chronyd_..._selinux(8)

💅 chronyd_..._selinux(8) — the SELinux Policy page for chronyd_restricted

okay so bestie, you're reading the chronyd_..._selinux(8) manual page, which is all about the SELinux policy for the chronyd_restricted processes. manual name's folded in already, we're doing great, let's go ✨

---

🌸 NAME

chronyd_restricted_selinux — Security Enhanced Linux Policy for the chronyd_restricted processes 🕐

---

✨ DESCRIPTION

Security-Enhanced Linux secures the chronyd_restricted processes via flexible mandatory access control. it's giving locked-down-but-make-it-fashion 💅

The chronyd_restricted processes execute with the chronyd_restricted_t SELinux type. wanna check if you've got these processes running? just run the ps command with the -Z qualifier, easy.

For example:

ps -eZ | grep chronyd_restricted_t

that's it, that's the vibe check 👑

---

🚪 ENTRYPOINTS

so the chronyd_restricted_t SELinux type can be entered via the chronyd_exec_t file type. that's the doorway, bestie.

The default entrypoint paths for the chronyd_restricted_t domain are the following:

• /usr/bin/chronyd
• /usr/lib/chrony/helper
• /usr/libexec/chrony-helper
• /usr/libexec/chrony/helper

---

🧬 PROCESS TYPES

SELinux defines process types (domains) for each process running on the system. literally every process gets a lil identity 🫶

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. The SELinux chronyd_restricted policy is very flexible, allowing users to setup their chronyd_restricted processes in as secure a method as possible.

The following process types are defined for chronyd_restricted:

• chronyd_restricted_t

Note: semanage permissive -a chronyd_restricted_t can be used to make the process type chronyd_restricted_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still snitching 💀

---

🎛️ BOOLEANS

SELinux policy is customizable based on least access required. the chronyd_restricted policy is extremely flexible and has several booleans that allow you to manipulate the policy and run chronyd_restricted with the tightest access possible. love that for us 🌈

• daemons_dontaudit_scheduling — if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

• fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

• nscd_use_shm — if you want to allow confined applications to use nscd shared memory, you must turn on the nscd_use_shm boolean. Enabled by default.

setsebool -P nscd_use_shm 1

---

📂 MANAGED FILES

The SELinux process type chronyd_restricted_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. and hey — the processes UID still needs to have DAC permissions, no skipping that part 😌

chronyd_var_lib_t

/var/lib/chrony(/.*)?

chronyd_var_run_t

/run/chrony(/.*)?
/run/chronyd(/.*)?
/run/chrony-dhcp(/.*)?
/run/chrony-helper(/.*)?
/run/chronyd.pid
/run/chronyd.sock

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

---

🛠️ COMMANDS

semanage fcontext can also be used to manipulate default file context mappings. (yes bestie, you read that right, it's literally the same command spelled with a leading space in the original — iconic, we keep it exactly as is 💅)

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage boolean can also be used to manipulate the booleans.

system-config-selinux is a GUI tool available to customize SELinux policy settings. cute little point-and-click moment 🖱️✨

---

👑 AUTHOR

This manual page was auto-generated using sepolicy manpage.

---

🦋 SEE ALSO

selinux(8), chronyd_restricted(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page, bestie, you ate that 🍓 this was chronyd_restricted, dated 26-10-06, living inside chronyd_..._selinux(8) — go forth and be secure, no cap 💖🎀