1kdumpgui_selinux(8)         SELinux Policy kdumpgui        kdumpgui_selinux(8)
2
3
4

NAME

6       kdumpgui_selinux - Security Enhanced Linux Policy for the kdumpgui pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  kdumpgui  processes  via  flexible
11       mandatory access control.
12
13       The  kdumpgui  processes  execute with the kdumpgui_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep kdumpgui_t
20
21
22

ENTRYPOINTS

24       The kdumpgui_t SELinux type can be entered via the kdumpgui_exec_t file
25       type.
26
27       The default entrypoint paths for the kdumpgui_t domain are the  follow‐
28       ing:
29
30       /usr/share/system-config-kdump/system-config-kdump-backend.py
31

PROCESS TYPES

33       SELinux defines process types (domains) for each process running on the
34       system
35
36       You can see the context of a process using the -Z option to ps
37
38       Policy governs the access confined processes have  to  files.   SELinux
39       kdumpgui policy is very flexible allowing users to setup their kdumpgui
40       processes in as secure a method as possible.
41
42       The following process types are defined for kdumpgui:
43
44       kdumpgui_t
45
46       Note: semanage permissive -a kdumpgui_t can be used to make the process
47       type  kdumpgui_t permissive. SELinux does not deny access to permissive
48       process types, but the AVC (SELinux denials) messages are still  gener‐
49       ated.
50
51

BOOLEANS

53       SELinux   policy  is  customizable  based  on  least  access  required.
54       kdumpgui policy is extremely flexible and has several booleans that al‐
55       low you to manipulate the policy and run kdumpgui with the tightest ac‐
56       cess possible.
57
58
59
60       If you want to allow s-c-kdump to run bootloader in  bootloader_t,  you
61       must turn on the kdumpgui_run_bootloader boolean. Disabled by default.
62
63       setsebool -P kdumpgui_run_bootloader 1
64
65
66
67       If  you  want  to  dontaudit all daemons scheduling requests (setsched,
68       sys_nice), you must turn on the  daemons_dontaudit_scheduling  boolean.
69       Enabled by default.
70
71       setsebool -P daemons_dontaudit_scheduling 1
72
73
74
75       If you want to allow all domains to execute in fips_mode, you must turn
76       on the fips_mode boolean. Enabled by default.
77
78       setsebool -P fips_mode 1
79
80
81
82       If you want to allow system to run with  NIS,  you  must  turn  on  the
83       nis_enabled boolean. Disabled by default.
84
85       setsebool -P nis_enabled 1
86
87
88

MANAGED FILES

90       The  SELinux  process type kdumpgui_t can manage files labeled with the
91       following file types.  The paths listed are the default paths for these
92       file types.  Note the processes UID still need to have DAC permissions.
93
94       bootloader_etc_t
95
96            /etc/lilo.conf.*
97            /etc/zipl.conf.*
98            /etc/yaboot.conf.*
99            /etc/default/grub
100
101       cluster_conf_t
102
103            /etc/cluster(/.*)?
104
105       cluster_var_lib_t
106
107            /var/lib/pcsd(/.*)?
108            /var/lib/cluster(/.*)?
109            /var/lib/openais(/.*)?
110            /var/lib/pengine(/.*)?
111            /var/lib/corosync(/.*)?
112            /usr/lib/heartbeat(/.*)?
113            /var/lib/heartbeat(/.*)?
114            /var/lib/pacemaker(/.*)?
115
116       cluster_var_run_t
117
118            /var/run/crm(/.*)?
119            /var/run/cman_.*
120            /var/run/rsctmp(/.*)?
121            /var/run/aisexec.*
122            /var/run/heartbeat(/.*)?
123            /var/run/pcsd-ruby.socket
124            /var/run/corosync-qnetd(/.*)?
125            /var/run/corosync-qdevice(/.*)?
126            /var/run/corosync.pid
127            /var/run/cpglockd.pid
128            /var/run/rgmanager.pid
129            /var/run/cluster/rgmanager.sk
130
131       dosfs_t
132
133
134       kdump_etc_t
135
136            /etc/kdump.conf
137
138       kdumpgui_tmp_t
139
140
141       krb5_host_rcache_t
142
143            /var/tmp/krb5_0.rcache2
144            /var/cache/krb5rcache(/.*)?
145            /var/tmp/nfs_0
146            /var/tmp/DNS_25
147            /var/tmp/host_0
148            /var/tmp/imap_0
149            /var/tmp/HTTP_23
150            /var/tmp/HTTP_48
151            /var/tmp/ldap_55
152            /var/tmp/ldap_487
153            /var/tmp/ldapmap1_0
154
155       root_t
156
157            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
158            /
159            /initrd
160
161       systemd_passwd_var_run_t
162
163            /var/run/systemd/ask-password(/.*)?
164            /var/run/systemd/ask-password-block(/.*)?
165
166

FILE CONTEXTS

168       SELinux requires files to have an extended attribute to define the file
169       type.
170
171       You can see the context of a file using the -Z option to ls
172
173       Policy governs the access  confined  processes  have  to  these  files.
174       SELinux  kdumpgui policy is very flexible allowing users to setup their
175       kdumpgui processes in as secure a method as possible.
176
177       STANDARD FILE CONTEXT
178
179       SELinux defines the file context types for the kdumpgui, if you  wanted
180       to  store files with these types in a different paths, you need to exe‐
181       cute the semanage command to specify alternate labeling  and  then  use
182       restorecon to put the labels on disk.
183
184       semanage fcontext -a -t kdumpgui_exec_t '/srv/kdumpgui/content(/.*)?'
185       restorecon -R -v /srv/mykdumpgui_content
186
187       Note:  SELinux  often  uses  regular expressions to specify labels that
188       match multiple files.
189
190       The following file types are defined for kdumpgui:
191
192
193
194       kdumpgui_exec_t
195
196       - Set files with the kdumpgui_exec_t type, if you want to transition an
197       executable to the kdumpgui_t domain.
198
199
200
201       kdumpgui_tmp_t
202
203       - Set files with the kdumpgui_tmp_t type, if you want to store kdumpgui
204       temporary files in the /tmp directories.
205
206
207
208       Note: File context can be temporarily modified with the chcon  command.
209       If  you want to permanently change the file context you need to use the
210       semanage fcontext command.  This will modify the SELinux labeling data‐
211       base.  You will need to use restorecon to apply the labels.
212
213

COMMANDS

215       semanage  fcontext  can also be used to manipulate default file context
216       mappings.
217
218       semanage permissive can also be used to manipulate  whether  or  not  a
219       process type is permissive.
220
221       semanage  module can also be used to enable/disable/install/remove pol‐
222       icy modules.
223
224       semanage boolean can also be used to manipulate the booleans
225
226
227       system-config-selinux is a GUI tool available to customize SELinux pol‐
228       icy settings.
229
230

AUTHOR

232       This manual page was auto-generated using sepolicy manpage .
233
234

SEE ALSO

236       selinux(8),  kdumpgui(8),  semanage(8), restorecon(8), chcon(1), sepol‐
237       icy(8), setsebool(8)
238
239
240
241kdumpgui                           23-10-20                kdumpgui_selinux(8)
Impressum