chronyd_selinux(8)

1chronyd_selinux(8)          SELinux Policy chronyd          chronyd_selinux(8)
2
3
4

NAME

6       chronyd_selinux  -  Security Enhanced Linux Policy for the chronyd pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures  the  chronyd  processes  via  flexible
11       mandatory access control.
12
13       The  chronyd processes execute with the chronyd_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep chronyd_t
20
21
22

ENTRYPOINTS

24       The  chronyd_t  SELinux type can be entered via the chronyd_exec_t file
25       type.
26
27       The default entrypoint paths for the chronyd_t domain are  the  follow‐
28       ing:
29
30       /usr/sbin/chronyd, /usr/libexec/chrony-helper
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       chronyd  policy  is very flexible allowing users to setup their chronyd
40       processes in as secure a method as possible.
41
42       The following process types are defined for chronyd:
43
44       chronyd_t, chronyd_restricted_t
45
46       Note: semanage permissive -a chronyd_t can be used to make the  process
47       type  chronyd_t  permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux policy is customizable based on least access required.  chronyd
54       policy is extremely flexible and has several booleans that allow you to
55       manipulate  the  policy and run chronyd with the tightest access possi‐
56       ble.
57
58
59
60       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
61       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
62       Enabled by default.
63
64       setsebool -P daemons_dontaudit_scheduling 1
65
66
67
68       If you want to allow all domains to execute in fips_mode, you must turn
69       on the fips_mode boolean. Enabled by default.
70
71       setsebool -P fips_mode 1
72
73
74
75       If  you  want  to  allow  system  to run with NIS, you must turn on the
76       nis_enabled boolean. Disabled by default.
77
78       setsebool -P nis_enabled 1
79
80
81

PORT TYPES

83       SELinux defines port types to represent TCP and UDP ports.
84
85       You can see the types associated with a port  by  using  the  following
86       command:
87
88       semanage port -l
89
90
91       Policy  governs  the  access  confined  processes  have to these ports.
92       SELinux chronyd policy is very flexible allowing users to  setup  their
93       chronyd processes in as secure a method as possible.
94
95       The following port types are defined for chronyd:
96
97
98       chronyd_port_t
99
100
101
102       Default Defined Ports:
103                 udp 323
104

MANAGED FILES

106       The  SELinux  process  type chronyd_t can manage files labeled with the
107       following file types.  The paths listed are the default paths for these
108       file types.  Note the processes UID still need to have DAC permissions.
109
110       chronyd_tmp_t
111
112
113       chronyd_tmpfs_t
114
115
116       chronyd_var_lib_t
117
118            /var/lib/chrony(/.*)?
119
120       chronyd_var_run_t
121
122            /var/run/chrony(/.*)?
123            /var/run/chronyd(/.*)?
124            /var/run/chrony-dhcp(/.*)?
125            /var/run/chrony-helper(/.*)?
126            /var/run/chronyd.pid
127            /var/run/chronyd.sock
128
129       cluster_conf_t
130
131            /etc/cluster(/.*)?
132
133       cluster_var_lib_t
134
135            /var/lib/pcsd(/.*)?
136            /var/lib/cluster(/.*)?
137            /var/lib/openais(/.*)?
138            /var/lib/pengine(/.*)?
139            /var/lib/corosync(/.*)?
140            /usr/lib/heartbeat(/.*)?
141            /var/lib/heartbeat(/.*)?
142            /var/lib/pacemaker(/.*)?
143
144       cluster_var_run_t
145
146            /var/run/crm(/.*)?
147            /var/run/cman_.*
148            /var/run/rsctmp(/.*)?
149            /var/run/aisexec.*
150            /var/run/heartbeat(/.*)?
151            /var/run/pcsd-ruby.socket
152            /var/run/corosync-qnetd(/.*)?
153            /var/run/corosync-qdevice(/.*)?
154            /var/run/corosync.pid
155            /var/run/cpglockd.pid
156            /var/run/rgmanager.pid
157            /var/run/cluster/rgmanager.sk
158
159       gpsd_tmpfs_t
160
161
162       krb5_host_rcache_t
163
164            /var/tmp/krb5_0.rcache2
165            /var/cache/krb5rcache(/.*)?
166            /var/tmp/nfs_0
167            /var/tmp/DNS_25
168            /var/tmp/host_0
169            /var/tmp/imap_0
170            /var/tmp/HTTP_23
171            /var/tmp/HTTP_48
172            /var/tmp/ldap_55
173            /var/tmp/ldap_487
174            /var/tmp/ldapmap1_0
175
176       root_t
177
178            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
179            /
180            /initrd
181
182       systemd_passwd_var_run_t
183
184            /var/run/systemd/ask-password(/.*)?
185            /var/run/systemd/ask-password-block(/.*)?
186
187       timemaster_tmpfs_t
188
189
190

