1named_selinux(8) SELinux Policy named named_selinux(8)
2
3
4
6 named_selinux - Security Enhanced Linux Policy for the named processes
7
9 Security-Enhanced Linux secures the named processes via flexible manda‐
10 tory access control.
11
12 The named processes execute with the named_t SELinux type. You can
13 check if you have these processes running by executing the ps command
14 with the -Z qualifier.
15
16 For example:
17
18 ps -eZ | grep named_t
19
20
21
23 The named_t SELinux type can be entered via the named_checkconf_exec_t,
24 named_exec_t file types.
25
26 The default entrypoint paths for the named_t domain are the following:
27
28 /usr/sbin/named-checkconf, /usr/sbin/named, /usr/sbin/lwresd,
29 /usr/sbin/unbound, /usr/sbin/named-sdb, /usr/sbin/named-pkcs11,
30 /usr/sbin/unbound-anchor, /usr/sbin/unbound-control, /usr/sbin/unbound-
31 checkconf
32
34 SELinux defines process types (domains) for each process running on the
35 system
36
37 You can see the context of a process using the -Z option to ps
38
39 Policy governs the access confined processes have to files. SELinux
40 named policy is very flexible allowing users to setup their named pro‐
41 cesses in as secure a method as possible.
42
43 The following process types are defined for named:
44
45 named_t
46
47 Note: semanage permissive -a named_t can be used to make the process
48 type named_t permissive. SELinux does not deny access to permissive
49 process types, but the AVC (SELinux denials) messages are still gener‐
50 ated.
51
52
54 SELinux policy is customizable based on least access required. named
55 policy is extremely flexible and has several booleans that allow you to
56 manipulate the policy and run named with the tightest access possible.
57
58
59
60 If you want to determine whether Bind can bind tcp socket to http
61 ports, you must turn on the named_tcp_bind_http_port boolean. Disabled
62 by default.
63
64 setsebool -P named_tcp_bind_http_port 1
65
66
67
68 If you want to determine whether Bind can write to master zone files.
69 Generally this is used for dynamic DNS or zone transfers, you must turn
70 on the named_write_master_zones boolean. Enabled by default.
71
72 setsebool -P named_write_master_zones 1
73
74
75
76 If you want to allow all domains to execute in fips_mode, you must turn
77 on the fips_mode boolean. Enabled by default.
78
79 setsebool -P fips_mode 1
80
81
82
84 The SELinux process type named_t can manage files labeled with the fol‐
85 lowing file types. The paths listed are the default paths for these
86 file types. Note the processes UID still need to have DAC permissions.
87
88 cluster_conf_t
89
90 /etc/cluster(/.*)?
91
92 cluster_var_lib_t
93
94 /var/lib/pcsd(/.*)?
95 /var/lib/cluster(/.*)?
96 /var/lib/openais(/.*)?
97 /var/lib/pengine(/.*)?
98 /var/lib/corosync(/.*)?
99 /usr/lib/heartbeat(/.*)?
100 /var/lib/heartbeat(/.*)?
101 /var/lib/pacemaker(/.*)?
102
103 cluster_var_run_t
104
105 /var/run/crm(/.*)?
106 /var/run/cman_.*
107 /var/run/rsctmp(/.*)?
108 /var/run/aisexec.*
109 /var/run/heartbeat(/.*)?
110 /var/run/pcsd-ruby.socket
111 /var/run/corosync-qnetd(/.*)?
112 /var/run/corosync-qdevice(/.*)?
113 /var/run/corosync.pid
114 /var/run/cpglockd.pid
115 /var/run/rgmanager.pid
116 /var/run/cluster/rgmanager.sk
117
118 dnssec_trigger_var_run_t
119
120 /var/run/dnssec.*
121
122 ipa_var_lib_t
123
124 /var/lib/ipa(/.*)?
