1rhev_agentd_selinux(8) SELinux Policy rhev_agentd rhev_agentd_selinux(8)
2
6 rhev_agentd_selinux - Security Enhanced Linux Policy for the
7 rhev_agentd processes
8
10 Security-Enhanced Linux secures the rhev_agentd processes via flexible
11 mandatory access control.
12 The rhev_agentd processes execute with the rhev_agentd_t SELinux type.
14 You can check if you have these processes running by executing the ps
15 command with the -Z qualifier.
16 For example:
18 ps -eZ | grep rhev_agentd_t
20
24 The rhev_agentd_t SELinux type can be entered via the
25 rhev_agentd_exec_t file type.
26 The default entrypoint paths for the rhev_agentd_t domain are the fol‐
28 lowing:
29 /usr/share/ovirt-guest-agent, /usr/share/rhev-agent/rhev-agentd.py,
31 /usr/share/rhev-agent/LockActiveSession.py, /usr/share/ovirt-guest-
32 agent/LockActiveSession.py, /usr/share/ovirt-guest-agent/ovirt-guest-
33 agent.py
34
36 SELinux defines process types (domains) for each process running on the
37 system
38 You can see the context of a process using the -Z option to ps
40 Policy governs the access confined processes have to files. SELinux
42 rhev_agentd policy is very flexible allowing users to setup their
43 rhev_agentd processes in as secure a method as possible.
44 The following process types are defined for rhev_agentd:
46 rhev_agentd_t, rhev_agentd_consolehelper_t
48 Note: semanage permissive -a rhev_agentd_t can be used to make the
50 process type rhev_agentd_t permissive. SELinux does not deny access to
51 permissive process types, but the AVC (SELinux denials) messages are
52 still generated.
53
56 SELinux policy is customizable based on least access required.
57 rhev_agentd policy is extremely flexible and has several booleans that
58 allow you to manipulate the policy and run rhev_agentd with the tight‐
59 est access possible.
60 If you want to dontaudit all daemons scheduling requests (setsched,
64 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
65 Enabled by default.
66 setsebool -P daemons_dontaudit_scheduling 1
68 If you want to allow all domains to execute in fips_mode, you must turn
72 on the fips_mode boolean. Enabled by default.
73 setsebool -P fips_mode 1
75 If you want to allow system to run with NIS, you must turn on the
79 nis_enabled boolean. Disabled by default.
80 setsebool -P nis_enabled 1
82
86 The SELinux process type rhev_agentd_t can manage files labeled with
87 the following file types. The paths listed are the default paths for
88 these file types. Note the processes UID still need to have DAC per‐
89 missions.
90 cluster_conf_t
92 /etc/cluster(/.*)?
94 cluster_var_lib_t
96 /var/lib/pcsd(/.*)?
98 /var/lib/cluster(/.*)?
99 /var/lib/openais(/.*)?
100 /var/lib/pengine(/.*)?
101 /var/lib/corosync(/.*)?
102 /usr/lib/heartbeat(/.*)?
103 /var/lib/heartbeat(/.*)?
104 /var/lib/pacemaker(/.*)?
105 cluster_var_run_t
107 /var/run/crm(/.*)?
109 /var/run/cman_.*
110 /var/run/rsctmp(/.*)?
111 /var/run/aisexec.*
112 /var/run/heartbeat(/.*)?
113 /var/run/pcsd-ruby.socket
114 /var/run/corosync-qnetd(/.*)?
115 /var/run/corosync-qdevice(/.*)?
116 /var/run/corosync.pid
117 /var/run/cpglockd.pid
118 /var/run/rgmanager.pid
119 /var/run/cluster/rgmanager.sk
120 krb5_host_rcache_t
122 /var/tmp/krb5_0.rcache2
124 /var/cache/krb5rcache(/.*)?
