1ntpd_selinux(8) SELinux Policy ntpd ntpd_selinux(8)
2
6 ntpd_selinux - Security Enhanced Linux Policy for the ntpd processes
7
9 Security-Enhanced Linux secures the ntpd processes via flexible manda‐
10 tory access control.
11 The ntpd processes execute with the ntpd_t SELinux type. You can check
13 if you have these processes running by executing the ps command with
14 the -Z qualifier.
15 For example:
17 ps -eZ | grep ntpd_t
19
23 The ntpd_t SELinux type can be entered via the ntpdate_exec_t,
24 ntpd_exec_t file types.
25 The default entrypoint paths for the ntpd_t domain are the following:
27 /usr/sbin/sntp, /usr/sbin/ntpdate, /usr/libexec/ntpdate-wrapper,
29 /etc/cron.(daily|weekly)/ntp-server, /etc/cron.(daily|weekly)/ntp-sim‐
30 ple, /usr/sbin/ntpd
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 ntpd policy is very flexible allowing users to setup their ntpd pro‐
40 cesses in as secure a method as possible.
41 The following process types are defined for ntpd:
43 ntpd_t
45 Note: semanage permissive -a ntpd_t can be used to make the process
47 type ntpd_t permissive. SELinux does not deny access to permissive
48 process types, but the AVC (SELinux denials) messages are still gener‐
49 ated.
50
53 SELinux policy is customizable based on least access required. ntpd
54 policy is extremely flexible and has several booleans that allow you to
55 manipulate the policy and run ntpd with the tightest access possible.
56 If you want to dontaudit all daemons scheduling requests (setsched,
60 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
61 Enabled by default.
62 setsebool -P daemons_dontaudit_scheduling 1
64 If you want to allow all domains to execute in fips_mode, you must turn
68 on the fips_mode boolean. Enabled by default.
69 setsebool -P fips_mode 1
71 If you want to allow system to run with NIS, you must turn on the
75 nis_enabled boolean. Disabled by default.
76 setsebool -P nis_enabled 1
78 If you want to support NFS home directories, you must turn on the
82 use_nfs_home_dirs boolean. Disabled by default.
83 setsebool -P use_nfs_home_dirs 1
85 If you want to support SAMBA home directories, you must turn on the
89 use_samba_home_dirs boolean. Disabled by default.
90 setsebool -P use_samba_home_dirs 1
92
96 SELinux defines port types to represent TCP and UDP ports.
97 You can see the types associated with a port by using the following
99 command:
100 semanage port -l
102 Policy governs the access confined processes have to these ports.
105 SELinux ntpd policy is very flexible allowing users to setup their ntpd
106 processes in as secure a method as possible.
107 The following port types are defined for ntpd:
109 ntp_port_t
112 Default Defined Ports:
116 udp 123
117
119 The SELinux process type ntpd_t can manage files labeled with the fol‐
120 lowing file types. The paths listed are the default paths for these
121 file types. Note the processes UID still need to have DAC permissions.
122 cluster_conf_t
124 /etc/cluster(/.*)?
126 cluster_var_lib_t
128 /var/lib/pcsd(/.*)?
130 /var/lib/cluster(/.*)?
131 /var/lib/openais(/.*)?
132 /var/lib/pengine(/.*)?
133 /var/lib/corosync(/.*)?
134 /usr/lib/heartbeat(/.*)?
135 /var/lib/heartbeat(/.*)?
136 /var/lib/pacemaker(/.*)?
137 cluster_var_run_t
139 /var/run/crm(/.*)?
141 /var/run/cman_.*
142 /var/run/rsctmp(/.*)?
143 /var/run/aisexec.*
144 /var/run/heartbeat(/.*)?
145 /var/run/pcsd-ruby.socket
146 /var/run/corosync-qnetd(/.*)?
147 /var/run/corosync-qdevice(/.*)?
148 /var/run/corosync.pid
149 /var/run/cpglockd.pid
150 /var/run/rgmanager.pid
151 /var/run/cluster/rgmanager.sk
152 gpsd_tmpfs_t
154 krb5_host_rcache_t
157 /var/tmp/krb5_0.rcache2
159 /var/cache/krb5rcache(/.*)?
160 /var/tmp/nfs_0
161 /var/tmp/DNS_25
162 /var/tmp/host_0
163 /var/tmp/imap_0
164 /var/tmp/HTTP_23
165 /var/tmp/HTTP_48
166 /var/tmp/ldap_55
167 /var/tmp/ldap_487
168 /var/tmp/ldapmap1_0
169 ntp_drift_t
171 /var/lib/ntp(/.*)?