125
126 krb5_host_rcache_t
127
128 /var/tmp/krb5_0.rcache2
129 /var/cache/krb5rcache(/.*)?
130 /var/tmp/nfs_0
131 /var/tmp/DNS_25
132 /var/tmp/host_0
133 /var/tmp/imap_0
134 /var/tmp/HTTP_23
135 /var/tmp/HTTP_48
136 /var/tmp/ldap_55
137 /var/tmp/ldap_487
138 /var/tmp/ldapmap1_0
139
140 krb5_keytab_t
141
142 /var/kerberos/krb5(/.*)?
143 /etc/krb5.keytab
144 /etc/krb5kdc/kadm5.keytab
145 /var/kerberos/krb5kdc/kadm5.keytab
146
147 named_cache_t
148
149 /var/named/data(/.*)?
150 /var/lib/softhsm(/.*)?
151 /var/lib/unbound(/.*)?
152 /var/named/slaves(/.*)?
153 /var/named/dynamic(/.*)?
154 /var/named/chroot/var/tmp(/.*)?
155 /var/named/chroot/var/named/data(/.*)?
156 /var/named/chroot/var/named/slaves(/.*)?
157 /var/named/chroot/var/named/dynamic(/.*)?
158
159 named_log_t
160
161 /var/log/named.*
162 /var/named/chroot/var/log/named.*
163
164 named_tmp_t
165
166
167 named_var_run_t
168
169 /var/run/bind(/.*)?
170 /var/run/named(/.*)?
171 /var/run/unbound(/.*)?
172 /var/named/chroot/run/named.*
173 /var/named/chroot/var/run/named.*
174 /var/run/ndc
175
176 root_t
177
178 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
179 /
180 /initrd
181
182
184 SELinux requires files to have an extended attribute to define the file
185 type.
186
187 You can see the context of a file using the -Z option to ls
188
189 Policy governs the access confined processes have to these files.
190 SELinux named policy is very flexible allowing users to setup their
191 named processes in as secure a method as possible.
192
193 EQUIVALENCE DIRECTORIES
194
195
196 named policy stores data with multiple different file context types un‐
197 der the /var/named directory. If you would like to store the data in a
198 different directory you can use the semanage command to create an
199 equivalence mapping. If you wanted to store this data under the /srv
200 directory you would execute the following command:
201
202 semanage fcontext -a -e /var/named /srv/named
203 restorecon -R -v /srv/named
204
205 STANDARD FILE CONTEXT
206
207 SELinux defines the file context types for the named, if you wanted to
208 store files with these types in a diffent paths, you need to execute
209 the semanage command to sepecify alternate labeling and then use re‐
210 storecon to put the labels on disk.
211
212 semanage fcontext -a -t named_zone_t '/srv/mynamed_content(/.*)?'
213 restorecon -R -v /srv/mynamed_content
214
215 Note: SELinux often uses regular expressions to specify labels that
216 match multiple files.
217
218 The following file types are defined for named:
219
220
221
222 named_cache_t
223
224 - Set files with the named_cache_t type, if you want to store the files
225 under the /var/cache directory.
226
227
228 Paths:
229 /var/named/data(/.*)?, /var/lib/softhsm(/.*)?, /var/lib/un‐
230 bound(/.*)?, /var/named/slaves(/.*)?, /var/named/dynamic(/.*)?,
231 /var/named/chroot/var/tmp(/.*)?, /var/named/ch‐
232 root/var/named/data(/.*)?, /var/named/ch‐
233 root/var/named/slaves(/.*)?, /var/named/chroot/var/named/dy‐
234 namic(/.*)?
235
236
237 named_checkconf_exec_t
238
239 - Set files with the named_checkconf_exec_t type, if you want to tran‐
240 sition an executable to the named_checkconf_t domain.
241
242
243
244 named_conf_t
245
246 - Set files with the named_conf_t type, if you want to treat the files
247 as named configuration data, usually stored under the /etc directory.
