lvm_selinux(8)

1lvm_selinux(8)                SELinux Policy lvm                lvm_selinux(8)
2
3
4

NAME

6       lvm_selinux - Security Enhanced Linux Policy for the lvm processes
7

DESCRIPTION

9       Security-Enhanced  Linux  secures the lvm processes via flexible manda‐
10       tory access control.
11
12       The lvm processes execute with the lvm_t SELinux type. You can check if
13       you  have  these processes running by executing the ps command with the
14       -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep lvm_t
19
20
21

ENTRYPOINTS

23       The lvm_t SELinux type can be entered via the lvm_exec_t file type.
24
25       The default entrypoint paths for the lvm_t domain are the following:
26
27       /lib/lvm-10/.*,          /lib/lvm-200/.*,           /usr/lib/lvm-10/.*,
28       /usr/lib/lvm-200/.*,         /usr/lib/systemd/system-generators/lvm2.*,
29       /sbin/lvm, /sbin/lvs, /sbin/pvs, /sbin/vgs,  /sbin/vgck,  /sbin/dmraid,
30       /sbin/kpartx,  /sbin/lvmsar,  /sbin/lvscan, /sbin/pvdata, /sbin/pvmove,
31       /sbin/pvscan,     /sbin/vgscan,      /sbin/dmsetup,      /sbin/e2fsadm,
32       /sbin/lvmetad,     /sbin/lvmsadc,     /sbin/vgmerge,     /sbin/vgsplit,
33       /usr/sbin/lvm,     /usr/sbin/lvs,     /usr/sbin/pvs,     /usr/sbin/vgs,
34       /sbin/lvchange,    /sbin/lvcreate,    /sbin/lvextend,   /sbin/lvmpolld,
35       /sbin/lvreduce,   /sbin/lvremove,    /sbin/lvrename,    /sbin/lvresize,
36       /sbin/pvchange,    /sbin/pvcreate,    /sbin/pvremove,   /sbin/vgchange,
37       /sbin/vgcreate,   /sbin/vgexport,    /sbin/vgextend,    /sbin/vgimport,
38       /sbin/vgreduce,    /sbin/vgremove,    /sbin/vgrename,   /usr/sbin/vgck,
39       /sbin/lvdisplay,  /sbin/lvmchange,  /sbin/pvdisplay,   /sbin/vgdisplay,
40       /sbin/vgmknodes,  /sbin/vgwrapper,  /sbin/cryptsetup, /sbin/lvm.static,
41       /sbin/multipathd, /usr/sbin/dmraid, /usr/sbin/kpartx, /usr/sbin/lvmsar,
42       /usr/sbin/lvscan, /usr/sbin/pvdata, /usr/sbin/pvmove, /usr/sbin/pvscan,
43       /usr/sbin/vgscan,  /sbin/lvmdiskscan,  /sbin/mount.crypt,  /sbin/vgcfg‐
44       backup,    /usr/sbin/dmsetup,   /usr/sbin/e2fsadm,   /usr/sbin/lvmetad,
45       /usr/sbin/lvmsadc,        /usr/sbin/vgmerge,         /usr/sbin/vgsplit,
46       /sbin/umount.crypt,       /sbin/vgcfgrestore,       /usr/sbin/dmeventd,
47       /usr/sbin/lvchange,       /usr/sbin/lvcreate,       /usr/sbin/lvextend,
48       /usr/sbin/lvmdbusd,       /usr/sbin/lvmlockd,       /usr/sbin/lvmpolld,
49       /usr/sbin/lvreduce,       /usr/sbin/lvremove,       /usr/sbin/lvrename,
50       /usr/sbin/lvresize,       /usr/sbin/pvchange,       /usr/sbin/pvcreate,
51       /usr/sbin/pvremove,       /usr/sbin/vgchange,       /usr/sbin/vgcreate,
52       /usr/sbin/vgexport,       /usr/sbin/vgextend,       /usr/sbin/vgimport,
53       /usr/sbin/vgreduce,       /usr/sbin/vgremove,       /usr/sbin/vgrename,
54       /sbin/lvmiopversion,      /sbin/vgscan.static,     /usr/sbin/lvdisplay,
55       /usr/sbin/lvmchange,     /usr/sbin/pvdisplay,      /usr/sbin/vgdisplay,
56       /usr/sbin/vgmknodes,     /usr/sbin/vgwrapper,     /sbin/dmsetup.static,
57       /usr/sbin/cryptsetup,    /usr/sbin/lvm.static,    /usr/sbin/lvmlockctl,
58       /usr/sbin/multipathd,   /sbin/vgchange.static,   /usr/sbin/lvmdiskscan,
59       /usr/sbin/mount.crypt,  /usr/sbin/vgcfgbackup,  /sbin/multipath.static,
60       /usr/sbin/vgcfgrestore,                        /usr/sbin/lvmiopversion,
61       /usr/sbin/vgscan.static,                      /usr/sbin/dmsetup.static,
62       /usr/sbin/vgchange.static, /usr/lib/storaged/storaged, /usr/sbin/multi‐
63       path.static,     /lib/udev/udisks-lvm-pv-export,     /usr/libexec/stor‐
64       aged/storaged,     /usr/lib/udev/udisks-lvm-pv-export,    /usr/lib/sys‐
65       temd/systemd-cryptsetup, /usr/lib/storaged/storaged-lvm-helper
66

