1dirsrv_selinux(8) SELinux Policy dirsrv dirsrv_selinux(8)
2
3
4
6 dirsrv_selinux - Security Enhanced Linux Policy for the dirsrv pro‐
7 cesses
8
10 Security-Enhanced Linux secures the dirsrv processes via flexible
11 mandatory access control.
12
13 The dirsrv processes execute with the dirsrv_t SELinux type. You can
14 check if you have these processes running by executing the ps command
15 with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep dirsrv_t
20
21
22
24 The dirsrv_t SELinux type can be entered via the dirsrv_exec_t file
25 type.
26
27 The default entrypoint paths for the dirsrv_t domain are the following:
28
29 /usr/sbin/ns-slapd
30
32 SELinux defines process types (domains) for each process running on the
33 system
34
35 You can see the context of a process using the -Z option to ps
36
37 Policy governs the access confined processes have to files. SELinux
38 dirsrv policy is very flexible allowing users to setup their dirsrv
39 processes in as secure a method as possible.
40
41 The following process types are defined for dirsrv:
42
43 dirsrv_t, dirsrv_snmp_t, dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
44
45 Note: semanage permissive -a dirsrv_t can be used to make the process
46 type dirsrv_t permissive. SELinux does not deny access to permissive
47 process types, but the AVC (SELinux denials) messages are still gener‐
48 ated.
49
50
52 SELinux policy is customizable based on least access required. dirsrv
53 policy is extremely flexible and has several booleans that allow you to
54 manipulate the policy and run dirsrv with the tightest access possible.
55
56
57
58 If you want to allow confined applications to run with kerberos, you
59 must turn on the kerberos_enabled boolean. Enabled by default.
60
61 setsebool -P kerberos_enabled 1
62
63
64
66 The SELinux process type dirsrv_t can manage files labeled with the
67 following file types. The paths listed are the default paths for these
68 file types. Note the processes UID still need to have DAC permissions.
69
70 cluster_conf_t
71
72 /etc/cluster(/.*)?
73
74 cluster_var_lib_t
75
76 /var/lib/pcsd(/.*)?
77 /var/lib/cluster(/.*)?
78 /var/lib/openais(/.*)?
79 /var/lib/pengine(/.*)?
80 /var/lib/corosync(/.*)?
81 /usr/lib/heartbeat(/.*)?
82 /var/lib/heartbeat(/.*)?
83 /var/lib/pacemaker(/.*)?
84
85 cluster_var_run_t
86
87 /var/run/crm(/.*)?
88 /var/run/cman_.*
89 /var/run/rsctmp(/.*)?
90 /var/run/aisexec.*
91 /var/run/heartbeat(/.*)?
92 /var/run/pcsd-ruby.socket
93 /var/run/corosync-qnetd(/.*)?
94 /var/run/corosync-qdevice(/.*)?
95 /var/run/corosync.pid
96 /var/run/cpglockd.pid
97 /var/run/rgmanager.pid
98 /var/run/cluster/rgmanager.sk
99
100 dirsrv_config_t
101
102 /etc/dirsrv(/.*)?
103
104 dirsrv_tmp_t
105
106
107 dirsrv_tmpfs_t
108
109 /dev/shm/slapd-.*
110
111 dirsrv_var_lib_t
112
113 /var/lib/dirsrv(/.*)?
114
115 dirsrv_var_lock_t
116
117 /var/lock/dirsrv(/.*)?
118
119 dirsrv_var_log_t
120
121 /var/log/dirsrv(/.*)?
122
123 dirsrv_var_run_t
124
125 /var/run/slapd.*
126 /var/run/dirsrv(/.*)?
127
128 faillog_t
129
130 /var/log/btmp.*
131 /var/log/faillog.*
132 /var/log/tallylog.*
133 /var/run/faillock(/.*)?
134
135 krb5_host_rcache_t
136
137 /var/tmp/krb5_0.rcache2
138 /var/cache/krb5rcache(/.*)?
