openvswitch_selinux(8)

📦

version 20250627+git412.dbf877ab7 · 7 versions

20250627+git412.dbf877ab7 · opensuse-leap 16.0 (latest)
38.1.87 · centos-stream 9
42.1.28 · centos-stream 10
43.10 · fedora 43
42.12 · fedora 43
44.11 · fedora 44
43.3 · fedora 44

✨ openvswitch_selinux — bestie edition ✨

okay so this is the SELinux manual page for the openvswitch processes, from the SELinux Policy openvswitch collection, and honestly? it's giving "mandatory access control but make it cute." let's get into it 💅

🌸 NAME 🌸

openvswitch_selinux — the Security Enhanced Linux Policy for the openvswitch processes. yes bestie, that's the whole vibe. 🦋

💖 DESCRIPTION 💖

Security-Enhanced Linux secures the openvswitch processes via flexible mandatory access control. periodt. 🔥

The openvswitch processes execute with the openvswitch_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier, like this:

ps -eZ | grep openvswitch_t

slay, now you know if they're out there living their best life. 👑

🎀 ENTRYPOINTS 🎀

The openvswitch_t SELinux type can be entered via the openvswitch_exec_t file type. lowkey iconic how that works.

The default entrypoint paths for the openvswitch_t domain are literally these:

/usr/bin/ovs-vsctl, /usr/bin/ovsdb-ctl, /usr/bin/ovs-appctl,
/usr/bin/ovs-vswitchd, /usr/bin/ovsdb-server,
/usr/share/openvswitch/scripts/ovs-ctl

no cap, memorize these if you're tryna transition something. 💜

🦋 PROCESS TYPES 🦋

SELinux defines process types (domains) for each process running on the system. it's giving "every queen gets her own category." ✨

You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. SELinux openvswitch policy is very flexible allowing users to setup their openvswitch processes in as secure a method as possible. we love a flexible icon. 🌈

The following process types are defined for openvswitch:

openvswitch_t

Note: semanage permissive -a openvswitch_t can be used to make the process type openvswitch_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, she's chill but she still keeps receipts. 💀

🍓 BOOLEANS 🍓

SELinux policy is customizable based on least access required. openvswitch policy is extremely flexible and has several booleans that allow you to manipulate the policy and run openvswitch with the tightest access possible. tightest access = bestie behavior, fr fr. 🫶

if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

see? easy. booleans are just vibes you can toggle. 💅

🌺 PORT TYPES 🌺

SELinux defines port types to represent TCP and UDP ports. yes, ports have types now. we stan structured networking.

You can see the types associated with a port by using the following command:

semanage port -l

Policy governs the access confined processes have to these ports. SELinux openvswitch policy is very flexible allowing users to setup their openvswitch processes in as secure a method as possible. (say it with me: flexible, secure, iconic.) 🌟

The following port types are defined for openvswitch:

openvswitch_port_t

Default Defined Ports:

tcp 6634

remember that number, bestie. it's on the test. 😌

🧚 MANAGED FILES 🧚

The SELinux process type openvswitch_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. Note: the processes UID still need to have DAC permissions. (SELinux is powerful but she's not doing everything for you, okay?)

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

hugetlbfs_t

/dev/hugepages
/usr/lib/udev/devices/hugepages

ipsec_conf_file_t

/etc/racoon(/.*)?
/etc/strongswan.conf
/etc/strongimcv(/.*)?
/etc/strongswan(/.*)?
/etc/strongswan.d(/.*)?
/etc/ipsec.conf
/etc/strongswan/ipsec.conf

ipsec_key_file_t

/etc/ipsec.d(/.*)?
/etc/racoon/certs(/.*)?
/etc/ipsec.secrets.*
/var/lib/ipsec/nss(/.*)?
/etc/strongswan/ipsec.d(/.*)?
/etc/strongswan/swanctl/rsa(/.*)?
/etc/strongswan/swanctl/pkcs.*
/etc/strongswan/swanctl/x509.*
/etc/strongswan/ipsec.secrets.*
/etc/strongswan/swanctl/ecdsa(/.*)?
/etc/strongswan/swanctl/bliss/(/.*)?
/etc/strongswan/swanctl/pubkey(/.*)?
/etc/strongswan/swanctl/private(/.*)?
/etc/racoon/psk.txt

krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

openvswitch_log_t

/var/log/openvswitch(/.*)?

