1slapd_selinux(8) SELinux Policy slapd slapd_selinux(8)
2
3
4
6 slapd_selinux - Security Enhanced Linux Policy for the slapd processes
7
9 Security-Enhanced Linux secures the slapd processes via flexible manda‐
10 tory access control.
11
12 The slapd processes execute with the slapd_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep slapd_t
19
20
21
23 The slapd_t SELinux type can be entered via the slapd_exec_t file type.
24
25 The default entrypoint paths for the slapd_t domain are the following:
26
27 /usr/lib/slapd, /usr/sbin/slapd, /usr/lib/openldap/slapd
28
30 SELinux defines process types (domains) for each process running on the
31 system
32
33 You can see the context of a process using the -Z option to ps
34
35 Policy governs the access confined processes have to files. SELinux
36 slapd policy is very flexible allowing users to setup their slapd pro‐
37 cesses in as secure a method as possible.
38
39 The following process types are defined for slapd:
40
41 slapd_t
42
43 Note: semanage permissive -a slapd_t can be used to make the process
44 type slapd_t permissive. SELinux does not deny access to permissive
45 process types, but the AVC (SELinux denials) messages are still gener‐
46 ated.
47
48
50 SELinux policy is customizable based on least access required. slapd
51 policy is extremely flexible and has several booleans that allow you to
52 manipulate the policy and run slapd with the tightest access possible.
53
54
55
56 If you want to allow all domains to execute in fips_mode, you must turn
57 on the fips_mode boolean. Enabled by default.
58
59 setsebool -P fips_mode 1
60
61
62
63 If you want to allow confined applications to run with kerberos, you
64 must turn on the kerberos_enabled boolean. Disabled by default.
65
66 setsebool -P kerberos_enabled 1
67
68
69
71 The SELinux process type slapd_t can manage files labeled with the fol‐
72 lowing file types. The paths listed are the default paths for these
73 file types. Note the processes UID still need to have DAC permissions.
74
75 auth_cache_t
76
77 /var/cache/coolkey(/.*)?
78
79 cluster_conf_t
80
81 /etc/cluster(/.*)?
82
83 cluster_var_lib_t
84
85 /var/lib/pcsd(/.*)?
86 /var/lib/cluster(/.*)?
87 /var/lib/openais(/.*)?
88 /var/lib/pengine(/.*)?
89 /var/lib/corosync(/.*)?
90 /usr/lib/heartbeat(/.*)?
91 /var/lib/heartbeat(/.*)?
92 /var/lib/pacemaker(/.*)?
93
94 cluster_var_run_t
95
96 /var/run/crm(/.*)?
97 /var/run/cman_.*
98 /var/run/rsctmp(/.*)?
99 /var/run/aisexec.*
100 /var/run/heartbeat(/.*)?
101 /var/run/corosync-qnetd(/.*)?
102 /var/run/corosync-qdevice(/.*)?
103 /var/run/corosync.pid
104 /var/run/cpglockd.pid
105 /var/run/rgmanager.pid
106 /var/run/cluster/rgmanager.sk
107
108 root_t
109
110 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
111 /
112 /initrd
113
114 security_t
115
116 /selinux
117
118 slapd_db_t
119
120 /var/lib/ldap(/.*)?
121 /etc/openldap/slapd.d(/.*)?
122 /var/lib/openldap-data(/.*)?
123 /var/lib/openldap-ldbm(/.*)?
124 /var/lib/openldap-slurpd(/.*)?
125
126 slapd_lock_t
127
128 /var/lock/subsys/ldap
129 /var/lock/subsys/slapd
130
131 slapd_log_t
132
133 /var/log/ldap.*
134 /var/log/slapd.*
135
136 slapd_replog_t
137
138 /var/lib/ldap/replog(/.*)?
139
140 slapd_tmpfs_t
141
142
143 slapd_var_run_t
144
145 /var/run/openldap(/.*)?
146 /var/run/ldapi
147 /var/run/slapd.pid
148 /var/run/slapd.args
149
150
152 SELinux requires files to have an extended attribute to define the file
153 type.
154
155 You can see the context of a file using the -Z option to ls
156
157 Policy governs the access confined processes have to these files.
158 SELinux slapd policy is very flexible allowing users to setup their
159 slapd processes in as secure a method as possible.