139 /var/tmp/nfs_0
140 /var/tmp/DNS_25
141 /var/tmp/host_0
142 /var/tmp/imap_0
143 /var/tmp/HTTP_23
144 /var/tmp/HTTP_48
145 /var/tmp/ldap_55
146 /var/tmp/ldap_487
147 /var/tmp/ldapmap1_0
148
149 lastlog_t
150
151 /var/log/lastlog.*
152
153 root_t
154
155 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
156 /
157 /initrd
158
159 security_t
160
161 /selinux
162
163 systemd_passwd_var_run_t
164
165 /var/run/systemd/ask-password(/.*)?
166 /var/run/systemd/ask-password-block(/.*)?
167
168
170 SELinux requires files to have an extended attribute to define the file
171 type.
172
173 You can see the context of a file using the -Z option to ls
174
175 Policy governs the access confined processes have to these files.
176 SELinux dirsrv policy is very flexible allowing users to setup their
177 dirsrv processes in as secure a method as possible.
178
179 EQUIVALENCE DIRECTORIES
180
181
182 dirsrv policy stores data with multiple different file context types
183 under the /var/log/dirsrv directory. If you would like to store the
184 data in a different directory you can use the semanage command to cre‐
185 ate an equivalence mapping. If you wanted to store this data under the
186 /srv directory you would execute the following command:
187
188 semanage fcontext -a -e /var/log/dirsrv /srv/dirsrv
189 restorecon -R -v /srv/dirsrv
190
191 STANDARD FILE CONTEXT
192
193 SELinux defines the file context types for the dirsrv, if you wanted to
194 store files with these types in a diffent paths, you need to execute
195 the semanage command to specify alternate labeling and then use re‐
196 storecon to put the labels on disk.
197
198 semanage fcontext -a -t dirsrvadmin_ra_content_t '/srv/mydirsrv_con‐
199 tent(/.*)?'
200 restorecon -R -v /srv/mydirsrv_content
201
202 Note: SELinux often uses regular expressions to specify labels that
203 match multiple files.
204
205 The following file types are defined for dirsrv:
206
207
208
209 dirsrv_config_t
210
211 - Set files with the dirsrv_config_t type, if you want to treat the
212 files as dirsrv configuration data, usually stored under the /etc di‐
213 rectory.
214
215
216
217 dirsrv_exec_t
218
219 - Set files with the dirsrv_exec_t type, if you want to transition an
220 executable to the dirsrv_t domain.
221
222
223
224 dirsrv_share_t
225
226 - Set files with the dirsrv_share_t type, if you want to treat the
227 files as dirsrv share data.
228
229
230
231 dirsrv_snmp_exec_t
232
233 - Set files with the dirsrv_snmp_exec_t type, if you want to transition
234 an executable to the dirsrv_snmp_t domain.
235
236
237 Paths:
238 /usr/sbin/ldap-agent, /usr/sbin/ldap-agent-bin
239
240
241 dirsrv_snmp_var_log_t
242
243 - Set files with the dirsrv_snmp_var_log_t type, if you want to treat
244 the data as dirsrv snmp var log data, usually stored under the /var/log
245 directory.
246
247
248
249 dirsrv_snmp_var_run_t
250
251 - Set files with the dirsrv_snmp_var_run_t type, if you want to store
252 the dirsrv snmp files under the /run or /var/run directory.
253
254
255
256 dirsrv_tmp_t
257
258 - Set files with the dirsrv_tmp_t type, if you want to store dirsrv
259 temporary files in the /tmp directories.
260
261
262
263 dirsrv_tmpfs_t
264
265 - Set files with the dirsrv_tmpfs_t type, if you want to store dirsrv
266 files on a tmpfs file system.
267
268
269
270 dirsrv_unit_file_t
271
272 - Set files with the dirsrv_unit_file_t type, if you want to treat the
273 files as dirsrv unit content.
274
275
276
277 dirsrv_var_lib_t
278
279 - Set files with the dirsrv_var_lib_t type, if you want to store the
280 dirsrv files under the /var/lib directory.
