ipmievd_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💖 ipmievd_selinux(8) — the whole SELinux tea for ipmievd 💖

okay so you opened the ipmievd_selinux(8) man page and honestly? good for you. this is the SELinux policy page for the ipmievd processes, and i'm gonna walk you through every single bit of it like we're texting at 2am. grab a snack. 🍓

✨ NAME ✨

ipmievd_selinux — the Security Enhanced Linux Policy for the ipmievd processes. that's it, that's the name, she's iconic and she's specific. 👑

🌸 DESCRIPTION 🌸

Security-Enhanced Linux secures the ipmievd processes via flexible mandatory access control. like, it's literally out here protecting them with mandatory access control that is flexible, bestie. the whole vibe.

The ipmievd processes execute with the ipmievd_t SELinux type. and if you wanna check whether you've got these processes running, you just run the ps command with the -Z qualifier. easy.

For example:

ps -eZ | grep ipmievd_t

that's the vibe check right there. run it. 🫶

🦋 ENTRYPOINTS 🦋

okay so the ipmievd_t SELinux type can be entered via the ipmievd_exec_t file type. that's the door, that's the entry point, iykyk.

The default entrypoint paths for the ipmievd_t domain are the following:

/usr/bin/ipmievd

one path. one single path. main character energy. ✨

💅 PROCESS TYPES 💅

SELinux defines process types (domains) for each process running on the system.

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. the SELinux ipmievd policy is very flexible, allowing users to setup their ipmievd processes in as secure a method as possible. like it's giving customizable but safe.

The following process types are defined for ipmievd:

  • ipmievd_t
  • ipmievd_helper_t
Note: semanage permissive -a ipmievd_t can be used to make the process type ipmievd_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like... she won't block you, but she will still be writing it all down in her notes. 💀

🔥 BOOLEANS 🔥

SELinux policy is customizable based on least access required. the ipmievd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run ipmievd with the tightest access possible. tightest access possible, periodt.

  • daemons_dontaudit_scheduling — if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.
setsebool -P daemons_dontaudit_scheduling 1
  • fips_mode — if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.
setsebool -P fips_mode 1
  • nis_enabled — if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.
setsebool -P nis_enabled 1
  • secure_mode_insmod — if you want to disable kernel module loading, you must turn on the secure_mode_insmod boolean. Disabled by default.
setsebool -P secure_mode_insmod 1

that's four booleans, all accounted for, nothing skipped. we don't do skipping here. 💜

🎀 MANAGED FILES 🎀

The SELinux process type ipmievd_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note the processes UID still need to have DAC permissions. (yes, even with all this SELinux magic, UID still gotta have its DAC permissions. rules are rules fr fr.)

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

ipmievd_lock_t

/run/lock/subsys/ipmi

ipmievd_var_run_t

/run/ipmievd.pid

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

look at all those paths. she ate. 🌈

⭐ FILE CONTEXTS ⭐

SELinux requires files to have an extended attribute to define the file type. that's just how she works.

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. the SELinux ipmievd policy is very flexible, allowing users to setup their ipmievd processes in as secure a method as possible.

🌸 STANDARD FILE CONTEXT 🌸

SELinux defines the file context types for the ipmievd. if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. like so:

semanage fcontext -a -t ipmievd_exec_t '/srv/ipmievd/content(/.*)?'
restorecon -R -v /srv/myipmievd_content
Note: SELinux often uses regular expressions to specify labels that match multiple files. regexes, bestie. she's fancy like that. 🎀

The following file types are defined for ipmievd:

ipmievd_exec_t

  • Set files with the ipmievd_exec_t type, if you want to transition an executable to the ipmievd_t domain.

ipmievd_helper_exec_t

  • Set files with the ipmievd_helper_exec_t type, if you want to transition an executable to the ipmievd_helper_t domain.

ipmievd_lock_t

  • Set files with the ipmievd_lock_t type, if you want to treat the files as ipmievd lock data, stored under the /var/lock directory.

ipmievd_unit_file_t

  • Set files with the ipmievd_unit_file_t type, if you want to treat the files as ipmievd unit content.

ipmievd_var_run_t

  • Set files with the ipmievd_var_run_t type, if you want to store the ipmievd files under the /run or /var/run directory.
Note: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. temporary = chcon, permanent = semanage fcontext + restorecon. don't mix them up, i'm begging. 😭

🧚 COMMANDS 🧚

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage boolean can also be used to manipulate the booleans.
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. (a GUI!! for the girlies who like clicking 🖱️✨)

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. not me finding out she was auto-generated the whole time 💀

💖 SEE ALSO 💖

selinux(8), ipmievd(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8), ipmievd_helper_selinux(8)

go read those too, i'm serious, expand your horizons. 🦋

and that's the whole page bestie, no crumbs left behind. this one's ipmievd 🎀, from 26-10-06, and the page itself is ipmievd_selinux(8). mwah, go forth and label responsibly 💅💜

📦 where this page comes from