173 /etc/ntp/data(/.*)?
174 /var/lib/sntp(/.*)?
175 /var/lib/sntp-kod(/.*)?
176 ntpd_log_t
178 /var/log/ntp.*
180 /var/log/xntpd.*
181 /var/log/ntpstats(/.*)?
182 ntpd_tmp_t
184 ntpd_tmpfs_t
187 ntpd_var_run_t
190 /var/run/ntpd.pid
192 root_t
194 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
196 /
197 /initrd
198 timemaster_tmpfs_t
200 tmpfs_t
203 /dev/shm
205 /var/run/shm
206 /usr/lib/udev/devices/shm
207
210 SELinux requires files to have an extended attribute to define the file
211 type.
212 You can see the context of a file using the -Z option to ls
214 Policy governs the access confined processes have to these files.
216 SELinux ntpd policy is very flexible allowing users to setup their ntpd
217 processes in as secure a method as possible.
218 STANDARD FILE CONTEXT
220 SELinux defines the file context types for the ntpd, if you wanted to
222 store files with these types in a different paths, you need to execute
223 the semanage command to specify alternate labeling and then use re‐
224 storecon to put the labels on disk.
225 semanage fcontext -a -t ntpd_exec_t '/srv/ntpd/content(/.*)?'
227 restorecon -R -v /srv/myntpd_content
228 Note: SELinux often uses regular expressions to specify labels that
230 match multiple files.
231 The following file types are defined for ntpd:
233 ntpd_exec_t
237 - Set files with the ntpd_exec_t type, if you want to transition an ex‐
239 ecutable to the ntpd_t domain.
240 Paths:
243 /etc/cron.(daily|weekly)/ntp-server, /etc/cron.(daily|weekly)/ntp-
244 simple, /usr/sbin/ntpd
245 ntpd_initrc_exec_t
248 - Set files with the ntpd_initrc_exec_t type, if you want to transition
250 an executable to the ntpd_initrc_t domain.
251 ntpd_key_t
255 - Set files with the ntpd_key_t type, if you want to treat the files as
257 ntpd key data.
258 Paths:
261 /etc/ntp/crypto(/.*)?, /etc/ntp/keys
262 ntpd_log_t
265 - Set files with the ntpd_log_t type, if you want to treat the data as
267 ntpd log data, usually stored under the /var/log directory.
268 Paths:
271 /var/log/ntp.*, /var/log/xntpd.*, /var/log/ntpstats(/.*)?
272 ntpd_tmp_t
275 - Set files with the ntpd_tmp_t type, if you want to store ntpd tempo‐
277 rary files in the /tmp directories.
278 ntpd_tmpfs_t
282 - Set files with the ntpd_tmpfs_t type, if you want to store ntpd files
284 on a tmpfs file system.
285 ntpd_unit_file_t
289 - Set files with the ntpd_unit_file_t type, if you want to treat the
291 files as ntpd unit content.
292 ntpd_var_run_t
296 - Set files with the ntpd_var_run_t type, if you want to store the ntpd
298 files under the /run or /var/run directory.
299 ntpdate_exec_t
303 - Set files with the ntpdate_exec_t type, if you want to transition an
305 executable to the ntpdate_t domain.
306 Paths:
309 /usr/sbin/sntp, /usr/sbin/ntpdate, /usr/libexec/ntpdate-wrapper
310 Note: File context can be temporarily modified with the chcon command.
313 If you want to permanently change the file context you need to use the
314 semanage fcontext command. This will modify the SELinux labeling data‐
315 base. You will need to use restorecon to apply the labels.
316
319 semanage fcontext can also be used to manipulate default file context
320 mappings.
321 semanage permissive can also be used to manipulate whether or not a
323 process type is permissive.
324 semanage module can also be used to enable/disable/install/remove pol‐
326 icy modules.
327 semanage port can also be used to manipulate the port definitions
329 semanage boolean can also be used to manipulate the booleans
331 system-config-selinux is a GUI tool available to customize SELinux pol‐
334 icy settings.
335
338 This manual page was auto-generated using sepolicy manpage .
339
342 selinux(8), ntpd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8),
343 setsebool(8)
344ntpd 23-12-15 ntpd_selinux(8)