281
282
283
284 dirsrv_var_lock_t
285
286 - Set files with the dirsrv_var_lock_t type, if you want to treat the
287 files as dirsrv var lock data, stored under the /var/lock directory
288
289
290
291 dirsrv_var_log_t
292
293 - Set files with the dirsrv_var_log_t type, if you want to treat the
294 data as dirsrv var log data, usually stored under the /var/log direc‐
295 tory.
296
297
298
299 dirsrv_var_run_t
300
301 - Set files with the dirsrv_var_run_t type, if you want to store the
302 dirsrv files under the /run or /var/run directory.
303
304
305 Paths:
306 /var/run/slapd.*, /var/run/dirsrv(/.*)?
307
308
309 dirsrvadmin_config_t
310
311 - Set files with the dirsrvadmin_config_t type, if you want to treat
312 the files as dirsrvadmin configuration data, usually stored under the
313 /etc directory.
314
315
316 Paths:
317 /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
318
319
320 dirsrvadmin_content_t
321
322 - Set files with the dirsrvadmin_content_t type, if you want to treat
323 the files as dirsrvadmin content.
324
325
326
327 dirsrvadmin_exec_t
328
329 - Set files with the dirsrvadmin_exec_t type, if you want to transition
330 an executable to the dirsrvadmin_t domain.
331
332
333 Paths:
334 /usr/sbin/stop-ds-admin, /usr/sbin/start-ds-admin,
335 /usr/sbin/restart-ds-admin
336
337
338 dirsrvadmin_htaccess_t
339
340 - Set files with the dirsrvadmin_htaccess_t type, if you want to treat
341 the file as a dirsrvadmin access file.
342
343
344
345 dirsrvadmin_lock_t
346
347 - Set files with the dirsrvadmin_lock_t type, if you want to treat the
348 files as dirsrvadmin lock data, stored under the /var/lock directory
349
350
351
352 dirsrvadmin_ra_content_t
353
354 - Set files with the dirsrvadmin_ra_content_t type, if you want to
355 treat the files as dirsrvadmin read/append content.
356
357
358
359 dirsrvadmin_rw_content_t
360
361 - Set files with the dirsrvadmin_rw_content_t type, if you want to
362 treat the files as dirsrvadmin read/write content.
363
364
365
366 dirsrvadmin_script_exec_t
367
368 - Set files with the dirsrvadmin_script_exec_t type, if you want to
369 transition an executable to the dirsrvadmin_script_t domain.
370
371
372 Paths:
373 /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
374
375
376 dirsrvadmin_tmp_t
377
378 - Set files with the dirsrvadmin_tmp_t type, if you want to store
379 dirsrvadmin temporary files in the /tmp directories.
380
381
382
383 dirsrvadmin_unconfined_script_exec_t
384
385 - Set files with the dirsrvadmin_unconfined_script_exec_t type, if you
386 want to transition an executable to the dirsrvadmin_unconfined_script_t
387 domain.
388
389
390 Paths:
391 /usr/lib/dirsrv/cgi-bin/ds_create, /usr/lib/dirsrv/cgi-bin/ds_re‐
392 move
393
394
395 dirsrvadmin_unit_file_t
396
397 - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
398 the files as dirsrvadmin unit content.
399
400
401
402 Note: File context can be temporarily modified with the chcon command.
403 If you want to permanently change the file context you need to use the
404 semanage fcontext command. This will modify the SELinux labeling data‐
405 base. You will need to use restorecon to apply the labels.
406
407
409 semanage fcontext can also be used to manipulate default file context
410 mappings.
411
412 semanage permissive can also be used to manipulate whether or not a
413 process type is permissive.
414
415 semanage module can also be used to enable/disable/install/remove pol‐
416 icy modules.
417
418 semanage boolean can also be used to manipulate the booleans
419
420
421 system-config-selinux is a GUI tool available to customize SELinux pol‐
422 icy settings.
423
424
426 This manual page was auto-generated using sepolicy manpage .
427
428
430 selinux(8), dirsrv(8), semanage(8), restorecon(8), chcon(1), sepol‐
431 icy(8), setsebool(8), dirsrv_snmp_selinux(8), dirsrv_snmp_selinux(8)
432
433
434
435dirsrv 21-11-19 dirsrv_selinux(8)