dirsrv_selinux(8)

1dirsrv_selinux(8)            SELinux Policy dirsrv           dirsrv_selinux(8)
2
3
4

NAME

6       dirsrv_selinux  -  Security  Enhanced  Linux Policy for the dirsrv pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  dirsrv  processes  via  flexible
11       mandatory access control.
12
13       The  dirsrv  processes  execute with the dirsrv_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep dirsrv_t
20
21
22

ENTRYPOINTS

24       The  dirsrv_t  SELinux  type  can be entered via the dirsrv_exec_t file
25       type.
26
27       The default entrypoint paths for the dirsrv_t domain are the following:
28
29       /usr/sbin/ns-slapd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       dirsrv policy is very flexible allowing users  to  setup  their  dirsrv
39       processes in as secure a method as possible.
40
41       The following process types are defined for dirsrv:
42
43       dirsrv_t, dirsrv_snmp_t, dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
44
45       Note:  semanage  permissive -a dirsrv_t can be used to make the process
46       type dirsrv_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   dirsrv
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run dirsrv with the tightest access possible.
55
56
57
58       If you want to allow confined applications to run  with  kerberos,  you
59       must turn on the kerberos_enabled boolean. Disabled by default.
60
61       setsebool -P kerberos_enabled 1
62
63
64

MANAGED FILES

66       The  SELinux  process  type  dirsrv_t can manage files labeled with the
67       following file types.  The paths listed are the default paths for these
68       file types.  Note the processes UID still need to have DAC permissions.
69
70       cluster_conf_t
71
72            /etc/cluster(/.*)?
73
74       cluster_var_lib_t
75
76            /var/lib/pcsd(/.*)?
77            /var/lib/cluster(/.*)?
78            /var/lib/openais(/.*)?
79            /var/lib/pengine(/.*)?
80            /var/lib/corosync(/.*)?
81            /usr/lib/heartbeat(/.*)?
82            /var/lib/heartbeat(/.*)?
83            /var/lib/pacemaker(/.*)?
84
85       cluster_var_run_t
86
87            /var/run/crm(/.*)?
88            /var/run/cman_.*
89            /var/run/rsctmp(/.*)?
90            /var/run/aisexec.*
91            /var/run/heartbeat(/.*)?
92            /var/run/corosync-qnetd(/.*)?
93            /var/run/corosync-qdevice(/.*)?
94            /var/run/corosync.pid
95            /var/run/cpglockd.pid
96            /var/run/rgmanager.pid
97            /var/run/cluster/rgmanager.sk
98
99       dirsrv_config_t
100
101            /etc/dirsrv(/.*)?
102
103       dirsrv_tmpfs_t
104
105            /dev/shm/dirsrv(/.*)?
106
107       dirsrv_var_lib_t
108
109            /var/lib/dirsrv(/.*)?
110
111       dirsrv_var_lock_t
112
113            /var/lock/dirsrv(/.*)?
114
115       dirsrv_var_log_t
116
117            /var/log/dirsrv(/.*)?
118
119       dirsrv_var_run_t
120
121            /var/run/slapd.*
122            /var/run/dirsrv(/.*)?
123
124       faillog_t
125
126            /var/log/btmp.*
127            /var/log/faillog.*
128            /var/log/tallylog.*
129            /var/run/faillock(/.*)?
130
131       lastlog_t
132
133            /var/log/lastlog.*
134
135       root_t
136
137            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
138            /
139            /initrd
140
141       security_t
142
143            /selinux
144
145       systemd_passwd_var_run_t
146
147            /var/run/systemd/ask-password(/.*)?
148            /var/run/systemd/ask-password-block(/.*)?
149
150

