1puppetmaster_selinux(8) SELinux Policy puppetmaster puppetmaster_selinux(8)
2
6 puppetmaster_selinux - Security Enhanced Linux Policy for the puppet‐
7 master processes
8
10 Security-Enhanced Linux secures the puppetmaster processes via flexible
11 mandatory access control.
12 The puppetmaster processes execute with the puppetmaster_t SELinux
14 type. You can check if you have these processes running by executing
15 the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep puppetmaster_t
20
24 The puppetmaster_t SELinux type can be entered via the puppetmas‐
25 ter_exec_t file type.
26 The default entrypoint paths for the puppetmaster_t domain are the fol‐
28 lowing:
29 /usr/bin/puppetmasterd, /usr/sbin/puppetmasterd, /usr/bin/start-puppet-
31 master
32
34 SELinux defines process types (domains) for each process running on the
35 system
36 You can see the context of a process using the -Z option to ps
38 Policy governs the access confined processes have to files. SELinux
40 puppetmaster policy is very flexible allowing users to setup their pup‐
41 petmaster processes in as secure a method as possible.
42 The following process types are defined for puppetmaster:
44 puppetmaster_t
46 Note: semanage permissive -a puppetmaster_t can be used to make the
48 process type puppetmaster_t permissive. SELinux does not deny access to
49 permissive process types, but the AVC (SELinux denials) messages are
50 still generated.
51
54 SELinux policy is customizable based on least access required. puppet‐
55 master policy is extremely flexible and has several booleans that allow
56 you to manipulate the policy and run puppetmaster with the tightest ac‐
57 cess possible.
58 If you want to allow Puppet master to use connect to MySQL and Post‐
62 greSQL database, you must turn on the puppetmaster_use_db boolean. Dis‐
63 abled by default.
64 setsebool -P puppetmaster_use_db 1
66 If you want to dontaudit all daemons scheduling requests (setsched,
70 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
71 Enabled by default.
72 setsebool -P daemons_dontaudit_scheduling 1
74 If you want to allow all domains to execute in fips_mode, you must turn
78 on the fips_mode boolean. Enabled by default.
79 setsebool -P fips_mode 1
81 If you want to allow system to run with NIS, you must turn on the
85 nis_enabled boolean. Disabled by default.
86 setsebool -P nis_enabled 1
88
92 The SELinux process type puppetmaster_t can manage files labeled with
93 the following file types. The paths listed are the default paths for
94 these file types. Note the processes UID still need to have DAC per‐
95 missions.
96 cluster_conf_t
98 /etc/cluster(/.*)?
100 cluster_var_lib_t
102 /var/lib/pcsd(/.*)?
104 /var/lib/cluster(/.*)?
105 /var/lib/openais(/.*)?
106 /var/lib/pengine(/.*)?
107 /var/lib/corosync(/.*)?
108 /usr/lib/heartbeat(/.*)?
109 /var/lib/heartbeat(/.*)?
110 /var/lib/pacemaker(/.*)?
111 cluster_var_run_t
113 /var/run/crm(/.*)?
115 /var/run/cman_.*
116 /var/run/rsctmp(/.*)?
117 /var/run/aisexec.*
118 /var/run/heartbeat(/.*)?
119 /var/run/pcsd-ruby.socket
120 /var/run/corosync-qnetd(/.*)?
121 /var/run/corosync-qdevice(/.*)?
122 /var/run/corosync.pid
123 /var/run/cpglockd.pid
124 /var/run/rgmanager.pid
125 /var/run/cluster/rgmanager.sk
126 krb5_host_rcache_t
128 /var/tmp/krb5_0.rcache2
130 /var/cache/krb5rcache(/.*)?
131 /var/tmp/nfs_0
132 /var/tmp/DNS_25
133 /var/tmp/host_0
134 /var/tmp/imap_0
135 /var/tmp/HTTP_23
136 /var/tmp/HTTP_48
137 /var/tmp/ldap_55
138 /var/tmp/ldap_487
139 /var/tmp/ldapmap1_0
140 puppet_log_t
142 /var/log/puppet(/.*)?
144 puppet_var_lib_t
146 /var/lib/puppet(/.*)?
148 puppet_var_run_t
150 /var/run/puppet(/.*)?
152 puppetmaster_tmp_t
154 root_t
157 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
159 /
160 /initrd
161 security_t
163 /selinux
165
168 SELinux requires files to have an extended attribute to define the file
169 type.
170 You can see the context of a file using the -Z option to ls
172 Policy governs the access confined processes have to these files.
174 SELinux puppetmaster policy is very flexible allowing users to setup
175 their puppetmaster processes in as secure a method as possible.
176 STANDARD FILE CONTEXT
178 SELinux defines the file context types for the puppetmaster, if you
180 wanted to store files with these types in a different paths, you need
181 to execute the semanage command to specify alternate labeling and then
182 use restorecon to put the labels on disk.
183 semanage fcontext -a -t puppetmaster_exec_t '/srv/puppetmaster/con‐
185 tent(/.*)?'
186 restorecon -R -v /srv/mypuppetmaster_content
187 Note: SELinux often uses regular expressions to specify labels that
189 match multiple files.
190 The following file types are defined for puppetmaster:
192 puppetmaster_exec_t
196 - Set files with the puppetmaster_exec_t type, if you want to transi‐
198 tion an executable to the puppetmaster_t domain.
199 Paths:
202 /usr/bin/puppetmasterd, /usr/sbin/puppetmasterd, /usr/bin/start-
203 puppet-master
204 puppetmaster_initrc_exec_t
207 - Set files with the puppetmaster_initrc_exec_t type, if you want to
209 transition an executable to the puppetmaster_initrc_t domain.
210 puppetmaster_tmp_t
214 - Set files with the puppetmaster_tmp_t type, if you want to store pup‐
216 petmaster temporary files in the /tmp directories.
217 Note: File context can be temporarily modified with the chcon command.
221 If you want to permanently change the file context you need to use the
222 semanage fcontext command. This will modify the SELinux labeling data‐
223 base. You will need to use restorecon to apply the labels.
224
227 semanage fcontext can also be used to manipulate default file context
228 mappings.
229 semanage permissive can also be used to manipulate whether or not a
231 process type is permissive.
232 semanage module can also be used to enable/disable/install/remove pol‐
234 icy modules.
235 semanage boolean can also be used to manipulate the booleans
237 system-config-selinux is a GUI tool available to customize SELinux pol‐
240 icy settings.
241
244 This manual page was auto-generated using sepolicy manpage .
245
248 selinux(8), puppetmaster(8), semanage(8), restorecon(8), chcon(1), se‐
249 policy(8), setsebool(8)
250puppetmaster 23-12-15 puppetmaster_selinux(8)