248
249
250 Paths:
251 /etc/rndc.*, /etc/named(/.*)?, /etc/unbound(/.*)?, /var/named/ch‐
252 root(/.*)?, /etc/named.rfc1912.zones, /var/named/ch‐
253 root/etc/named.rfc1912.zones, /etc/named.conf,
254 /var/named/named.ca, /etc/named.root.hints, /var/named/ch‐
255 root/etc/named.conf, /etc/named.caching-nameserver.conf,
256 /var/named/chroot/var/named/named.ca, /var/named/ch‐
257 root/etc/named.root.hints, /var/named/chroot/etc/named.caching-
258 nameserver.conf
259
260
261 named_exec_t
262
263 - Set files with the named_exec_t type, if you want to transition an
264 executable to the named_t domain.
265
266
267 Paths:
268 /usr/sbin/named, /usr/sbin/lwresd, /usr/sbin/unbound,
269 /usr/sbin/named-sdb, /usr/sbin/named-pkcs11, /usr/sbin/unbound-an‐
270 chor, /usr/sbin/unbound-control, /usr/sbin/unbound-checkconf
271
272
273 named_initrc_exec_t
274
275 - Set files with the named_initrc_exec_t type, if you want to transi‐
276 tion an executable to the named_initrc_t domain.
277
278
279 Paths:
280 /etc/rc.d/init.d/named, /etc/rc.d/init.d/unbound,
281 /etc/rc.d/init.d/named-sdb
282
283
284 named_keytab_t
285
286 - Set files with the named_keytab_t type, if you want to treat the
287 files as kerberos keytab files.
288
289
290
291 named_log_t
292
293 - Set files with the named_log_t type, if you want to treat the data as
294 named log data, usually stored under the /var/log directory.
295
296
297 Paths:
298 /var/log/named.*, /var/named/chroot/var/log/named.*
299
300
301 named_tmp_t
302
303 - Set files with the named_tmp_t type, if you want to store named tem‐
304 porary files in the /tmp directories.
305
306
307
308 named_unit_file_t
309
310 - Set files with the named_unit_file_t type, if you want to treat the
311 files as named unit content.
312
313
314 Paths:
315 /usr/lib/systemd/system/named.*, /usr/lib/systemd/system/un‐
316 bound.*, /usr/lib/systemd/system/named-sdb.*
317
318
319 named_var_run_t
320
321 - Set files with the named_var_run_t type, if you want to store the
322 named files under the /run or /var/run directory.
323
324
325 Paths:
326 /var/run/bind(/.*)?, /var/run/named(/.*)?, /var/run/unbound(/.*)?,
327 /var/named/chroot/run/named.*, /var/named/chroot/var/run/named.*,
328 /var/run/ndc
329
330
331 named_zone_t
332
333 - Set files with the named_zone_t type, if you want to treat the files
334 as named zone data.
335
336
337 Paths:
338 /var/named(/.*)?, /var/named/chroot/var/named(/.*)?
339
340
341 Note: File context can be temporarily modified with the chcon command.
342 If you want to permanently change the file context you need to use the
343 semanage fcontext command. This will modify the SELinux labeling data‐
344 base. You will need to use restorecon to apply the labels.
345
346
348 semanage fcontext can also be used to manipulate default file context
349 mappings.
350
351 semanage permissive can also be used to manipulate whether or not a
352 process type is permissive.
353
354 semanage module can also be used to enable/disable/install/remove pol‐
355 icy modules.
356
357 semanage boolean can also be used to manipulate the booleans
358
359
360 system-config-selinux is a GUI tool available to customize SELinux pol‐
361 icy settings.
362
363
365 This manual page was auto-generated using sepolicy manpage .
366
367
369 selinux(8), named(8), semanage(8), restorecon(8), chcon(1), sepol‐
370 icy(8), setsebool(8)
371
372
373
374named 21-06-09 named_selinux(8)