1haproxy_selinux(8) SELinux Policy haproxy haproxy_selinux(8)
2
3
4
6 haproxy_selinux - Security Enhanced Linux Policy for the haproxy pro‐
7 cesses
8
10 Security-Enhanced Linux secures the haproxy processes via flexible
11 mandatory access control.
12
13 The haproxy processes execute with the haproxy_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep haproxy_t
20
21
22
24 The haproxy_t SELinux type can be entered via the haproxy_exec_t file
25 type.
26
27 The default entrypoint paths for the haproxy_t domain are the follow‐
28 ing:
29
30 /usr/sbin/haproxy, /usr/sbin/haproxy-systemd-wrapper
31
33 SELinux defines process types (domains) for each process running on the
34 system
35
36 You can see the context of a process using the -Z option to ps
37
38 Policy governs the access confined processes have to files. SELinux
39 haproxy policy is very flexible allowing users to setup their haproxy
40 processes in as secure a method as possible.
41
42 The following process types are defined for haproxy:
43
44 haproxy_t
45
46 Note: semanage permissive -a haproxy_t can be used to make the process
47 type haproxy_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
51
53 SELinux policy is customizable based on least access required. haproxy
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run haproxy with the tightest access possi‐
56 ble.
57
58
59
60 If you want to determine whether haproxy can connect to all TCP ports,
61 you must turn on the haproxy_connect_any boolean. Disabled by default.
62
63 setsebool -P haproxy_connect_any 1
64
65
66
67 If you want to allow cluster administrative cluster domains memcheck-
68 amd64- to use executable memory, you must turn on the cluster_use_ex‐
69 ecmem boolean. Disabled by default.
70
71 setsebool -P cluster_use_execmem 1
72
73
74
75 If you want to dontaudit all daemons scheduling requests (setsched,
76 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
77 Enabled by default.
78
79 setsebool -P daemons_dontaudit_scheduling 1
80
81
82
83 If you want to allow all domains to execute in fips_mode, you must turn
84 on the fips_mode boolean. Enabled by default.
85
86 setsebool -P fips_mode 1
87
88
89
90 If you want to allow system to run with NIS, you must turn on the
91 nis_enabled boolean. Disabled by default.
92
93 setsebool -P nis_enabled 1
94
95
96
98 The SELinux process type haproxy_t can manage files labeled with the
99 following file types. The paths listed are the default paths for these
100 file types. Note the processes UID still need to have DAC permissions.
101
102 cluster_conf_t
103
104 /etc/cluster(/.*)?
105
106 cluster_log
107
108
109 cluster_var_lib_t
110
111 /var/lib/pcsd(/.*)?
112 /var/lib/cluster(/.*)?
113 /var/lib/openais(/.*)?
114 /var/lib/pengine(/.*)?
115 /var/lib/corosync(/.*)?
116 /usr/lib/heartbeat(/.*)?
117 /var/lib/heartbeat(/.*)?
118 /var/lib/pacemaker(/.*)?
119
120 cluster_var_run_t
121
122 /var/run/crm(/.*)?
123 /var/run/cman_.*
124 /var/run/rsctmp(/.*)?
125 /var/run/aisexec.*
126 /var/run/heartbeat(/.*)?
127 /var/run/pcsd-ruby.socket
128 /var/run/corosync-qnetd(/.*)?
129 /var/run/corosync-qdevice(/.*)?
130 /var/run/corosync.pid
131 /var/run/cpglockd.pid
132 /var/run/rgmanager.pid
133 /var/run/cluster/rgmanager.sk
134
135 haproxy_tmpfs_t
136
137
138 haproxy_var_lib_t
139
140 /var/lib/haproxy(/.*)?
141
142 haproxy_var_run_t
143
144 /var/run/haproxy.stat.*
145 /var/run/haproxy.sock.*
146 /var/run/haproxy.pid
147
148 krb5_host_rcache_t
149
150 /var/tmp/krb5_0.rcache2
151 /var/cache/krb5rcache(/.*)?
152 /var/tmp/nfs_0
153 /var/tmp/DNS_25
154 /var/tmp/host_0
155 /var/tmp/imap_0
156 /var/tmp/HTTP_23
157 /var/tmp/HTTP_48
158 /var/tmp/ldap_55
159 /var/tmp/ldap_487
160 /var/tmp/ldapmap1_0
161
162 root_t
163
164 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
165 /
166 /initrd
167
168
170 SELinux requires files to have an extended attribute to define the file
171 type.
172
173 You can see the context of a file using the -Z option to ls
174
175 Policy governs the access confined processes have to these files.
176 SELinux haproxy policy is very flexible allowing users to setup their
177 haproxy processes in as secure a method as possible.
178
179 STANDARD FILE CONTEXT
180
181 SELinux defines the file context types for the haproxy, if you wanted
182 to store files with these types in a different paths, you need to exe‐
183 cute the semanage command to specify alternate labeling and then use
184 restorecon to put the labels on disk.
185
186 semanage fcontext -a -t haproxy_exec_t '/srv/haproxy/content(/.*)?'
187 restorecon -R -v /srv/myhaproxy_content
188
189 Note: SELinux often uses regular expressions to specify labels that
190 match multiple files.
191
192 The following file types are defined for haproxy:
193
194
195
196 haproxy_exec_t
197
198 - Set files with the haproxy_exec_t type, if you want to transition an
199 executable to the haproxy_t domain.
200
201
202 Paths:
203 /usr/sbin/haproxy, /usr/sbin/haproxy-systemd-wrapper
204
205
206 haproxy_tmpfs_t
207
208 - Set files with the haproxy_tmpfs_t type, if you want to store haproxy
209 files on a tmpfs file system.
210
211
212
213 haproxy_unit_file_t
214
215 - Set files with the haproxy_unit_file_t type, if you want to treat the
216 files as haproxy unit content.
217
218
219
220 haproxy_var_lib_t
221
222 - Set files with the haproxy_var_lib_t type, if you want to store the
223 haproxy files under the /var/lib directory.
224
225
226
227 haproxy_var_log_t
228
229 - Set files with the haproxy_var_log_t type, if you want to treat the
230 data as haproxy var log data, usually stored under the /var/log direc‐
231 tory.
232
233
234
235 haproxy_var_run_t
236
237 - Set files with the haproxy_var_run_t type, if you want to store the
238 haproxy files under the /run or /var/run directory.
239
240
241 Paths:
242 /var/run/haproxy.stat.*, /var/run/haproxy.sock.*,
243 /var/run/haproxy.pid
244
245
246 Note: File context can be temporarily modified with the chcon command.
247 If you want to permanently change the file context you need to use the
248 semanage fcontext command. This will modify the SELinux labeling data‐
249 base. You will need to use restorecon to apply the labels.
250
251
253 semanage fcontext can also be used to manipulate default file context
254 mappings.
255
256 semanage permissive can also be used to manipulate whether or not a
257 process type is permissive.
258
259 semanage module can also be used to enable/disable/install/remove pol‐
260 icy modules.
261
262 semanage boolean can also be used to manipulate the booleans
263
264
265 system-config-selinux is a GUI tool available to customize SELinux pol‐
266 icy settings.
267
268
270 This manual page was auto-generated using sepolicy manpage .
271
272
274 selinux(8), haproxy(8), semanage(8), restorecon(8), chcon(1), sepol‐
275 icy(8), setsebool(8)
276
277
278
279haproxy 23-10-20 haproxy_selinux(8)