PROCESS TYPES

68       SELinux defines process types (domains) for each process running on the
69       system
70
71       You can see the context of a process using the -Z option to ps
72
73       Policy  governs  the  access confined processes have to files.  SELinux
74       lvm policy is very flexible allowing users to setup their lvm processes
75       in as secure a method as possible.
76
77       The following process types are defined for lvm:
78
79       lvm_t
80
81       Note: semanage permissive -a lvm_t can be used to make the process type
82       lvm_t permissive. SELinux does not deny access  to  permissive  process
83       types, but the AVC (SELinux denials) messages are still generated.
84
85

BOOLEANS

87       SELinux  policy  is  customizable  based on least access required.  lvm
88       policy is extremely flexible and has several booleans that allow you to
89       manipulate the policy and run lvm with the tightest access possible.
90
91
92
93       If you want to deny user domains applications to map a memory region as
94       both executable and writable, this  is  dangerous  and  the  executable
95       should be reported in bugzilla, you must turn on the deny_execmem bool‐
96       ean. Disabled by default.
97
98       setsebool -P deny_execmem 1
99
100
101
102       If you want to control the ability to mmap a low area  of  the  address
103       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
104       the mmap_low_allowed boolean. Disabled by default.
105
106       setsebool -P mmap_low_allowed 1
107
108
109
110       If you want to allow system to run with  NIS,  you  must  turn  on  the
111       nis_enabled boolean. Disabled by default.
112
113       setsebool -P nis_enabled 1
114
115
116
117       If  you want to disable kernel module loading, you must turn on the se‐
118       cure_mode_insmod boolean. Disabled by default.
119
120       setsebool -P secure_mode_insmod 1
121
122
123
124       If you want to allow unconfined executables to make their  heap  memory
125       executable.   Doing  this  is  a  really bad idea. Probably indicates a
126       badly coded executable, but could indicate an attack.  This  executable
127       should  be  reported  in bugzilla, you must turn on the selinuxuser_ex‐
128       echeap boolean. Disabled by default.
129
130       setsebool -P selinuxuser_execheap 1
131
132
133
134       If you want to allow unconfined executables to make  their  stack  exe‐
135       cutable.   This  should  never, ever be necessary. Probably indicates a
136       badly coded executable, but could indicate an attack.  This  executable
137       should  be reported in bugzilla, you must turn on the selinuxuser_exec‐
138       stack boolean. Enabled by default.
139
140       setsebool -P selinuxuser_execstack 1
141
142
143

MANAGED FILES

145       The SELinux process type lvm_t can manage files labeled with  the  fol‐
146       lowing  file  types.   The paths listed are the default paths for these
147       file types.  Note the processes UID still need to have DAC permissions.
148
149       file_type
150
151            all files on the system
152
153

