1pegasus_openlmi_serviScEeLsi_nsuexliPnoulxi(c8y)pegasus_oppeegnalsmuis__soeprevnilcmeis_services_selinux(8)
2
6 pegasus_openlmi_services_selinux - Security Enhanced Linux Policy for
7 the pegasus_openlmi_services processes
8
10 Security-Enhanced Linux secures the pegasus_openlmi_services processes
11 via flexible mandatory access control.
12 The pegasus_openlmi_services processes execute with the pega‐
14 sus_openlmi_services_t SELinux type. You can check if you have these
15 processes running by executing the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep pegasus_openlmi_services_t
20
24 The pegasus_openlmi_services_t SELinux type can be entered via the pe‐
25 gasus_openlmi_services_exec_t file type.
26 The default entrypoint paths for the pegasus_openlmi_services_t domain
28 are the following:
29 /usr/libexec/pegasus/cmpiLMI_Realmd-cimprovagt
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 pegasus_openlmi_services policy is very flexible allowing users to
40 setup their pegasus_openlmi_services processes in as secure a method as
41 possible.
42 The following process types are defined for pegasus_openlmi_services:
44 pegasus_openlmi_services_t
46 Note: semanage permissive -a pegasus_openlmi_services_t can be used to
48 make the process type pegasus_openlmi_services_t permissive. SELinux
49 does not deny access to permissive process types, but the AVC (SELinux
50 denials) messages are still generated.
51
54 SELinux policy is customizable based on least access required. pega‐
55 sus_openlmi_services policy is extremely flexible and has several bool‐
56 eans that allow you to manipulate the policy and run pega‐
57 sus_openlmi_services with the tightest access possible.
58 If you want to dontaudit all daemons scheduling requests (setsched,
62 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
63 Enabled by default.
64 setsebool -P daemons_dontaudit_scheduling 1
66 If you want to allow all domains to execute in fips_mode, you must turn
70 on the fips_mode boolean. Enabled by default.
71 setsebool -P fips_mode 1
73
77 The SELinux process type pegasus_openlmi_services_t can manage files
78 labeled with the following file types. The paths listed are the de‐
79 fault paths for these file types. Note the processes UID still need to
80 have DAC permissions.
81 cluster_conf_t
83 /etc/cluster(/.*)?
85 cluster_var_lib_t
87 /var/lib/pcsd(/.*)?
89 /var/lib/cluster(/.*)?
90 /var/lib/openais(/.*)?
91 /var/lib/pengine(/.*)?
92 /var/lib/corosync(/.*)?
93 /usr/lib/heartbeat(/.*)?
94 /var/lib/heartbeat(/.*)?
95 /var/lib/pacemaker(/.*)?
96 cluster_var_run_t
98 /var/run/crm(/.*)?
100 /var/run/cman_.*
101 /var/run/rsctmp(/.*)?
102 /var/run/aisexec.*
103 /var/run/heartbeat(/.*)?
104 /var/run/pcsd-ruby.socket
105 /var/run/corosync-qnetd(/.*)?
106 /var/run/corosync-qdevice(/.*)?
107 /var/run/corosync.pid
108 /var/run/cpglockd.pid
109 /var/run/rgmanager.pid
110 /var/run/cluster/rgmanager.sk
111 pegasus_data_t
113 /var/lib/Pegasus(/.*)?
115 /etc/Pegasus/pegasus_current.conf
116 /etc/Pegasus/cimserver_current.conf
117 root_t
119 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
121 /
122 /initrd
123
126 SELinux requires files to have an extended attribute to define the file
127 type.
128 You can see the context of a file using the -Z option to ls
130 Policy governs the access confined processes have to these files.
132 SELinux pegasus_openlmi_services policy is very flexible allowing users
133 to setup their pegasus_openlmi_services processes in as secure a method
134 as possible.
135 STANDARD FILE CONTEXT
137 SELinux defines the file context types for the pegasus_openlmi_ser‐
139 vices, if you wanted to store files with these types in a different
140 paths, you need to execute the semanage command to specify alternate
141 labeling and then use restorecon to put the labels on disk.
142 semanage fcontext -a -t pegasus_openlmi_services_exec_t '/srv/pega‐
144 sus_openlmi_services/content(/.*)?'
145 restorecon -R -v /srv/mypegasus_openlmi_services_content
146 Note: SELinux often uses regular expressions to specify labels that
148 match multiple files.
149 The following file types are defined for pegasus_openlmi_services:
151 pegasus_openlmi_services_exec_t
155 - Set files with the pegasus_openlmi_services_exec_t type, if you want
157 to transition an executable to the pegasus_openlmi_services_t domain.
158 Note: File context can be temporarily modified with the chcon command.
162 If you want to permanently change the file context you need to use the
163 semanage fcontext command. This will modify the SELinux labeling data‐
164 base. You will need to use restorecon to apply the labels.
165
168 semanage fcontext can also be used to manipulate default file context
169 mappings.
170 semanage permissive can also be used to manipulate whether or not a
172 process type is permissive.
173 semanage module can also be used to enable/disable/install/remove pol‐
175 icy modules.
176 semanage boolean can also be used to manipulate the booleans
178 system-config-selinux is a GUI tool available to customize SELinux pol‐
181 icy settings.
182
185 This manual page was auto-generated using sepolicy manpage .
186
189 selinux(8), pegasus_openlmi_services(8), semanage(8), restorecon(8),
190 chcon(1), sepolicy(8), setsebool(8)
191pegasus_openlmi_services 23-12-15pegasus_openlmi_services_selinux(8)