1zebra_selinux(8) SELinux Policy zebra zebra_selinux(8)
2
6 zebra_selinux - Security Enhanced Linux Policy for the zebra processes
7
9 Security-Enhanced Linux secures the zebra processes via flexible manda‐
10 tory access control.
11 The zebra processes execute with the zebra_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15 For example:
17 ps -eZ | grep zebra_t
19
23 The zebra_t SELinux type can be entered via the zebra_exec_t file type.
24 The default entrypoint paths for the zebra_t domain are the following:
26 /usr/sbin/ospf.*, /usr/sbin/bgpd, /usr/sbin/pimd, /usr/sbin/ripd,
28 /usr/sbin/isisd, /usr/sbin/nhrpd, /usr/sbin/zebra, /usr/sbin/babeld,
29 /usr/sbin/ripngd
30
32 SELinux defines process types (domains) for each process running on the
33 system
34 You can see the context of a process using the -Z option to ps
36 Policy governs the access confined processes have to files. SELinux
38 zebra policy is very flexible allowing users to setup their zebra pro‐
39 cesses in as secure a method as possible.
40 The following process types are defined for zebra:
42 zebra_t
44 Note: semanage permissive -a zebra_t can be used to make the process
46 type zebra_t permissive. SELinux does not deny access to permissive
47 process types, but the AVC (SELinux denials) messages are still gener‐
48 ated.
49
52 SELinux policy is customizable based on least access required. zebra
53 policy is extremely flexible and has several booleans that allow you to
54 manipulate the policy and run zebra with the tightest access possible.
55 If you want to allow zebra daemon to write it configuration files, you
59 must turn on the zebra_write_config boolean. Disabled by default.
60 setsebool -P zebra_write_config 1
62 If you want to dontaudit all daemons scheduling requests (setsched,
66 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
67 Enabled by default.
68 setsebool -P daemons_dontaudit_scheduling 1
70 If you want to allow all domains to execute in fips_mode, you must turn
74 on the fips_mode boolean. Enabled by default.
75 setsebool -P fips_mode 1
77 If you want to allow system to run with NIS, you must turn on the
81 nis_enabled boolean. Disabled by default.
82 setsebool -P nis_enabled 1
84
88 SELinux defines port types to represent TCP and UDP ports.
89 You can see the types associated with a port by using the following
91 command:
92 semanage port -l
94 Policy governs the access confined processes have to these ports.
97 SELinux zebra policy is very flexible allowing users to setup their ze‐
98 bra processes in as secure a method as possible.
99 The following port types are defined for zebra:
101 zebra_port_t
104 Default Defined Ports:
108 tcp 2606,2608-2609,2600-2604
109 udp 2606,2608-2609,2600-2604
110
112 The SELinux process type zebra_t can manage files labeled with the fol‐
113 lowing file types. The paths listed are the default paths for these
114 file types. Note the processes UID still need to have DAC permissions.
115 cluster_conf_t
117 /etc/cluster(/.*)?
119 cluster_var_lib_t
121 /var/lib/pcsd(/.*)?
123 /var/lib/cluster(/.*)?
124 /var/lib/openais(/.*)?
125 /var/lib/pengine(/.*)?
126 /var/lib/corosync(/.*)?
127 /usr/lib/heartbeat(/.*)?
128 /var/lib/heartbeat(/.*)?
129 /var/lib/pacemaker(/.*)?
130 cluster_var_run_t
132 /var/run/crm(/.*)?
134 /var/run/cman_.*
135 /var/run/rsctmp(/.*)?
136 /var/run/aisexec.*
137 /var/run/heartbeat(/.*)?
138 /var/run/pcsd-ruby.socket
139 /var/run/corosync-qnetd(/.*)?
140 /var/run/corosync-qdevice(/.*)?
141 /var/run/corosync.pid
142 /var/run/cpglockd.pid
143 /var/run/rgmanager.pid
144 /var/run/cluster/rgmanager.sk
145 krb5_host_rcache_t
147 /var/tmp/krb5_0.rcache2
149 /var/cache/krb5rcache(/.*)?
150 /var/tmp/nfs_0
151 /var/tmp/DNS_25
152 /var/tmp/host_0
153 /var/tmp/imap_0
154 /var/tmp/HTTP_23
155 /var/tmp/HTTP_48
156 /var/tmp/ldap_55
157 /var/tmp/ldap_487
158 /var/tmp/ldapmap1_0
159 root_t
161 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
163 /
164 /initrd
165 zebra_log_t
167 /var/log/zebra(/.*)?