FILE CONTEXTS

155       SELinux requires files to have an extended attribute to define the file
156       type.
157
158       You can see the context of a file using the -Z option to ls
159
160       Policy  governs  the  access  confined  processes  have to these files.
161       SELinux lvm policy is very flexible allowing users to setup  their  lvm
162       processes in as secure a method as possible.
163
164       EQUIVALENCE DIRECTORIES
165
166
167       lvm policy stores data with multiple different file context types under
168       the /var/run/multipathd directory.  If you would like to store the data
169       in  a different directory you can use the semanage command to create an
170       equivalence mapping.  If you wanted to store this data under  the  /srv
171       directory you would execute the following command:
172
173       semanage fcontext -a -e /var/run/multipathd /srv/multipathd
174       restorecon -R -v /srv/multipathd
175
176       STANDARD FILE CONTEXT
177
178       SELinux  defines  the  file context types for the lvm, if you wanted to
179       store files with these types in a different paths, you need to  execute
180       the  semanage  command  to  specify alternate labeling and then use re‐
181       storecon to put the labels on disk.
182
183       semanage fcontext -a -t lvm_exec_t '/srv/lvm/content(/.*)?'
184       restorecon -R -v /srv/mylvm_content
185
186       Note: SELinux often uses regular expressions  to  specify  labels  that
187       match multiple files.
188
189       The following file types are defined for lvm:
190
191
192
193       lvm_etc_t
194
195       -  Set files with the lvm_etc_t type, if you want to store lvm files in
196       the /etc directories.
197
198
199
200       lvm_exec_t
201
202       - Set files with the lvm_exec_t type, if you want to transition an exe‐
203       cutable to the lvm_t domain.
204
205
206       Paths:
207            /lib/lvm-10/.*,        /lib/lvm-200/.*,        /usr/lib/lvm-10/.*,
208            /usr/lib/lvm-200/.*,    /usr/lib/systemd/system-generators/lvm2.*,
209            /sbin/lvm,  /sbin/lvs, /sbin/pvs, /sbin/vgs, /sbin/vgck, /sbin/dm‐
210            raid,  /sbin/kpartx,  /sbin/lvmsar,  /sbin/lvscan,   /sbin/pvdata,
211            /sbin/pvmove,     /sbin/pvscan,    /sbin/vgscan,    /sbin/dmsetup,
212            /sbin/e2fsadm,   /sbin/lvmetad,   /sbin/lvmsadc,    /sbin/vgmerge,
213            /sbin/vgsplit,    /usr/sbin/lvm,   /usr/sbin/lvs,   /usr/sbin/pvs,
214            /usr/sbin/vgs,  /sbin/lvchange,  /sbin/lvcreate,   /sbin/lvextend,
215            /sbin/lvmpolld,  /sbin/lvreduce,  /sbin/lvremove,  /sbin/lvrename,
216            /sbin/lvresize,  /sbin/pvchange,  /sbin/pvcreate,  /sbin/pvremove,
217            /sbin/vgchange,  /sbin/vgcreate,  /sbin/vgexport,  /sbin/vgextend,
218            /sbin/vgimport,  /sbin/vgreduce,  /sbin/vgremove,  /sbin/vgrename,
219            /usr/sbin/vgck, /sbin/lvdisplay, /sbin/lvmchange, /sbin/pvdisplay,
220            /sbin/vgdisplay,  /sbin/vgmknodes,  /sbin/vgwrapper,  /sbin/crypt‐
221            setup,   /sbin/lvm.static,   /sbin/multipathd,   /usr/sbin/dmraid,
222            /usr/sbin/kpartx,       /usr/sbin/lvmsar,        /usr/sbin/lvscan,
223            /usr/sbin/pvdata,        /usr/sbin/pvmove,       /usr/sbin/pvscan,
224            /usr/sbin/vgscan,      /sbin/lvmdiskscan,       /sbin/mount.crypt,
225            /sbin/vgcfgbackup,      /usr/sbin/dmsetup,      /usr/sbin/e2fsadm,
226            /usr/sbin/lvmetad,      /usr/sbin/lvmsadc,      /usr/sbin/vgmerge,
227            /usr/sbin/vgsplit,     /sbin/umount.crypt,     /sbin/vgcfgrestore,
228            /usr/sbin/dmeventd,    /usr/sbin/lvchange,     /usr/sbin/lvcreate,
229            /usr/sbin/lvextend,     /usr/sbin/lvmdbusd,    /usr/sbin/lvmlockd,
230            /usr/sbin/lvmpolld,    /usr/sbin/lvreduce,     /usr/sbin/lvremove,
231            /usr/sbin/lvrename,     /usr/sbin/lvresize,    /usr/sbin/pvchange,
