 /etc/glusterd(/.*)?, /etc/glusterfs(/.*)?
275 glusterd_exec_t
278 - Set files with the glusterd_exec_t type, if you want to transition an
280 executable to the glusterd_t domain.
281 Paths:
284 /opt/glusterfs/[^/]+/sbin/glusterfsd, /usr/libexec/glus‐
285 terfs/peer_eventsapi.py, /usr/libexec/glusterfs/events/glus‐
286 tereventsd.py, /usr/sbin/glusterfsd, /usr/sbin/glustereventsd,
287 /usr/sbin/gluster-eventsapi
288 glusterd_initrc_exec_t
291 - Set files with the glusterd_initrc_exec_t type, if you want to tran‐
293 sition an executable to the glusterd_initrc_t domain.
294 Paths:
297 /etc/rc.d/init.d/gluster.*, /usr/sbin/glusterd
298 glusterd_log_t
301 - Set files with the glusterd_log_t type, if you want to treat the data
303 as glusterd log data, usually stored under the /var/log directory.
304 glusterd_tmp_t
308 - Set files with the glusterd_tmp_t type, if you want to store glusterd
310 temporary files in the /tmp directories.
311 glusterd_tmpfs_t
315 - Set files with the glusterd_tmpfs_t type, if you want to store glus‐
317 terd files on a tmpfs file system.
318 glusterd_var_lib_t
322 - Set files with the glusterd_var_lib_t type, if you want to store the
324 glusterd files under the /var/lib directory.
325 glusterd_var_run_t
329 - Set files with the glusterd_var_run_t type, if you want to store the
331 glusterd files under the /run or /var/run directory.
332 Paths:
335 /var/run/gluster(/.*)?, /var/run/glusterd.*, /var/run/glusterd.*,
336 /var/run/glusterd(/.*)?
337 Note: File context can be temporarily modified with the chcon command.
340 If you want to permanently change the file context you need to use the
341 semanage fcontext command. This will modify the SELinux labeling data‐
342 base. You will need to use restorecon to apply the labels.
343
346 If you want to share files with multiple domains (Apache, FTP, rsync,
347 Samba), you can set a file context of public_content_t and public_con‐
348 tent_rw_t. These context allow any of the above domains to read the
349 content. If you want a particular domain to write to the public_con‐
350 tent_rw_t domain, you must set the appropriate boolean.
351 Allow glusterd servers to read the /var/glusterd directory by adding
353 the public_content_t file type to the directory and by restoring the
354 file type.
355 semanage fcontext -a -t public_content_t "/var/glusterd(/.*)?"
357 restorecon -F -R -v /var/glusterd
358 Allow glusterd servers to read and write /var/glusterd/incoming by
360 adding the public_content_rw_t type to the directory and by restoring
361 the file type. You also need to turn on the glusterd_anon_write bool‐
362 ean.
363 semanage fcontext -a -t public_content_rw_t "/var/glusterd/incom‐
365 ing(/.*)?"
366 restorecon -F -R -v /var/glusterd/incoming
367 setsebool -P glusterd_anon_write 1
368 If you want to allow glusterfsd to modify public files used for public
371 file transfer services. Files/Directories must be labeled public_con‐
372 tent_rw_t., you must turn on the gluster_anon_write boolean.
373 setsebool -P gluster_anon_write 1
375
378 semanage fcontext can also be used to manipulate default file context
379 mappings.
380 semanage permissive can also be used to manipulate whether or not a
382 process type is permissive.
383 semanage module can also be used to enable/disable/install/remove pol‐
385 icy modules.
386 semanage port can also be used to manipulate the port definitions
388 semanage boolean can also be used to manipulate the booleans
390 system-config-selinux is a GUI tool available to customize SELinux pol‐
393 icy settings.
394
397 This manual page was auto-generated using sepolicy manpage .
398
401 selinux(8), glusterd(8), semanage(8), restorecon(8), chcon(1), sepol‐
402 icy(8), setsebool(8)
403glusterd 23-02-03 glusterd_selinux(8)