1dirsrv_selinux(8)            SELinux Policy dirsrv           dirsrv_selinux(8)
2
3
4

NAME

6       dirsrv_selinux  -  Security  Enhanced  Linux Policy for the dirsrv pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  dirsrv  processes  via  flexible
11       mandatory access control.
12
13       The  dirsrv  processes  execute with the dirsrv_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep dirsrv_t
20
21
22

ENTRYPOINTS

24       The  dirsrv_t  SELinux  type  can be entered via the dirsrv_exec_t file
25       type.
26
27       The default entrypoint paths for the dirsrv_t domain are the following:
28
29       /usr/sbin/ns-slapd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       dirsrv policy is very flexible allowing users  to  setup  their  dirsrv
39       processes in as secure a method as possible.
40
41       The following process types are defined for dirsrv:
42
43       dirsrv_t, dirsrv_snmp_t, dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
44
45       Note:  semanage  permissive -a dirsrv_t can be used to make the process
46       type dirsrv_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   dirsrv
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run dirsrv with the tightest access possible.
55
56
57
58       If you want to allow confined applications to run  with  kerberos,  you
59       must turn on the kerberos_enabled boolean. Disabled by default.
60
61       setsebool -P kerberos_enabled 1
62
63
64

MANAGED FILES

66       The  SELinux  process  type  dirsrv_t can manage files labeled with the
67       following file types.  The paths listed are the default paths for these
68       file types.  Note the processes UID still need to have DAC permissions.
69
70       cluster_conf_t
71
72            /etc/cluster(/.*)?
73
74       cluster_var_lib_t
75
76            /var/lib/pcsd(/.*)?
77            /var/lib/cluster(/.*)?
78            /var/lib/openais(/.*)?
79            /var/lib/pengine(/.*)?
80            /var/lib/corosync(/.*)?
81            /usr/lib/heartbeat(/.*)?
82            /var/lib/heartbeat(/.*)?
83            /var/lib/pacemaker(/.*)?
84
85       cluster_var_run_t
86
87            /var/run/crm(/.*)?
88            /var/run/cman_.*
89            /var/run/rsctmp(/.*)?
90            /var/run/aisexec.*
91            /var/run/heartbeat(/.*)?
92            /var/run/corosync-qnetd(/.*)?
93            /var/run/corosync-qdevice(/.*)?
94            /var/run/corosync.pid
95            /var/run/cpglockd.pid
96            /var/run/rgmanager.pid
97            /var/run/cluster/rgmanager.sk
98
99       dirsrv_config_t
100
101            /etc/dirsrv(/.*)?
102
103       dirsrv_tmpfs_t
104
105            /dev/shm/dirsrv(/.*)?
106
107       dirsrv_var_lib_t
108
109            /var/lib/dirsrv(/.*)?
110
111       dirsrv_var_lock_t
112
113            /var/lock/dirsrv(/.*)?
114
115       dirsrv_var_log_t
116
117            /var/log/dirsrv(/.*)?
118
119       dirsrv_var_run_t
120
121            /var/run/slapd.*
122            /var/run/dirsrv(/.*)?
123
124       faillog_t
125
126            /var/log/btmp.*
127            /var/log/faillog.*
128            /var/log/tallylog.*
129            /var/run/faillock(/.*)?
130
131       lastlog_t
132
133            /var/log/lastlog.*
134
135       root_t
136
137            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
138            /
139            /initrd
140
141       security_t
142
143            /selinux
144
145       systemd_passwd_var_run_t
146
147            /var/run/systemd/ask-password(/.*)?
148            /var/run/systemd/ask-password-block(/.*)?
149
150

