ptp4l_selinux(8)

📦
version 20250627+git412.dbf877ab7 · 2 versions
, in opensuse-leap 16.0

💅 ptp4l_selinux — the SELinux glow-up for your ptp4l processes 🎀

okay so bestie, listen. this is the manual page for ptp4l_selinux, and it's basically the ~vibe check~ for how Security-Enhanced Linux keeps an eye on your ptp4l processes. no cap, it's lowkey iconic. let's get into it ✨

🌸 NAME 🌸

ptp4l_selinux — Security Enhanced Linux Policy for the ptp4l processes. that's it, that's the whole name. slay 💅

🦋 DESCRIPTION 🦋

Security-Enhanced Linux secures the ptp4l processes via flexible mandatory access control. yes bestie, mandatory. not optional. that's the whole point 🫶

So the ptp4l processes execute with the ptp4l_t SELinux type. wanna check if you've got these processes running? literally just run the ps command with the -Z qualifier. that's the move.

for example:

ps -eZ | grep ptp4l_t

that's it. so simple. love that for us 💖

⭐ ENTRYPOINTS ⭐

okay so here's how things get in. the ptp4l_t SELinux type can be entered via the ptp4l_exec_t file type. that's the doorway, bestie 🚪✨

and the default entrypoint paths for the ptp4l_t domain are literally just:

/usr/bin/ptp4l

one path. one icon. main character energy fr fr 👑

💜 PROCESS TYPES 💜

so SELinux defines process types (aka domains) for each process running on the system. yep, every single one gets a little label. it's giving personalized name tags at a party 🎀

you can see the context of a process using the -Z option to ps. easy peasy.

Policy governs the access confined processes have to files. and the SELinux ptp4l policy is very flexible — it allows users to set up their ptp4l processes in as secure a method as possible. that's the goal, always the goal 💯

these are the process types defined for ptp4l:

  • ptp4l_t
Note: semanage permissive -a ptp4l_t can be used to make the process type ptp4l_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like, it's chill but it's still watching you 👀

✨ BOOLEANS ✨

SELinux policy is customizable based on least access required — the whole "give them nothing and let them earn it" energy. and the ptp4l policy is extremely flexible, with several booleans that let you manipulate the policy and run ptp4l with the tightest access possible. tightest access = cleanest look, obviously.

okay so, boolean number one:

if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. it's enabled by default, bestie.

setsebool -P daemons_dontaudit_scheduling 1

and boolean number two:

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. also enabled by default 💖

setsebool -P fips_mode 1

two booleans, both already on. we love a low-maintenance queen 🧚

🍓 MANAGED FILES 🍓

so the SELinux process type ptp4l_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. and heads up — the process's UID still needs to have DAC permissions. SELinux isn't gonna override DAC for you, that's not how this works 🙈

  • chronyd_tmpfs_t
  • cluster_conf_t
    • /etc/cluster(/.*)?
  • cluster_var_lib_t
    • /var/lib/pcsd(/.*)?
    • /var/lib/cluster(/.*)?
    • /var/lib/openais(/.*)?
    • /var/lib/pengine(/.*)?
    • /var/lib/corosync(/.*)?
    • /usr/lib/heartbeat(/.*)?
    • /var/lib/heartbeat(/.*)?
    • /var/lib/pacemaker(/.*)?
  • cluster_var_run_t
    • /run/crm(/.*)?
    • /run/cman_.*
    • /run/rsctmp(/.*)?
    • /run/aisexec.*
    • /run/heartbeat(/.*)?
    • /run/pcsd-ruby.socket
    • /run/corosync-qnetd(/.*)?
    • /run/corosync-qdevice(/.*)?
    • /run/pcsd.socket
    • /run/corosync.pid
    • /run/cpglockd.pid
    • /run/rgmanager.pid
    • /run/cluster/rgmanager.sk
  • gpsd_tmpfs_t
  • root_t
    • /sysroot/.aleph-version.json
    • /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
    • /
    • /initrd
    • /var/lib/ntp
  • timemaster_tmpfs_t
  • timemaster_var_run_t
    • /run/timemaster(/.*)?

look at all those. organised. gorgeous. no notes 🌈

🎀 FILE CONTEXTS 🎀

SELinux requires files to have an extended attribute to define the file type. yes, an extended attribute. it's the file's whole personality okay 😭

you can see the context of a file using the -Z option to ls.

policy governs the access confined processes have to these files. and again, the SELinux ptp4l policy is very flexible, allowing users to set up their ptp4l processes in as secure a method as possible. consistency is key bestie 💅

💫 STANDARD FILE CONTEXT 💫

SELinux defines the file context types for the ptp4l. so if you wanted to store files with these types in different paths, you'd need to execute the semanage command to specify alternate labeling, and then use restorecon to put the labels on disk. two-step process, very demure.

semanage fcontext -a -t ptp4l_exec_t '/srv/ptp4l/content(/.*)?'
restorecon -R -v /srv/myptp4l_content
Note: SELinux often uses regular expressions to specify labels that match multiple files. regex girlies rise 🧚‍♀️

the following file types are defined for ptp4l:

  • ptp4l_exec_t — set files with the ptp4l_exec_t type, if you want to transition an executable to the ptp4l_t domain.
  • ptp4l_unit_file_t — set files with the ptp4l_unit_file_t type, if you want to treat the files as ptp4l unit content.
Note: file context can be temporarily modified with the chcon command. but if you want to permanently change the file context you need to use the semanage fcontext command. this will modify the SELinux labeling database. and then you'll need to use restorecon to apply the labels. temporary vs permanent, know the difference bestie 💀

🔥 COMMANDS 🔥

here's the tool lineup, the whole crew:

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage boolean can also be used to manipulate the booleans.
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. yes, a GUI. for the visual learners 🎨

🌟 AUTHOR 🌟

this manual page was auto-generated using sepolicy manpage. no human wrote this, a script did, and honestly? it ate 🤖✨

🫶 SEE ALSO 🫶

selinux(8), ptp4l(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

like, go read those too. iykyk 💖

and that's the whole page, bestie! this one came from ptp4l, version 26-10-06 (dated ptp4l_selinux(8)), so shoutout to that exact moment in time for bringing us this masterpiece. periodt. 💅✨🍓

📦 where this page comes from