1dirsrvadmin_selinux(8) SELinux Policy dirsrvadmin dirsrvadmin_selinux(8)
2
3
4
6 dirsrvadmin_selinux - Security Enhanced Linux Policy for the dirsrvad‐
7 min processes
8
10 Security-Enhanced Linux secures the dirsrvadmin processes via flexible
11 mandatory access control.
12
13 The dirsrvadmin processes execute with the dirsrvadmin_t SELinux type.
14 You can check if you have these processes running by executing the ps
15 command with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep dirsrvadmin_t
20
21
22
24 The dirsrvadmin_t SELinux type can be entered via the dirsrvad‐
25 min_exec_t, shell_exec_t file types.
26
27 The default entrypoint paths for the dirsrvadmin_t domain are the fol‐
28 lowing:
29
30 /usr/sbin/stop-ds-admin, /usr/sbin/start-ds-admin, /usr/sbin/restart-
31 ds-admin, /bin/d?ash, /bin/ksh.*, /bin/zsh.*, /usr/bin/d?ash,
32 /usr/bin/ksh.*, /usr/bin/zsh.*, /bin/esh, /bin/bash, /bin/fish,
33 /bin/mksh, /bin/sash, /bin/tcsh, /bin/yash, /bin/bash2, /usr/bin/esh,
34 /sbin/nologin, /usr/bin/bash, /usr/bin/fish, /usr/bin/mksh,
35 /usr/bin/sash, /usr/bin/tcsh, /usr/bin/yash, /usr/bin/bash2,
36 /usr/sbin/sesh, /usr/sbin/smrsh, /usr/bin/scponly, /usr/libexec/sesh,
37 /usr/sbin/nologin, /usr/bin/git-shell, /usr/sbin/scponlyc,
38 /usr/libexec/sudo/sesh, /usr/bin/cockpit-bridge, /usr/libexec/cockpit-
39 agent, /usr/libexec/git-core/git-shell
40
42 SELinux defines process types (domains) for each process running on the
43 system
44
45 You can see the context of a process using the -Z option to ps
46
47 Policy governs the access confined processes have to files. SELinux
48 dirsrvadmin policy is very flexible allowing users to setup their
49 dirsrvadmin processes in as secure a method as possible.
50
51 The following process types are defined for dirsrvadmin:
52
53 dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
54
55 Note: semanage permissive -a dirsrvadmin_t can be used to make the
56 process type dirsrvadmin_t permissive. SELinux does not deny access to
57 permissive process types, but the AVC (SELinux denials) messages are
58 still generated.
59
60
62 SELinux policy is customizable based on least access required. dirsr‐
63 vadmin policy is extremely flexible and has several booleans that allow
64 you to manipulate the policy and run dirsrvadmin with the tightest ac‐
65 cess possible.
66
67
68
69 If you want to dontaudit all daemons scheduling requests (setsched,
70 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
71 Enabled by default.
72
73 setsebool -P daemons_dontaudit_scheduling 1
74
75
76
77 If you want to allow all domains to execute in fips_mode, you must turn
78 on the fips_mode boolean. Enabled by default.
79
80 setsebool -P fips_mode 1
81
82
83
85 The SELinux process type dirsrvadmin_t can manage files labeled with
86 the following file types. The paths listed are the default paths for
87 these file types. Note the processes UID still need to have DAC per‐
88 missions.
89
90 cluster_conf_t
91
92 /etc/cluster(/.*)?
93
94 cluster_var_lib_t
95
96 /var/lib/pcsd(/.*)?
97 /var/lib/cluster(/.*)?
98 /var/lib/openais(/.*)?
99 /var/lib/pengine(/.*)?
100 /var/lib/corosync(/.*)?
101 /usr/lib/heartbeat(/.*)?
102 /var/lib/heartbeat(/.*)?
103 /var/lib/pacemaker(/.*)?
104
105 cluster_var_run_t
106
107 /var/run/crm(/.*)?
108 /var/run/cman_.*
109 /var/run/rsctmp(/.*)?
110 /var/run/aisexec.*
111 /var/run/heartbeat(/.*)?
112 /var/run/pcsd-ruby.socket
113 /var/run/corosync-qnetd(/.*)?
114 /var/run/corosync-qdevice(/.*)?
115 /var/run/corosync.pid
116 /var/run/cpglockd.pid
117 /var/run/rgmanager.pid
118 /var/run/cluster/rgmanager.sk
119
120 dirsrvadmin_tmp_t
121
122
123 root_t
124
125 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
126 /
127 /initrd
128
129
131 SELinux requires files to have an extended attribute to define the file
132 type.
133
134 You can see the context of a file using the -Z option to ls
135
136 Policy governs the access confined processes have to these files.
137 SELinux dirsrvadmin policy is very flexible allowing users to setup
138 their dirsrvadmin processes in as secure a method as possible.
139
140 STANDARD FILE CONTEXT
141
142 SELinux defines the file context types for the dirsrvadmin, if you
143 wanted to store files with these types in a different paths, you need
144 to execute the semanage command to specify alternate labeling and then
145 use restorecon to put the labels on disk.
146
147 semanage fcontext -a -t dirsrvadmin_exec_t '/srv/dirsrvadmin/con‐
148 tent(/.*)?'
149 restorecon -R -v /srv/mydirsrvadmin_content
150
151 Note: SELinux often uses regular expressions to specify labels that
152 match multiple files.
153
154 The following file types are defined for dirsrvadmin:
155
156
157
158 dirsrvadmin_config_t
159
160 - Set files with the dirsrvadmin_config_t type, if you want to treat
161 the files as dirsrvadmin configuration data, usually stored under the
162 /etc directory.
163
164
165 Paths:
166 /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
167
168
169 dirsrvadmin_content_t
170
171 - Set files with the dirsrvadmin_content_t type, if you want to treat
172 the files as dirsrvadmin content.
173
174
175
176 dirsrvadmin_exec_t
177
178 - Set files with the dirsrvadmin_exec_t type, if you want to transition
179 an executable to the dirsrvadmin_t domain.
180
181
182 Paths:
183 /usr/sbin/stop-ds-admin, /usr/sbin/start-ds-admin,
184 /usr/sbin/restart-ds-admin
185
186
187 dirsrvadmin_htaccess_t
188
189 - Set files with the dirsrvadmin_htaccess_t type, if you want to treat
190 the file as a dirsrvadmin access file.
191
192
193
194 dirsrvadmin_lock_t
195
196 - Set files with the dirsrvadmin_lock_t type, if you want to treat the
197 files as dirsrvadmin lock data, stored under the /var/lock directory
198
199
200
201 dirsrvadmin_ra_content_t
202
203 - Set files with the dirsrvadmin_ra_content_t type, if you want to
204 treat the files as dirsrvadmin read/append content.
205
206
207
208 dirsrvadmin_rw_content_t
209
210 - Set files with the dirsrvadmin_rw_content_t type, if you want to
211 treat the files as dirsrvadmin read/write content.
212
213
214
215 dirsrvadmin_script_exec_t
216
217 - Set files with the dirsrvadmin_script_exec_t type, if you want to
218 transition an executable to the dirsrvadmin_script_t domain.
219
220
221 Paths:
222 /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
223
224
225 dirsrvadmin_tmp_t
226
227 - Set files with the dirsrvadmin_tmp_t type, if you want to store
228 dirsrvadmin temporary files in the /tmp directories.
229
230
231
232 dirsrvadmin_unconfined_script_exec_t
233
234 - Set files with the dirsrvadmin_unconfined_script_exec_t type, if you
235 want to transition an executable to the dirsrvadmin_unconfined_script_t
236 domain.
237
238
239 Paths:
240 /usr/lib/dirsrv/cgi-bin/ds_create, /usr/lib/dirsrv/cgi-bin/ds_re‐
241 move
242
243
244 dirsrvadmin_unit_file_t
245
246 - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
247 the files as dirsrvadmin unit content.
248
249
250
251 Note: File context can be temporarily modified with the chcon command.
252 If you want to permanently change the file context you need to use the
253 semanage fcontext command. This will modify the SELinux labeling data‐
254 base. You will need to use restorecon to apply the labels.
255
256
258 semanage fcontext can also be used to manipulate default file context
259 mappings.
260
261 semanage permissive can also be used to manipulate whether or not a
262 process type is permissive.
263
264 semanage module can also be used to enable/disable/install/remove pol‐
265 icy modules.
266
267 semanage boolean can also be used to manipulate the booleans
268
269
270 system-config-selinux is a GUI tool available to customize SELinux pol‐
271 icy settings.
272
273
275 This manual page was auto-generated using sepolicy manpage .
276
277
279 selinux(8), dirsrvadmin(8), semanage(8), restorecon(8), chcon(1), se‐
280 policy(8), setsebool(8), dirsrvadmin_script_selinux(8), dirsrvad‐
281 min_script_selinux(8), dirsrvadmin_unconfined_script_selinux(8), dirsr‐
282 vadmin_unconfined_script_selinux(8)
283
284
285
286dirsrvadmin 23-10-20 dirsrvadmin_selinux(8)