169 /var/log/quagga(/.*)?
170 zebra_tmp_t
172 zebra_var_run_t
175 /var/run/bgpd(/.*)?
177 /var/run/quagga(/.*)?
178 /var/run/.zebra
179 /var/run/.zserv
180
183 SELinux requires files to have an extended attribute to define the file
184 type.
185 You can see the context of a file using the -Z option to ls
187 Policy governs the access confined processes have to these files.
189 SELinux zebra policy is very flexible allowing users to setup their ze‐
190 bra processes in as secure a method as possible.
191 STANDARD FILE CONTEXT
193 SELinux defines the file context types for the zebra, if you wanted to
195 store files with these types in a different paths, you need to execute
196 the semanage command to specify alternate labeling and then use re‐
197 storecon to put the labels on disk.
198 semanage fcontext -a -t zebra_exec_t '/srv/zebra/content(/.*)?'
200 restorecon -R -v /srv/myzebra_content
201 Note: SELinux often uses regular expressions to specify labels that
203 match multiple files.
204 The following file types are defined for zebra:
206 zebra_conf_t
210 - Set files with the zebra_conf_t type, if you want to treat the files
212 as zebra configuration data, usually stored under the /etc directory.
213 Paths:
216 /etc/zebra(/.*)?, /etc/quagga(/.*)?
217 zebra_exec_t
220 - Set files with the zebra_exec_t type, if you want to transition an
222 executable to the zebra_t domain.
223 Paths:
226 /usr/sbin/ospf.*, /usr/sbin/bgpd, /usr/sbin/pimd, /usr/sbin/ripd,
227 /usr/sbin/isisd, /usr/sbin/nhrpd, /usr/sbin/zebra, /usr/sbin/ba‐
228 beld, /usr/sbin/ripngd
229 zebra_initrc_exec_t
232 - Set files with the zebra_initrc_exec_t type, if you want to transi‐
234 tion an executable to the zebra_initrc_t domain.
235 Paths:
238 /etc/rc.d/init.d/bgpd, /etc/rc.d/init.d/ripd,
239 /etc/rc.d/init.d/isisd, /etc/rc.d/init.d/ospfd,
240 /etc/rc.d/init.d/zebra, /etc/rc.d/init.d/babeld,
241 /etc/rc.d/init.d/ospf6d, /etc/rc.d/init.d/ripngd
242 zebra_log_t
245 - Set files with the zebra_log_t type, if you want to treat the data as
247 zebra log data, usually stored under the /var/log directory.
248 Paths:
251 /var/log/zebra(/.*)?, /var/log/quagga(/.*)?
252 zebra_tmp_t
255 - Set files with the zebra_tmp_t type, if you want to store zebra tem‐
257 porary files in the /tmp directories.
258 zebra_unit_file_t
262 - Set files with the zebra_unit_file_t type, if you want to treat the
264 files as zebra unit content.
265 Paths:
268 /usr/lib/systemd/system/bgpd.*, /usr/lib/systemd/system/ripd.*,
269 /usr/lib/systemd/system/isisd.*, /usr/lib/systemd/system/ospfd.*,
270 /usr/lib/systemd/system/zebra.*, /usr/lib/systemd/system/babeld.*,
271 /usr/lib/systemd/system/ospf6d.*, /usr/lib/systemd/system/ripngd.*
272 zebra_var_run_t
275 - Set files with the zebra_var_run_t type, if you want to store the ze‐
277 bra files under the /run or /var/run directory.
278 Paths:
281 /var/run/bgpd(/.*)?, /var/run/quagga(/.*)?, /var/run/.zebra,
282 /var/run/.zserv
283 Note: File context can be temporarily modified with the chcon command.
286 If you want to permanently change the file context you need to use the
287 semanage fcontext command. This will modify the SELinux labeling data‐
288 base. You will need to use restorecon to apply the labels.
289
292 semanage fcontext can also be used to manipulate default file context
293 mappings.
294 semanage permissive can also be used to manipulate whether or not a
296 process type is permissive.
297 semanage module can also be used to enable/disable/install/remove pol‐
299 icy modules.
300 semanage port can also be used to manipulate the port definitions
302 semanage boolean can also be used to manipulate the booleans
304 system-config-selinux is a GUI tool available to customize SELinux pol‐
307 icy settings.
308
311 This manual page was auto-generated using sepolicy manpage .
312
315 selinux(8), zebra(8), semanage(8), restorecon(8), chcon(1), sepol‐
316 icy(8), setsebool(8)
317zebra 23-10-20 zebra_selinux(8)