openvswitch_rw_t

/etc/openvswitch(/.*)?

openvswitch_tmp_t

(no default paths listed, she's mysterious like that) 🙈

openvswitch_var_lib_t

/var/lib/openvswitch(/.*)?

openvswitch_var_run_t

/run/openvswitch(/.*)?

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

svirt_image_t

(no default paths listed)

svirt_tmp_t

(no default paths listed)

sysfs_t

/sys(/.*)?

that's a whole lot of file types, but honestly? she ate. 💖

⭐ FILE CONTEXTS ⭐

SELinux requires files to have an extended attribute to define the file type. it's like a little name tag for your files, so cute. 🎀

You can see the context of a file using the -Z option to ls.

Policy governs the access confined processes have to these files. SELinux openvswitch policy is very flexible allowing users to setup their openvswitch processes in as secure a method as possible.

💫 STANDARD FILE CONTEXT 💫

SELinux defines the file context types for the openvswitch, if you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

semanage fcontext -a -t openvswitch_exec_t '/srv/openvswitch/content(/.*)?'
restorecon -R -v /srv/myopenvswitch_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. regex bestie, we love her. 🦋

The following file types are defined for openvswitch:

openvswitch_exec_t — set files with the openvswitch_exec_t type, if you want to transition an executable to the openvswitch_t domain.

Paths:

/usr/bin/ovs-vsctl, /usr/bin/ovsdb-ctl, /usr/bin/ovs-appctl,
/usr/bin/ovs-vswitchd, /usr/bin/ovsdb-server,
/usr/share/openvswitch/scripts/ovs-ctl

openvswitch_log_t — set files with the openvswitch_log_t type, if you want to treat the data as openvswitch log data, usually stored under the /var/log directory.
openvswitch_rw_t — set files with the openvswitch_rw_t type, if you want to treat the files as openvswitch read/write content.
openvswitch_tmp_t — set files with the openvswitch_tmp_t type, if you want to store openvswitch temporary files in the /tmp directories.
openvswitch_tmpfs_t — set files with the openvswitch_tmpfs_t type, if you want to store openvswitch files on a tmpfs file system.
openvswitch_unit_file_t — set files with the openvswitch_unit_file_t type, if you want to treat the files as openvswitch unit content.
openvswitch_var_lib_t — set files with the openvswitch_var_lib_t type, if you want to store the openvswitch files under the /var/lib directory.
openvswitch_var_run_t — set files with the openvswitch_var_run_t type, if you want to store the openvswitch files under the /run or /var/run directory.

Note: file context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels. so like, chcon is the temp tattoo, semanage fcontext + restorecon is the real permanent ink. 💀

💅 COMMANDS 💅

semanage fcontext can also be used to manipulate default file context mappings.

semanage permissive can also be used to manipulate whether or not a process type is permissive.

semanage module can also be used to enable/disable/install/remove policy modules.

semanage port can also be used to manipulate the port definitions

semanage boolean can also be used to manipulate the booleans

system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a whole GUI, for when you're feeling fancy. ✨

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. (auto-generated and still ate, honestly.) 🫶

🌈 SEE ALSO 🌈

selinux(8), openvswitch(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

and that's the whole page bestie!! this one's from the openvswitch collection, dated 26-10-06, and it's page openvswitch_selinux(8). go forth and SELinux responsibly 💖🎀🦋

📦 where this page comes from

opensuse-leap 16.0: selinux-policy-doc 20250627+git412.dbf877ab7-160000.1.1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms