# firewalld.lockdown-whitelist

firewalld.lockdown-whitelist

5

firewalld.lockdown-whitelist

firewalld lockdown whitelist configuration file

    /firewalld/lockdown-whitelists.xml

## Description

The firewalld lockdown-whitelist configuration file contains the selinux contexts, commands, users and user ids that are white-listed when firewalld lockdown feature is enabled (see

firewalld.conf

5 and

firewall-cmd

1).

This example configuration file shows the structure of an lockdown-whitelist file:

    <?xml version="1.0" encoding="utf-8"?>
    <whitelist>
      <selinux context="selinuxcontext"/>
      <command name="commandline[*]"/>
      <user {name="username|id="userid"}/>
    </whitelist>

## Options

The config can contain these tags and attributes. Some of them are mandatory, others optional.

### whitelist

The mandatory whitelist start and end tag defines the lockdown-whitelist. This tag can only be used once in a lockdown-whitelist configuration file. There are no attributes for this.

### selinux

Is an optional empty-element tag and can be used several times to have more than one selinux contexts entries. A selinux entry has exactly one attribute:

context="`string`"

- The context is the security (SELinux) context of a running application or service.

  To get the context of a running application use `ps -e --context` and search for the application that should be white-listed.

  Warning: If the context of an application is unconfined, then this will open access for more than the desired application.

### command

Is an optional empty-element tag and can be used several times to have more than one command entry. A command entry has exactly one attribute:

name="`string`"

- The command `string` is a complete command line including path and also attributes.

  If a command entry ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the absolute command inclusive arguments must match.

  Commands for user root and others is not always the same, the used path depends on the use of the `PATH` environment variable.

### user

Is an optional empty-element tag and can be used several times to white-list more than one user. A user entry has exactly one attribute of these:

name="`string`"

- The user with the name `string` will be white-listed.

id="`integer`"

- The user with the id `userid` will be white-listed.

&seealso; ¬es;