1keepalived_unconfinSeEdL_isncurxipPto_lsieclyinkuexe(p8a)likveeedp_aulnicvoendf_iunnecdo_nsfcirniepdt_script_selinux(8)
2
3
4

NAME

6       keepalived_unconfined_script_selinux  -  Security Enhanced Linux Policy
7       for the keepalived_unconfined_script processes
8

DESCRIPTION

10       Security-Enhanced Linux secures the  keepalived_unconfined_script  pro‐
11       cesses via flexible mandatory access control.
12
13       The    keepalived_unconfined_script    processes   execute   with   the
14       keepalived_unconfined_script_t SELinux type. You can check if you  have
15       these  processes running by executing the ps command with the -Z quali‐
16       fier.
17
18       For example:
19
20       ps -eZ | grep keepalived_unconfined_script_t
21
22
23

ENTRYPOINTS

25       The keepalived_unconfined_script_t SELinux type can be entered via  the
26       keepalived_unconfined_script_exec_t file type.
27
28       The default entrypoint paths for the keepalived_unconfined_script_t do‐
29       main are the following:
30
31       /usr/libexec/keepalived(/.*)?
32

PROCESS TYPES

34       SELinux defines process types (domains) for each process running on the
35       system
36
37       You can see the context of a process using the -Z option to ps
38
39       Policy  governs  the  access confined processes have to files.  SELinux
40       keepalived_unconfined_script policy is very flexible allowing users  to
41       setup  their  keepalived_unconfined_script  processes  in  as  secure a
42       method as possible.
43
44       The  following  process  types  are   defined   for   keepalived_uncon‐
45       fined_script:
46
47       keepalived_unconfined_script_t
48
49       Note: semanage permissive -a keepalived_unconfined_script_t can be used
50       to make the  process  type  keepalived_unconfined_script_t  permissive.
51       SELinux  does  not deny access to permissive process types, but the AVC
52       (SELinux denials) messages are still generated.
53
54

BOOLEANS

56       SELinux  policy  is  customizable  based  on  least  access   required.
57       keepalived_unconfined_script  policy is extremely flexible and has sev‐
58       eral  booleans  that  allow  you  to  manipulate  the  policy  and  run
59       keepalived_unconfined_script with the tightest access possible.
60
61
62
63       If you want to deny user domains applications to map a memory region as
64       both executable and writable, this  is  dangerous  and  the  executable
65       should be reported in bugzilla, you must turn on the deny_execmem bool‐
66       ean. Disabled by default.
67
68       setsebool -P deny_execmem 1
69
70
71
72       If you want to control the ability to mmap a low area  of  the  address
73       space,  as  configured  by /proc/sys/vm/mmap_min_addr, you must turn on
74       the mmap_low_allowed boolean. Disabled by default.
75
76       setsebool -P mmap_low_allowed 1
77
78
79
80       If you want to disable kernel module loading, you must turn on the  se‐
81       cure_mode_insmod boolean. Disabled by default.
82
83       setsebool -P secure_mode_insmod 1
84
85
86
87       If  you  want to allow unconfined executables to make their heap memory
88       executable.  Doing this is a really  bad  idea.  Probably  indicates  a
89       badly  coded  executable, but could indicate an attack. This executable
90       should be reported in bugzilla, you must turn  on  the  selinuxuser_ex‐
91       echeap boolean. Disabled by default.
92
93       setsebool -P selinuxuser_execheap 1
94
95
96
97       If  you  want  to allow unconfined executables to make their stack exe‐
98       cutable.  This should never, ever be necessary.  Probably  indicates  a
99       badly  coded  executable, but could indicate an attack. This executable
100       should be reported in bugzilla, you must turn on the  selinuxuser_exec‐
101       stack boolean. Enabled by default.
102
103       setsebool -P selinuxuser_execstack 1
104
105
106

MANAGED FILES

108       The  SELinux  process  type  keepalived_unconfined_script_t  can manage
109       files labeled with the following file types.  The paths listed are  the
110       default  paths for these file types.  Note the processes UID still need
111       to have DAC permissions.
112
113       file_type
114
115            all files on the system
116
117

FILE CONTEXTS

119       SELinux requires files to have an extended attribute to define the file
120       type.
121
122       You can see the context of a file using the -Z option to ls
123
124       Policy  governs  the  access  confined  processes  have to these files.
125       SELinux keepalived_unconfined_script policy is very  flexible  allowing
126       users  to  setup their keepalived_unconfined_script processes in as se‐
127       cure a method as possible.
128
129       STANDARD FILE CONTEXT
130
131       SELinux defines  the  file  context  types  for  the  keepalived_uncon‐
132       fined_script,  if  you wanted to store files with these types in a dif‐
133       ferent paths, you need to execute the semanage command to  specify  al‐
134       ternate labeling and then use restorecon to put the labels on disk.
135
136       semanage    fcontext    -a    -t    keepalived_unconfined_script_exec_t
137       '/srv/keepalived_unconfined_script/content(/.*)?'
138       restorecon -R -v /srv/mykeepalived_unconfined_script_content
139
140       Note: SELinux often uses regular expressions  to  specify  labels  that
141       match multiple files.
142
143       The following file types are defined for keepalived_unconfined_script:
144
145
146
147       keepalived_unconfined_script_exec_t
148
149       -  Set  files with the keepalived_unconfined_script_exec_t type, if you
150       want to transition an executable to the  keepalived_unconfined_script_t
151       domain.
152
153
154
155       Note:  File context can be temporarily modified with the chcon command.
156       If you want to permanently change the file context you need to use  the
157       semanage fcontext command.  This will modify the SELinux labeling data‐
158       base.  You will need to use restorecon to apply the labels.
159
160

COMMANDS

162       semanage fcontext can also be used to manipulate default  file  context
163       mappings.
164
165       semanage  permissive  can  also  be used to manipulate whether or not a
166       process type is permissive.
167
168       semanage module can also be used to enable/disable/install/remove  pol‐
169       icy modules.
170
171       semanage boolean can also be used to manipulate the booleans
172
173
174       system-config-selinux is a GUI tool available to customize SELinux pol‐
175       icy settings.
176
177

AUTHOR

179       This manual page was auto-generated using sepolicy manpage .
180
181

SEE ALSO

183       selinux(8),  keepalived_unconfined_script(8),   semanage(8),   restore‐
184       con(8), chcon(1), sepolicy(8), setsebool(8)
185
186
187
188keepalived_unconfined_script       23-12k-e1e5palived_unconfined_script_selinux(8)
Impressum