FILE CONTEXTS

152       SELinux requires files to have an extended attribute to define the file
153       type.
154
155       You can see the context of a file using the -Z option to ls
156
157       Policy governs the access  confined  processes  have  to  these  files.
158       SELinux  dirsrv  policy  is very flexible allowing users to setup their
159       dirsrv processes in as secure a method as possible.
160
161       EQUIVALENCE DIRECTORIES
162
163
164       dirsrv policy stores data with multiple different  file  context  types
165       under  the  /var/log/dirsrv  directory.  If you would like to store the
166       data in a different directory you can use the semanage command to  cre‐
167       ate an equivalence mapping.  If you wanted to store this data under the
168       /srv directory you would execute the following command:
169
170       semanage fcontext -a -e /var/log/dirsrv /srv/dirsrv
171       restorecon -R -v /srv/dirsrv
172
173       STANDARD FILE CONTEXT
174
175       SELinux defines the file context types for the dirsrv, if you wanted to
176       store  files  with  these types in a diffent paths, you need to execute
177       the semanage command  to  sepecify  alternate  labeling  and  then  use
178       restorecon to put the labels on disk.
179
180       semanage  fcontext  -a  -t dirsrvadmin_ra_content_t '/srv/mydirsrv_con‐
181       tent(/.*)?'
182       restorecon -R -v /srv/mydirsrv_content
183
184       Note: SELinux often uses regular expressions  to  specify  labels  that
185       match multiple files.
186
187       The following file types are defined for dirsrv:
188
189
190
191       dirsrv_config_t
192
193       -  Set  files  with  the dirsrv_config_t type, if you want to treat the
194       files as dirsrv configuration  data,  usually  stored  under  the  /etc
195       directory.
196
197
198
199       dirsrv_exec_t
200
201       -  Set  files with the dirsrv_exec_t type, if you want to transition an
202       executable to the dirsrv_t domain.
203
204
205
206       dirsrv_share_t
207
208       - Set files with the dirsrv_share_t type, if  you  want  to  treat  the
209       files as dirsrv share data.
210
211
212
213       dirsrv_snmp_exec_t
214
215       - Set files with the dirsrv_snmp_exec_t type, if you want to transition
216       an executable to the dirsrv_snmp_t domain.
217
218
219       Paths:
220            /usr/sbin/ldap-agent, /usr/sbin/ldap-agent-bin
221
222
223       dirsrv_snmp_var_log_t
224
225       - Set files with the dirsrv_snmp_var_log_t type, if you want  to  treat
226       the data as dirsrv snmp var log data, usually stored under the /var/log
227       directory.
228
229
230
231       dirsrv_snmp_var_run_t
232
233       - Set files with the dirsrv_snmp_var_run_t type, if you want  to  store
234       the dirsrv snmp files under the /run or /var/run directory.
235
236
237
238       dirsrv_tmp_t
239
240       -  Set  files  with  the dirsrv_tmp_t type, if you want to store dirsrv
241       temporary files in the /tmp directories.
242
243
244
245       dirsrv_tmpfs_t
246
247       - Set files with the dirsrv_tmpfs_t type, if you want to  store  dirsrv
248       files on a tmpfs file system.
249
250
251
252       dirsrv_var_lib_t
253
254       -  Set  files  with the dirsrv_var_lib_t type, if you want to store the
255       dirsrv files under the /var/lib directory.
256
257
258
259       dirsrv_var_lock_t
260
261       - Set files with the dirsrv_var_lock_t type, if you want to  treat  the
262       files as dirsrv var lock data, stored under the /var/lock directory
263
264
265
266       dirsrv_var_log_t
267
268       -  Set  files  with the dirsrv_var_log_t type, if you want to treat the
269       data as dirsrv var log data, usually stored under the  /var/log  direc‐
270       tory.
271
272
273
274       dirsrv_var_run_t
275
276       -  Set  files  with the dirsrv_var_run_t type, if you want to store the
277       dirsrv files under the /run or /var/run directory.
278
279
280       Paths:
281            /var/run/slapd.*, /var/run/dirsrv(/.*)?
282
283
284       dirsrvadmin_config_t
285
286       - Set files with the dirsrvadmin_config_t type, if you  want  to  treat
287       the  files  as dirsrvadmin configuration data, usually stored under the
288       /etc directory.
289
290
291       Paths:
292            /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
293
294
295       dirsrvadmin_content_t
296
297       - Set files with the dirsrvadmin_content_t type, if you want  to  treat
298       the files as dirsrvadmin content.
299
300
301
302       dirsrvadmin_exec_t
303
304       - Set files with the dirsrvadmin_exec_t type, if you want to transition
305       an executable to the dirsrvadmin_t domain.
306
307
308       Paths:
309            /usr/sbin/stop-ds-admin,                 /usr/sbin/start-ds-admin,
310            /usr/sbin/restart-ds-admin
311
312
313       dirsrvadmin_htaccess_t
314
315       -  Set files with the dirsrvadmin_htaccess_t type, if you want to treat
316       the file as a dirsrvadmin access file.
317
318
319
320       dirsrvadmin_lock_t
321
322       - Set files with the dirsrvadmin_lock_t type, if you want to treat  the
323       files as dirsrvadmin lock data, stored under the /var/lock directory
324
325
326
327       dirsrvadmin_ra_content_t
328
329       -  Set  files  with  the  dirsrvadmin_ra_content_t type, if you want to
330       treat the files as dirsrvadmin read/append content.
331
332
333
334       dirsrvadmin_rw_content_t
335
336       - Set files with the dirsrvadmin_rw_content_t  type,  if  you  want  to
337       treat the files as dirsrvadmin read/write content.
338
339
340
341       dirsrvadmin_script_exec_t
342
343       -  Set  files  with  the dirsrvadmin_script_exec_t type, if you want to
344       transition an executable to the dirsrvadmin_script_t domain.
345
346
347       Paths:
348            /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
349
350
351       dirsrvadmin_tmp_t
352
353       - Set files with the dirsrvadmin_tmp_t  type,  if  you  want  to  store
354       dirsrvadmin temporary files in the /tmp directories.
355
356
357
358       dirsrvadmin_unconfined_script_exec_t
359
360       -  Set files with the dirsrvadmin_unconfined_script_exec_t type, if you
361       want to transition an executable to the dirsrvadmin_unconfined_script_t
362       domain.
363
364
365       Paths:
366            /usr/lib/dirsrv/cgi-bin/ds_create,            /usr/lib/dirsrv/cgi-
367            bin/ds_remove
368
369
370       dirsrvadmin_unit_file_t
371
372       - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
373       the files as dirsrvadmin unit content.
374
375
376
377       Note:  File context can be temporarily modified with the chcon command.
378       If you want to permanently change the file context you need to use  the
379       semanage fcontext command.  This will modify the SELinux labeling data‐
380       base.  You will need to use restorecon to apply the labels.
381
382

COMMANDS

384       semanage fcontext can also be used to manipulate default  file  context
385       mappings.
386
387       semanage  permissive  can  also  be used to manipulate whether or not a
388       process type is permissive.
389
390       semanage module can also be used to enable/disable/install/remove  pol‐
391       icy modules.
392
393       semanage boolean can also be used to manipulate the booleans
394
395
396       system-config-selinux is a GUI tool available to customize SELinux pol‐
397       icy settings.
398
399

AUTHOR

401       This manual page was auto-generated using sepolicy manpage .
402
403

SEE ALSO

405       selinux(8), dirsrv(8),  semanage(8),  restorecon(8),  chcon(1),  sepol‐
406       icy(8), setsebool(8), dirsrv_snmp_selinux(8), dirsrv_snmp_selinux(8)
407
408
409
410dirsrv                             20-05-05                  dirsrv_selinux(8)
Impressum