ricci_selinux(8)

1ricci_selinux(8)             SELinux Policy ricci             ricci_selinux(8)
2
3
4

NAME

6       ricci_selinux - Security Enhanced Linux Policy for the ricci processes
7

DESCRIPTION

9       Security-Enhanced Linux secures the ricci processes via flexible manda‐
10       tory access control.
11
12       The ricci processes execute with the  ricci_t  SELinux  type.  You  can
13       check  if  you have these processes running by executing the ps command
14       with the -Z qualifier.
15
16       For example:
17
18       ps -eZ | grep ricci_t
19
20
21

ENTRYPOINTS

23       The ricci_t SELinux type can be entered via  the  ricci_exec_t,  usr_t,
24       bin_t file types.
25
26       The default entrypoint paths for the ricci_t domain are the following:
27
28       All  executables  with  the default executable label, usually stored in
29       /usr/bin and /usr/sbin.  /usr/sbin/ricci, /opt/.*,  /usr/.*,  /emul/.*,
30       /export(/.*)?,    /ostree(/.*)?,   /usr/doc(/.*)?/lib(/.*)?,   /usr/in‐
31       clu.e(/.*)?,    /usr/share/rpm(/.*)?,    /usr/share/doc(/.*)?/README.*,
32       /usr/lib/modules(/.*)/vmlinuz,     /usr/lib/modules(/.*)/initramfs.img,
33       /usr/lib/sysimage(/.*)?, /usr/lib/ostree-boot(/.*)?, /opt, /usr, /emul
34

PROCESS TYPES

36       SELinux defines process types (domains) for each process running on the
37       system
38
39       You can see the context of a process using the -Z option to ps
40
41       Policy  governs  the  access confined processes have to files.  SELinux
42       ricci policy is very flexible allowing users to setup their ricci  pro‐
43       cesses in as secure a method as possible.
44
45       The following process types are defined for ricci:
46
47       ricci_t, ricci_modcluster_t, ricci_modclusterd_t, ricci_modlog_t, ricci_modrpm_t, ricci_modservice_t, ricci_modstorage_t
48
49       Note:  semanage  permissive  -a ricci_t can be used to make the process
50       type ricci_t permissive. SELinux does not  deny  access  to  permissive
51       process  types, but the AVC (SELinux denials) messages are still gener‐
52       ated.
53
54

BOOLEANS

56       SELinux policy is customizable based on least access  required.   ricci
57       policy is extremely flexible and has several booleans that allow you to
58       manipulate the policy and run ricci with the tightest access possible.
59
60
61
62       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
63       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
64       Enabled by default.
65
66       setsebool -P daemons_dontaudit_scheduling 1
67
68
69
70       If you want to allow all domains to execute in fips_mode, you must turn
71       on the fips_mode boolean. Enabled by default.
72
73       setsebool -P fips_mode 1
74
75
76
77       If  you  want  to  allow  system  to run with NIS, you must turn on the
78       nis_enabled boolean. Disabled by default.
79
80       setsebool -P nis_enabled 1
81
82
83

PORT TYPES

85       SELinux defines port types to represent TCP and UDP ports.
86
87       You can see the types associated with a port  by  using  the  following
88       command:
89
90       semanage port -l
91
92
93       Policy  governs  the  access  confined  processes  have to these ports.
94       SELinux ricci policy is very flexible allowing  users  to  setup  their
95       ricci processes in as secure a method as possible.
96
97       The following port types are defined for ricci:
98
99
100       ricci_modcluster_port_t
101
102
103
104       Default Defined Ports:
105                 tcp 16851
106                 udp 16851
107
108
109       ricci_port_t
110
111
112
113       Default Defined Ports:
114                 tcp 11111
115                 udp 11111
116

MANAGED FILES

118       The SELinux process type ricci_t can manage files labeled with the fol‐
119       lowing file types.  The paths listed are the default  paths  for  these
120       file types.  Note the processes UID still need to have DAC permissions.
121
122       cluster_conf_t
123
124            /etc/cluster(/.*)?
125
126       cluster_var_lib_t
127
128            /var/lib/pcsd(/.*)?
129            /var/lib/cluster(/.*)?
130            /var/lib/openais(/.*)?
131            /var/lib/pengine(/.*)?
132            /var/lib/corosync(/.*)?
133            /usr/lib/heartbeat(/.*)?
134            /var/lib/heartbeat(/.*)?
135            /var/lib/pacemaker(/.*)?
136
137       cluster_var_run_t
138
139            /var/run/crm(/.*)?
140            /var/run/cman_.*
141            /var/run/rsctmp(/.*)?
142            /var/run/aisexec.*
143            /var/run/heartbeat(/.*)?
144            /var/run/pcsd-ruby.socket
145            /var/run/corosync-qnetd(/.*)?
146            /var/run/corosync-qdevice(/.*)?
147            /var/run/corosync.pid
148            /var/run/cpglockd.pid
149            /var/run/rgmanager.pid
150            /var/run/cluster/rgmanager.sk
151
152       faillog_t
153
154            /var/log/btmp.*
155            /var/log/faillog.*
156            /var/log/tallylog.*
157            /var/run/faillock(/.*)?
158
159       krb5_host_rcache_t
160
161            /var/tmp/krb5_0.rcache2
162            /var/cache/krb5rcache(/.*)?
163            /var/tmp/nfs_0
164            /var/tmp/DNS_25
165            /var/tmp/host_0
166            /var/tmp/imap_0
167            /var/tmp/HTTP_23
168            /var/tmp/HTTP_48
169            /var/tmp/ldap_55
170            /var/tmp/ldap_487
171            /var/tmp/ldapmap1_0
172
173       ricci_tmp_t
174
175
176       ricci_var_lib_t
177
178            /var/lib/ricci(/.*)?
179
180       ricci_var_run_t
181
182            /var/run/ricci.pid
183
184       root_t
185
186            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
187            /
188            /initrd
189
190       systemd_passwd_var_run_t
191
192            /var/run/systemd/ask-password(/.*)?
193            /var/run/systemd/ask-password-block(/.*)?
194
195