125 /var/tmp/nfs_0
126 /var/tmp/DNS_25
127 /var/tmp/host_0
128 /var/tmp/imap_0
129 /var/tmp/HTTP_23
130 /var/tmp/HTTP_48
131 /var/tmp/ldap_55
132 /var/tmp/ldap_487
133 /var/tmp/ldapmap1_0
134 rhev_agentd_log_t
136 /var/log/rhev-agent(/.*)?
138 /var/log/ovirt-guest-agent(/.*)?
139 rhev_agentd_tmp_t
141 rhev_agentd_var_run_t
144 /var/run/rhev-agentd.pid
146 /var/run/ovirt-guest-agent.pid
147 root_t
149 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
151 /
152 /initrd
153
156 SELinux requires files to have an extended attribute to define the file
157 type.
158 You can see the context of a file using the -Z option to ls
160 Policy governs the access confined processes have to these files.
162 SELinux rhev_agentd policy is very flexible allowing users to setup
163 their rhev_agentd processes in as secure a method as possible.
164 STANDARD FILE CONTEXT
166 SELinux defines the file context types for the rhev_agentd, if you
168 wanted to store files with these types in a different paths, you need
169 to execute the semanage command to specify alternate labeling and then
170 use restorecon to put the labels on disk.
171 semanage fcontext -a -t rhev_agentd_exec_t '/srv/rhev_agentd/con‐
173 tent(/.*)?'
174 restorecon -R -v /srv/myrhev_agentd_content
175 Note: SELinux often uses regular expressions to specify labels that
177 match multiple files.
178 The following file types are defined for rhev_agentd:
180 rhev_agentd_exec_t
184 - Set files with the rhev_agentd_exec_t type, if you want to transition
186 an executable to the rhev_agentd_t domain.
187 Paths:
190 /usr/share/ovirt-guest-agent, /usr/share/rhev-agent/rhev-
191 agentd.py, /usr/share/rhev-agent/LockActiveSession.py,
192 /usr/share/ovirt-guest-agent/LockActiveSession.py,
193 /usr/share/ovirt-guest-agent/ovirt-guest-agent.py
194 rhev_agentd_log_t
197 - Set files with the rhev_agentd_log_t type, if you want to treat the
199 data as rhev agentd log data, usually stored under the /var/log direc‐
200 tory.
201 Paths:
204 /var/log/rhev-agent(/.*)?, /var/log/ovirt-guest-agent(/.*)?
205 rhev_agentd_tmp_t
208 - Set files with the rhev_agentd_tmp_t type, if you want to store rhev
210 agentd temporary files in the /tmp directories.
211 rhev_agentd_unit_file_t
215 - Set files with the rhev_agentd_unit_file_t type, if you want to treat
217 the files as rhev agentd unit content.
218 rhev_agentd_var_run_t
222 - Set files with the rhev_agentd_var_run_t type, if you want to store
224 the rhev agentd files under the /run or /var/run directory.
225 Paths:
228 /var/run/rhev-agentd.pid, /var/run/ovirt-guest-agent.pid
229 Note: File context can be temporarily modified with the chcon command.
232 If you want to permanently change the file context you need to use the
233 semanage fcontext command. This will modify the SELinux labeling data‐
234 base. You will need to use restorecon to apply the labels.
235
238 semanage fcontext can also be used to manipulate default file context
239 mappings.
240 semanage permissive can also be used to manipulate whether or not a
242 process type is permissive.
243 semanage module can also be used to enable/disable/install/remove pol‐
245 icy modules.
246 semanage boolean can also be used to manipulate the booleans
248 system-config-selinux is a GUI tool available to customize SELinux pol‐
251 icy settings.
252
255 This manual page was auto-generated using sepolicy manpage .
256
259 selinux(8), rhev_agentd(8), semanage(8), restorecon(8), chcon(1), se‐
260 policy(8), setsebool(8), rhev_agentd_consolehelper_selinux(8)
261rhev_agentd 23-10-20 rhev_agentd_selinux(8)