160
161 EQUIVALENCE DIRECTORIES
162
163
164 slapd policy stores data with multiple different file context types
165 under the /var/lib/ldap directory. If you would like to store the data
166 in a different directory you can use the semanage command to create an
167 equivalence mapping. If you wanted to store this data under the /srv
168 directory you would execute the following command:
169
170 semanage fcontext -a -e /var/lib/ldap /srv/ldap
171 restorecon -R -v /srv/ldap
172
173 STANDARD FILE CONTEXT
174
175 SELinux defines the file context types for the slapd, if you wanted to
176 store files with these types in a diffent paths, you need to execute
177 the semanage command to sepecify alternate labeling and then use
178 restorecon to put the labels on disk.
179
180 semanage fcontext -a -t slapd_var_run_t '/srv/myslapd_content(/.*)?'
181 restorecon -R -v /srv/myslapd_content
182
183 Note: SELinux often uses regular expressions to specify labels that
184 match multiple files.
185
186 The following file types are defined for slapd:
187
188
189
190 slapd_cert_t
191
192 - Set files with the slapd_cert_t type, if you want to treat the files
193 as slapd certificate data.
194
195
196
197 slapd_db_t
198
199 - Set files with the slapd_db_t type, if you want to treat the files as
200 slapd database content.
201
202
203 Paths:
204 /var/lib/ldap(/.*)?, /etc/openldap/slapd.d(/.*)?, /var/lib/openl‐
205 dap-data(/.*)?, /var/lib/openldap-ldbm(/.*)?, /var/lib/openldap-
206 slurpd(/.*)?
207
208
209 slapd_etc_t
210
211 - Set files with the slapd_etc_t type, if you want to store slapd files
212 in the /etc directories.
213
214
215
216 slapd_exec_t
217
218 - Set files with the slapd_exec_t type, if you want to transition an
219 executable to the slapd_t domain.
220
221
222 Paths:
223 /usr/lib/slapd, /usr/sbin/slapd, /usr/lib/openldap/slapd
224
225
226 slapd_initrc_exec_t
227
228 - Set files with the slapd_initrc_exec_t type, if you want to transi‐
229 tion an executable to the slapd_initrc_t domain.
230
231
232
233 slapd_keytab_t
234
235 - Set files with the slapd_keytab_t type, if you want to treat the
236 files as kerberos keytab files.
237
238
239
240 slapd_lock_t
241
242 - Set files with the slapd_lock_t type, if you want to treat the files
243 as slapd lock data, stored under the /var/lock directory
244
245
246 Paths:
247 /var/lock/subsys/ldap, /var/lock/subsys/slapd
248
249
250 slapd_log_t
251
252 - Set files with the slapd_log_t type, if you want to treat the data as
253 slapd log data, usually stored under the /var/log directory.
254
255
256 Paths:
257 /var/log/ldap.*, /var/log/slapd.*
258
259
260 slapd_replog_t
261
262 - Set files with the slapd_replog_t type, if you want to treat the
263 files as slapd replog data.
264
265
266
267 slapd_tmp_t
268
269 - Set files with the slapd_tmp_t type, if you want to store slapd tem‐
270 porary files in the /tmp directories.
271
272
273
274 slapd_tmpfs_t
275
276 - Set files with the slapd_tmpfs_t type, if you want to store slapd
277 files on a tmpfs file system.
278
279
280
281 slapd_unit_file_t
282
283 - Set files with the slapd_unit_file_t type, if you want to treat the
284 files as slapd unit content.
285
286
287
288 slapd_var_run_t
289
290 - Set files with the slapd_var_run_t type, if you want to store the
291 slapd files under the /run or /var/run directory.
292
293
294 Paths:
295 /var/run/openldap(/.*)?, /var/run/ldapi, /var/run/slapd.pid,
296 /var/run/slapd.args
297
298
299 Note: File context can be temporarily modified with the chcon command.
300 If you want to permanently change the file context you need to use the
301 semanage fcontext command. This will modify the SELinux labeling data‐
302 base. You will need to use restorecon to apply the labels.
303
304
306 semanage fcontext can also be used to manipulate default file context
307 mappings.
308
309 semanage permissive can also be used to manipulate whether or not a
310 process type is permissive.
311
312 semanage module can also be used to enable/disable/install/remove pol‐
313 icy modules.
314
315 semanage boolean can also be used to manipulate the booleans
316
317
318 system-config-selinux is a GUI tool available to customize SELinux pol‐
319 icy settings.
320
321
323 This manual page was auto-generated using sepolicy manpage .
324
325
327 selinux(8), slapd(8), semanage(8), restorecon(8), chcon(1), sepol‐
328 icy(8), setsebool(8)
329
330
331
332slapd 20-05-05 slapd_selinux(8)