FILE CONTEXTS

197       SELinux requires files to have an extended attribute to define the file
198       type.
199
200       You can see the context of a file using the -Z option to ls
201
202       Policy governs the access  confined  processes  have  to  these  files.
203       SELinux  ricci  policy  is  very flexible allowing users to setup their
204       ricci processes in as secure a method as possible.
205
206       STANDARD FILE CONTEXT
207
208       SELinux defines the file context types for the ricci, if you wanted  to
209       store  files with these types in a different paths, you need to execute
210       the semanage command to specify alternate labeling  and  then  use  re‐
211       storecon to put the labels on disk.
212
213       semanage fcontext -a -t ricci_exec_t '/srv/ricci/content(/.*)?'
214       restorecon -R -v /srv/myricci_content
215
216       Note:  SELinux  often  uses  regular expressions to specify labels that
217       match multiple files.
218
219       The following file types are defined for ricci:
220
221
222
223       ricci_exec_t
224
225       - Set files with the ricci_exec_t type, if you want  to  transition  an
226       executable to the ricci_t domain.
227
228
229
230       ricci_initrc_exec_t
231
232       -  Set  files with the ricci_initrc_exec_t type, if you want to transi‐
233       tion an executable to the ricci_initrc_t domain.
234
235
236
237       ricci_modcluster_exec_t
238
239       - Set files with the ricci_modcluster_exec_t type, if you want to tran‐
240       sition an executable to the ricci_modcluster_t domain.
241
242
243
244       ricci_modcluster_var_lib_t
245
246       -  Set  files  with the ricci_modcluster_var_lib_t type, if you want to
247       store the ricci modcluster files under the /var/lib directory.
248
249
250
251       ricci_modcluster_var_log_t
252
253       - Set files with the ricci_modcluster_var_log_t type, if  you  want  to
254       treat  the  data as ricci modcluster var log data, usually stored under
255       the /var/log directory.
256
257
258
259       ricci_modcluster_var_run_t
260
261       - Set files with the ricci_modcluster_var_run_t type, if  you  want  to
262       store the ricci modcluster files under the /run or /var/run directory.
263
264
265       Paths:
266            /var/run/clumond.sock, /var/run/modclusterd.pid
267
268
269       ricci_modclusterd_exec_t
270
271       -  Set  files  with  the  ricci_modclusterd_exec_t type, if you want to
272       transition an executable to the ricci_modclusterd_t domain.
273
274
275
276       ricci_modclusterd_tmpfs_t
277
278       - Set files with the ricci_modclusterd_tmpfs_t type,  if  you  want  to
279       store ricci modclusterd files on a tmpfs file system.
280
281
282
283       ricci_modlog_exec_t
284
285       -  Set  files with the ricci_modlog_exec_t type, if you want to transi‐
286       tion an executable to the ricci_modlog_t domain.
287
288
289
290       ricci_modrpm_exec_t
291
292       - Set files with the ricci_modrpm_exec_t type, if you want  to  transi‐
293       tion an executable to the ricci_modrpm_t domain.
294
295
296
297       ricci_modservice_exec_t
298
299       - Set files with the ricci_modservice_exec_t type, if you want to tran‐
300       sition an executable to the ricci_modservice_t domain.
301
302
303
304       ricci_modstorage_exec_t
305
306       - Set files with the ricci_modstorage_exec_t type, if you want to tran‐
307       sition an executable to the ricci_modstorage_t domain.
308
309
310
311       ricci_modstorage_lock_t
312
313       - Set files with the ricci_modstorage_lock_t type, if you want to treat
314       the files as ricci modstorage lock data, stored under the /var/lock di‐
315       rectory
316
317
318
319       ricci_tmp_t
320
321       -  Set files with the ricci_tmp_t type, if you want to store ricci tem‐
322       porary files in the /tmp directories.
323
324
325
326       ricci_var_lib_t
327
328       - Set files with the ricci_var_lib_t type, if you  want  to  store  the
329       ricci files under the /var/lib directory.
330
331
332
333       ricci_var_log_t
334
335       -  Set  files  with  the ricci_var_log_t type, if you want to treat the
336       data as ricci var log data, usually stored under  the  /var/log  direc‐
337       tory.
338
339
340
341       ricci_var_run_t
342
343       -  Set  files  with  the ricci_var_run_t type, if you want to store the
344       ricci files under the /run or /var/run directory.
345
346
347
348       Note: File context can be temporarily modified with the chcon  command.
349       If  you want to permanently change the file context you need to use the
350       semanage fcontext command.  This will modify the SELinux labeling data‐
351       base.  You will need to use restorecon to apply the labels.
352
353

COMMANDS

355       semanage  fcontext  can also be used to manipulate default file context
356       mappings.
357
358       semanage permissive can also be used to manipulate  whether  or  not  a
359       process type is permissive.
360
361       semanage  module can also be used to enable/disable/install/remove pol‐
362       icy modules.
363
364       semanage port can also be used to manipulate the port definitions
365
366       semanage boolean can also be used to manipulate the booleans
367
368
369       system-config-selinux is a GUI tool available to customize SELinux pol‐
370       icy settings.
371
372

AUTHOR

374       This manual page was auto-generated using sepolicy manpage .
375
376