232            /usr/sbin/pvcreate,    /usr/sbin/pvremove,     /usr/sbin/vgchange,
233            /usr/sbin/vgcreate,     /usr/sbin/vgexport,    /usr/sbin/vgextend,
234            /usr/sbin/vgimport,    /usr/sbin/vgreduce,     /usr/sbin/vgremove,
235            /usr/sbin/vgrename,    /sbin/lvmiopversion,   /sbin/vgscan.static,
236            /usr/sbin/lvdisplay,   /usr/sbin/lvmchange,   /usr/sbin/pvdisplay,
237            /usr/sbin/vgdisplay,   /usr/sbin/vgmknodes,   /usr/sbin/vgwrapper,
238            /sbin/dmsetup.static, /usr/sbin/cryptsetup,  /usr/sbin/lvm.static,
239            /usr/sbin/lvmlockctl, /usr/sbin/multipathd, /sbin/vgchange.static,
240            /usr/sbin/lvmdiskscan,   /usr/sbin/mount.crypt,   /usr/sbin/vgcfg‐
241            backup,       /sbin/multipath.static,      /usr/sbin/vgcfgrestore,
242            /usr/sbin/lvmiopversion,  /usr/sbin/vgscan.static,   /usr/sbin/dm‐
243            setup.static,  /usr/sbin/vgchange.static,  /usr/lib/storaged/stor‐
244            aged, /usr/sbin/multipath.static,  /lib/udev/udisks-lvm-pv-export,
245            /usr/libexec/storaged/storaged,    /usr/lib/udev/udisks-lvm-pv-ex‐
246            port, /usr/lib/systemd/systemd-cryptsetup, /usr/lib/storaged/stor‐
247            aged-lvm-helper
248
249
250       lvm_lock_t
251
252       - Set files with the lvm_lock_t type, if you want to treat the files as
253       lvm lock data, stored under the /var/lock directory
254
255
256       Paths:
257            /etc/lvm/lock(/.*)?, /var/lock/lvm(/.*)?, /var/lock/dmraid(/.*)?
258
259
260       lvm_metadata_t
261
262       - Set files with the lvm_metadata_t type, if  you  want  to  treat  the
263       files as lvm metadata data.
264
265
266       Paths:
267            /etc/lvmtab(/.*)?,    /etc/lvmtab.d(/.*)?,   /etc/lvm/cache(/.*)?,
268            /etc/multipath(/.*)?,     /etc/lvm/backup(/.*)?,      /etc/lvm/ar‐
269            chive(/.*)?, /var/cache/multipathd(/.*)?, /etc/lvm/.cache
270
271
272       lvm_tmp_t
273
274       - Set files with the lvm_tmp_t type, if you want to store lvm temporary
275       files in the /tmp directories.
276
277
278
279       lvm_unit_file_t
280
281       - Set files with the lvm_unit_file_t type, if you  want  to  treat  the
282       files as lvm unit content.
283
284
285       Paths:
286            /usr/lib/systemd/system/lvm2.*.service,   /usr/lib/systemd/genera‐
287            tor/lvm.*
288
289
290       lvm_var_lib_t
291
292       - Set files with the lvm_var_lib_t type, if you want to store  the  lvm
293       files under the /var/lib directory.
294
295
296
297       lvm_var_run_t
298
299       -  Set  files with the lvm_var_run_t type, if you want to store the lvm
300       files under the /run or /var/run directory.
301
302
303       Paths:
304            /var/run/lvm(/.*)?,  /var/run/dmevent.*,  /var/run/storaged(/.*)?,
305            /var/run/cryptsetup(/.*)?,              /var/run/multipathd(/.*)?,
306            /var/run/multipathd.sock
307
308
309       Note: File context can be temporarily modified with the chcon  command.
310       If  you want to permanently change the file context you need to use the
311       semanage fcontext command.  This will modify the SELinux labeling data‐
312       base.  You will need to use restorecon to apply the labels.
313
314

COMMANDS

316       semanage  fcontext  can also be used to manipulate default file context
317       mappings.
318
319       semanage permissive can also be used to manipulate  whether  or  not  a
320       process type is permissive.
321
322       semanage  module can also be used to enable/disable/install/remove pol‐
323       icy modules.
324
325       semanage boolean can also be used to manipulate the booleans
326
327
328       system-config-selinux is a GUI tool available to customize SELinux pol‐
329       icy settings.
330
331

AUTHOR

333       This manual page was auto-generated using sepolicy manpage .
334
335