FILE CONTEXTS

192       SELinux requires files to have an extended attribute to define the file
193       type.
194
195       You can see the context of a file using the -Z option to ls
196
197       Policy governs the access  confined  processes  have  to  these  files.
198       SELinux  chronyd  policy is very flexible allowing users to setup their
199       chronyd processes in as secure a method as possible.
200
201       EQUIVALENCE DIRECTORIES
202
203
204       chronyd policy stores data with multiple different file  context  types
205       under  the  /var/run/chrony  directory.  If you would like to store the
206       data in a different directory you can use the semanage command to  cre‐
207       ate an equivalence mapping.  If you wanted to store this data under the
208       /srv directory you would execute the following command:
209
210       semanage fcontext -a -e /var/run/chrony /srv/chrony
211       restorecon -R -v /srv/chrony
212
213       STANDARD FILE CONTEXT
214
215       SELinux defines the file context types for the chronyd, if  you  wanted
216       to  store files with these types in a different paths, you need to exe‐
217       cute the semanage command to specify alternate labeling  and  then  use
218       restorecon to put the labels on disk.
219
220       semanage fcontext -a -t chronyd_exec_t '/srv/chronyd/content(/.*)?'
221       restorecon -R -v /srv/mychronyd_content
222
223       Note:  SELinux  often  uses  regular expressions to specify labels that
224       match multiple files.
225
226       The following file types are defined for chronyd:
227
228
229
230       chronyd_exec_t
231
232       - Set files with the chronyd_exec_t type, if you want to transition  an
233       executable to the chronyd_t domain.
234
235
236       Paths:
237            /usr/sbin/chronyd, /usr/libexec/chrony-helper
238
239
240       chronyd_initrc_exec_t
241
242       - Set files with the chronyd_initrc_exec_t type, if you want to transi‐
243       tion an executable to the chronyd_initrc_t domain.
244
245
246
247       chronyd_keys_t
248
249       - Set files with the chronyd_keys_t type, if  you  want  to  treat  the
250       files as chronyd keys data.
251
252
253
254       chronyd_tmp_t
255
256       -  Set  files with the chronyd_tmp_t type, if you want to store chronyd
257       temporary files in the /tmp directories.
258
259
260
261       chronyd_tmpfs_t
262
263       - Set files with the chronyd_tmpfs_t type, if you want to store chronyd
264       files on a tmpfs file system.
265
266
267
268       chronyd_unit_file_t
269
270       - Set files with the chronyd_unit_file_t type, if you want to treat the
271       files as chronyd unit content.
272
273
274
275       chronyd_var_lib_t
276
277       - Set files with the chronyd_var_lib_t type, if you want to  store  the
278       chronyd files under the /var/lib directory.
279
280
281
282       chronyd_var_log_t
283
284       -  Set  files with the chronyd_var_log_t type, if you want to treat the
285       data as chronyd var log data, usually stored under the /var/log  direc‐
286       tory.
287
288
289
290       chronyd_var_run_t
291
292       -  Set  files with the chronyd_var_run_t type, if you want to store the
293       chronyd files under the /run or /var/run directory.
294
295
296       Paths:
297            /var/run/chrony(/.*)?,  /var/run/chronyd(/.*)?,   /var/run/chrony-
298            dhcp(/.*)?,   /var/run/chrony-helper(/.*)?,  /var/run/chronyd.pid,
299            /var/run/chronyd.sock
300
301
302       Note: File context can be temporarily modified with the chcon  command.
303       If  you want to permanently change the file context you need to use the
304       semanage fcontext command.  This will modify the SELinux labeling data‐
305       base.  You will need to use restorecon to apply the labels.
306
307

COMMANDS

309       semanage  fcontext  can also be used to manipulate default file context
310       mappings.
311
312       semanage permissive can also be used to manipulate  whether  or  not  a
313       process type is permissive.
314
315       semanage  module can also be used to enable/disable/install/remove pol‐
316       icy modules.
317
318       semanage port can also be used to manipulate the port definitions
319
320       semanage boolean can also be used to manipulate the booleans
321
322
323       system-config-selinux is a GUI tool available to customize SELinux pol‐
324       icy settings.
325
326

AUTHOR

328       This manual page was auto-generated using sepolicy manpage .
329
330