FILE CONTEXTS

152       SELinux requires files to have an extended attribute to define the file
153       type.
154
155       You can see the context of a file using the -Z option to ls
156
157       Policy governs the access  confined  processes  have  to  these  files.
158       SELinux  dirsrv  policy  is very flexible allowing users to setup their
159       dirsrv processes in as secure a method as possible.
160
161       EQUIVALENCE DIRECTORIES
162
163
164       dirsrv policy stores data with multiple different  file  context  types
165       under  the  /var/log/dirsrv  directory.  If you would like to store the
166       data in a different directory you can use the semanage command to  cre‐
167       ate an equivalence mapping.  If you wanted to store this data under the
168       /srv directory you would execute the following command:
169
170       semanage fcontext -a -e /var/log/dirsrv /srv/dirsrv
171       restorecon -R -v /srv/dirsrv
172
173       STANDARD FILE CONTEXT
174
175       SELinux defines the file context types for the dirsrv, if you wanted to
176       store  files  with  these types in a diffent paths, you need to execute
177       the semanage command  to  sepecify  alternate  labeling  and  then  use
178       restorecon to put the labels on disk.
179
180       semanage  fcontext  -a  -t dirsrvadmin_ra_content_t '/srv/mydirsrv_con‐
181       tent(/.*)?'
182       restorecon -R -v /srv/mydirsrv_content
183
184       Note: SELinux often uses regular expressions  to  specify  labels  that
185       match multiple files.
186
187       The following file types are defined for dirsrv:
188
189
190
191       dirsrv_config_t
192
193       -  Set  files  with  the dirsrv_config_t type, if you want to treat the
194       files as dirsrv configuration  data,  usually  stored  under  the  /etc
195       directory.
196
197
198
199       dirsrv_exec_t
200
201       -  Set  files with the dirsrv_exec_t type, if you want to transition an
202       executable to the dirsrv_t domain.
203
204
205
206       dirsrv_share_t
207
208       - Set files with the dirsrv_share_t type, if  you  want  to  treat  the
209       files as dirsrv share data.
210
211
212
213       dirsrv_snmp_exec_t
214
215       - Set files with the dirsrv_snmp_exec_t type, if you want to transition
216       an executable to the dirsrv_snmp_t domain.
217
218
219       Paths:
220            /usr/sbin/ldap-agent, /usr/sbin/ldap-agent-bin
221
222
223       dirsrv_snmp_var_log_t
224
225       - Set files with the dirsrv_snmp_var_log_t type, if you want  to  treat
226       the data as dirsrv snmp var log data, usually stored under the /var/log
227       directory.
228
229
230
231       dirsrv_snmp_var_run_t
232
233       - Set files with the dirsrv_snmp_var_run_t type, if you want  to  store
234       the dirsrv snmp files under the /run or /var/run directory.
235
236
237
238       dirsrv_tmp_t
239
240       -  Set  files  with  the dirsrv_tmp_t type, if you want to store dirsrv
241       temporary files in the /tmp directories.
242
243
244
245       dirsrv_tmpfs_t
246
247       - Set files with the dirsrv_tmpfs_t type, if you want to  store  dirsrv
248       files on a tmpfs file system.
249
250
251
252       dirsrv_unit_file_t
253
254       -  Set files with the dirsrv_unit_file_t type, if you want to treat the
255       files as dirsrv unit content.
256
257
258
259       dirsrv_var_lib_t
260
261       - Set files with the dirsrv_var_lib_t type, if you want  to  store  the
262       dirsrv files under the /var/lib directory.
263
264
265
266       dirsrv_var_lock_t
267
268       -  Set  files with the dirsrv_var_lock_t type, if you want to treat the
269       files as dirsrv var lock data, stored under the /var/lock directory
270
271
272
273       dirsrv_var_log_t
274
275       - Set files with the dirsrv_var_log_t type, if you want  to  treat  the
276       data  as  dirsrv var log data, usually stored under the /var/log direc‐
277       tory.
278
279
280
281       dirsrv_var_run_t
282
283       - Set files with the dirsrv_var_run_t type, if you want  to  store  the
284       dirsrv files under the /run or /var/run directory.
285
286
287       Paths:
288            /var/run/slapd.*, /var/run/dirsrv(/.*)?
289
290
291       dirsrvadmin_config_t
292
293       -  Set  files  with the dirsrvadmin_config_t type, if you want to treat
294       the files as dirsrvadmin configuration data, usually stored  under  the
295       /etc directory.
296
297
298       Paths:
299            /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
300
301
302       dirsrvadmin_content_t
303
304       -  Set  files with the dirsrvadmin_content_t type, if you want to treat
305       the files as dirsrvadmin content.
306
307
308
309       dirsrvadmin_exec_t
310
311       - Set files with the dirsrvadmin_exec_t type, if you want to transition
312       an executable to the dirsrvadmin_t domain.
313
314
315       Paths:
316            /usr/sbin/stop-ds-admin,                 /usr/sbin/start-ds-admin,
317            /usr/sbin/restart-ds-admin
318
319
320       dirsrvadmin_htaccess_t
321
322       - Set files with the dirsrvadmin_htaccess_t type, if you want to  treat
323       the file as a dirsrvadmin access file.
324
325
326
327       dirsrvadmin_lock_t
328
329       -  Set files with the dirsrvadmin_lock_t type, if you want to treat the
330       files as dirsrvadmin lock data, stored under the /var/lock directory
331
332
333
334       dirsrvadmin_ra_content_t
335
336       - Set files with the dirsrvadmin_ra_content_t  type,  if  you  want  to
337       treat the files as dirsrvadmin read/append content.
338
339
340
341       dirsrvadmin_rw_content_t
342
343       -  Set  files  with  the  dirsrvadmin_rw_content_t type, if you want to
344       treat the files as dirsrvadmin read/write content.
345
346
347
348       dirsrvadmin_script_exec_t
349
350       - Set files with the dirsrvadmin_script_exec_t type,  if  you  want  to
351       transition an executable to the dirsrvadmin_script_t domain.
352
353
354       Paths:
355            /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
356
357
358       dirsrvadmin_tmp_t
359
360       -  Set  files  with  the  dirsrvadmin_tmp_t  type, if you want to store
361       dirsrvadmin temporary files in the /tmp directories.
362
363
364
365       dirsrvadmin_unconfined_script_exec_t
366
367       - Set files with the dirsrvadmin_unconfined_script_exec_t type, if  you
368       want to transition an executable to the dirsrvadmin_unconfined_script_t
369       domain.
370
371
372       Paths:
373            /usr/lib/dirsrv/cgi-bin/ds_create,            /usr/lib/dirsrv/cgi-
374            bin/ds_remove
375
376
377       dirsrvadmin_unit_file_t
378
379       - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
380       the files as dirsrvadmin unit content.
381
382
383
384       Note: File context can be temporarily modified with the chcon  command.
385       If  you want to permanently change the file context you need to use the
386       semanage fcontext command.  This will modify the SELinux labeling data‐
387       base.  You will need to use restorecon to apply the labels.
388
389

COMMANDS

391       semanage  fcontext  can also be used to manipulate default file context
392       mappings.
393
394       semanage permissive can also be used to manipulate  whether  or  not  a
395       process type is permissive.
396
397       semanage  module can also be used to enable/disable/install/remove pol‐
398       icy modules.
399
400       semanage boolean can also be used to manipulate the booleans
401
402
403       system-config-selinux is a GUI tool available to customize SELinux pol‐
404       icy settings.
405
406

AUTHOR

408       This manual page was auto-generated using sepolicy manpage .
409
410