1kdump_selinux(8) SELinux Policy kdump kdump_selinux(8)
2
6 kdump_selinux - Security Enhanced Linux Policy for the kdump processes
7
9 Security-Enhanced Linux secures the kdump processes via flexible manda‐
10 tory access control.
11 The kdump processes execute with the kdump_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15 For example:
17 ps -eZ | grep kdump_t
19
23 The kdump_t SELinux type can be entered via the kdump_exec_t file type.
24 The default entrypoint paths for the kdump_t domain are the following:
26 /sbin/kdump, /sbin/kexec, /usr/sbin/kdump, /usr/sbin/kexec
28
30 SELinux defines process types (domains) for each process running on the
31 system
32 You can see the context of a process using the -Z option to ps
34 Policy governs the access confined processes have to files. SELinux
36 kdump policy is very flexible allowing users to setup their kdump pro‐
37 cesses in as secure a method as possible.
38 The following process types are defined for kdump:
40 kdump_t, kdumpctl_t, kdumpgui_t
42 Note: semanage permissive -a kdump_t can be used to make the process
44 type kdump_t permissive. SELinux does not deny access to permissive
45 process types, but the AVC (SELinux denials) messages are still gener‐
46 ated.
47
50 SELinux policy is customizable based on least access required. kdump
51 policy is extremely flexible and has several booleans that allow you to
52 manipulate the policy and run kdump with the tightest access possible.
53 If you want to allow all domains to execute in fips_mode, you must turn
57 on the fips_mode boolean. Enabled by default.
58 setsebool -P fips_mode 1
60
64 The SELinux process type kdump_t can manage files labeled with the fol‐
65 lowing file types. The paths listed are the default paths for these
66 file types. Note the processes UID still need to have DAC permissions.
67 kdump_crash_t
69 /var/crash(/.*)?
71 kdump_lock_t
73 /var/lock/kdump(/.*)?
75 kdump_tmpfs_t
77 kdump_var_lib_t
80 /var/lib/kdump(/.*)?
82 tmp_t
84 /sandbox(/.*)?
86 /tmp
87 /usr/tmp
88 /var/tmp
89 /var/tmp
90 /tmp-inst
91 /var/tmp-inst
92 /var/tmp/tmp-inst
93 /var/tmp/vi.recover
94
97 SELinux requires files to have an extended attribute to define the file
98 type.
99 You can see the context of a file using the -Z option to ls
101 Policy governs the access confined processes have to these files.
103 SELinux kdump policy is very flexible allowing users to setup their
104 kdump processes in as secure a method as possible.
105 STANDARD FILE CONTEXT
107 SELinux defines the file context types for the kdump, if you wanted to
109 store files with these types in a different paths, you need to execute
110 the semanage command to specify alternate labeling and then use re‐
111 storecon to put the labels on disk.
112 semanage fcontext -a -t kdump_exec_t '/srv/kdump/content(/.*)?'
114 restorecon -R -v /srv/mykdump_content
115 Note: SELinux often uses regular expressions to specify labels that
117 match multiple files.
118 The following file types are defined for kdump:
120 kdump_crash_t
124 - Set files with the kdump_crash_t type, if you want to treat the files
126 as kdump crash data.
127 kdump_etc_t
131 - Set files with the kdump_etc_t type, if you want to store kdump files
133 in the /etc directories.
134 kdump_exec_t
138 - Set files with the kdump_exec_t type, if you want to transition an
140 executable to the kdump_t domain.
141 Paths:
144 /sbin/kdump, /sbin/kexec, /usr/sbin/kdump, /usr/sbin/kexec
145 kdump_initrc_exec_t
148 - Set files with the kdump_initrc_exec_t type, if you want to transi‐
150 tion an executable to the kdump_initrc_t domain.
151 kdump_lock_t
155 - Set files with the kdump_lock_t type, if you want to treat the files
157 as kdump lock data, stored under the /var/lock directory
158 kdump_log_t
162 - Set files with the kdump_log_t type, if you want to treat the data as
164 kdump log data, usually stored under the /var/log directory.
165 kdump_tmpfs_t
169 - Set files with the kdump_tmpfs_t type, if you want to store kdump
171 files on a tmpfs file system.
172 kdump_unit_file_t
176 - Set files with the kdump_unit_file_t type, if you want to treat the
178 files as kdump unit content.
179 kdump_var_lib_t
183 - Set files with the kdump_var_lib_t type, if you want to store the
185 kdump files under the /var/lib directory.
186 kdumpctl_exec_t
190 - Set files with the kdumpctl_exec_t type, if you want to transition an
192 executable to the kdumpctl_t domain.
193 kdumpctl_tmp_t
197 - Set files with the kdumpctl_tmp_t type, if you want to store kdumpctl
199 temporary files in the /tmp directories.
200 kdumpgui_exec_t
204 - Set files with the kdumpgui_exec_t type, if you want to transition an
206 executable to the kdumpgui_t domain.
207 kdumpgui_tmp_t
211 - Set files with the kdumpgui_tmp_t type, if you want to store kdumpgui
213 temporary files in the /tmp directories.
214 Note: File context can be temporarily modified with the chcon command.
218 If you want to permanently change the file context you need to use the
219 semanage fcontext command. This will modify the SELinux labeling data‐
220 base. You will need to use restorecon to apply the labels.
221
224 semanage fcontext can also be used to manipulate default file context
225 mappings.
226 semanage permissive can also be used to manipulate whether or not a
228 process type is permissive.
229 semanage module can also be used to enable/disable/install/remove pol‐
231 icy modules.
232 semanage boolean can also be used to manipulate the booleans
234 system-config-selinux is a GUI tool available to customize SELinux pol‐
237 icy settings.
238
241 This manual page was auto-generated using sepolicy manpage .
242
245 selinux(8), kdump(8), semanage(8), restorecon(8), chcon(1), sepol‐
246 icy(8), setsebool(8)
247kdump 23-12-15 kdump_selinux(8)