dirsrv_selinux(8)

1dirsrv_selinux(8)            SELinux Policy dirsrv           dirsrv_selinux(8)
2
3
4

NAME

6       dirsrv_selinux  -  Security  Enhanced  Linux Policy for the dirsrv pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  dirsrv  processes  via  flexible
11       mandatory access control.
12
13       The  dirsrv  processes  execute with the dirsrv_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep dirsrv_t
20
21
22

ENTRYPOINTS

24       The  dirsrv_t  SELinux  type  can be entered via the dirsrv_exec_t file
25       type.
26
27       The default entrypoint paths for the dirsrv_t domain are the following:
28
29       /usr/sbin/ns-slapd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       dirsrv policy is very flexible allowing users  to  setup  their  dirsrv
39       processes in as secure a method as possible.
40
41       The following process types are defined for dirsrv:
42
43       dirsrv_t, dirsrv_snmp_t, dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
44
45       Note:  semanage  permissive -a dirsrv_t can be used to make the process
46       type dirsrv_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   dirsrv
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run dirsrv with the tightest access possible.
55
56
57
58       If you want to allow confined applications to run  with  kerberos,  you
59       must turn on the kerberos_enabled boolean. Enabled by default.
60
61       setsebool -P kerberos_enabled 1
62
63
64

MANAGED FILES

66       The  SELinux  process  type  dirsrv_t can manage files labeled with the
67       following file types.  The paths listed are the default paths for these
68       file types.  Note the processes UID still need to have DAC permissions.
69
70       cluster_conf_t
71
72            /etc/cluster(/.*)?
73
74       cluster_var_lib_t
75
76            /var/lib/pcsd(/.*)?
77            /var/lib/cluster(/.*)?
78            /var/lib/openais(/.*)?
79            /var/lib/pengine(/.*)?
80            /var/lib/corosync(/.*)?
81            /usr/lib/heartbeat(/.*)?
82            /var/lib/heartbeat(/.*)?
83            /var/lib/pacemaker(/.*)?
84
85       cluster_var_run_t
86
87            /var/run/crm(/.*)?
88            /var/run/cman_.*
89            /var/run/rsctmp(/.*)?
90            /var/run/aisexec.*
91            /var/run/heartbeat(/.*)?
92            /var/run/pcsd-ruby.socket
93            /var/run/corosync-qnetd(/.*)?
94            /var/run/corosync-qdevice(/.*)?
95            /var/run/corosync.pid
96            /var/run/cpglockd.pid
97            /var/run/rgmanager.pid
98            /var/run/cluster/rgmanager.sk
99
100       dirsrv_config_t
101
102            /etc/dirsrv(/.*)?
103
104       dirsrv_tmp_t
105
106
107       dirsrv_tmpfs_t
108
109            /dev/shm/slapd-.*
110
111       dirsrv_var_lib_t
112
113            /var/lib/dirsrv(/.*)?
114
115       dirsrv_var_lock_t
116
117            /var/lock/dirsrv(/.*)?
118
119       dirsrv_var_log_t
120
121            /var/log/dirsrv(/.*)?
122
123       dirsrv_var_run_t
124
125            /var/run/slapd.*
126            /var/run/dirsrv(/.*)?
127
128       faillog_t
129
130            /var/log/btmp.*
131            /var/log/faillog.*
132            /var/log/tallylog.*
133            /var/run/faillock(/.*)?
134
135       krb5_host_rcache_t
136
137            /var/tmp/krb5_0.rcache2
138            /var/cache/krb5rcache(/.*)?
139            /var/tmp/nfs_0
140            /var/tmp/DNS_25
141            /var/tmp/host_0
142            /var/tmp/imap_0
143            /var/tmp/HTTP_23
144            /var/tmp/HTTP_48
145            /var/tmp/ldap_55
146            /var/tmp/ldap_487
147            /var/tmp/ldapmap1_0
148
149       lastlog_t
150
151            /var/log/lastlog.*
152
153       root_t
154
155            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
156            /
157            /initrd
158
159       security_t
160
161            /selinux
162
163       systemd_passwd_var_run_t
164
165            /var/run/systemd/ask-password(/.*)?
166            /var/run/systemd/ask-password-block(/.*)?
167
168

FILE CONTEXTS

170       SELinux requires files to have an extended attribute to define the file
171       type.
172
173       You can see the context of a file using the -Z option to ls
174
175       Policy governs the access  confined  processes  have  to  these  files.
176       SELinux  dirsrv  policy  is very flexible allowing users to setup their
177       dirsrv processes in as secure a method as possible.
178
179       EQUIVALENCE DIRECTORIES
180
181
182       dirsrv policy stores data with multiple different  file  context  types
183       under  the  /var/log/dirsrv  directory.  If you would like to store the
184       data in a different directory you can use the semanage command to  cre‐
185       ate an equivalence mapping.  If you wanted to store this data under the
186       /srv directory you would execute the following command:
187
188       semanage fcontext -a -e /var/log/dirsrv /srv/dirsrv
189       restorecon -R -v /srv/dirsrv
190
191       STANDARD FILE CONTEXT
192
193       SELinux defines the file context types for the dirsrv, if you wanted to
194       store  files  with  these types in a diffent paths, you need to execute
195       the semanage command to specify alternate labeling  and  then  use  re‐
196       storecon to put the labels on disk.
197
198       semanage  fcontext  -a  -t dirsrvadmin_ra_content_t '/srv/mydirsrv_con‐
199       tent(/.*)?'
200       restorecon -R -v /srv/mydirsrv_content
201
202       Note: SELinux often uses regular expressions  to  specify  labels  that
203       match multiple files.
204
205       The following file types are defined for dirsrv:
206
207
208
209       dirsrv_config_t
210
211       -  Set  files  with  the dirsrv_config_t type, if you want to treat the
212       files as dirsrv configuration data, usually stored under the  /etc  di‐
213       rectory.
214
215
216
217       dirsrv_exec_t
218
219       -  Set  files with the dirsrv_exec_t type, if you want to transition an
220       executable to the dirsrv_t domain.
221
222
223
224       dirsrv_share_t
225
226       - Set files with the dirsrv_share_t type, if  you  want  to  treat  the
227       files as dirsrv share data.
228
229
230
231       dirsrv_snmp_exec_t
232
233       - Set files with the dirsrv_snmp_exec_t type, if you want to transition
234       an executable to the dirsrv_snmp_t domain.
235
236
237       Paths:
238            /usr/sbin/ldap-agent, /usr/sbin/ldap-agent-bin
239
240
241       dirsrv_snmp_var_log_t
242
243       - Set files with the dirsrv_snmp_var_log_t type, if you want  to  treat
244       the data as dirsrv snmp var log data, usually stored under the /var/log
245       directory.
246
247
248
249       dirsrv_snmp_var_run_t
250
251       - Set files with the dirsrv_snmp_var_run_t type, if you want  to  store
252       the dirsrv snmp files under the /run or /var/run directory.
253
254
255
256       dirsrv_tmp_t
257
258       -  Set  files  with  the dirsrv_tmp_t type, if you want to store dirsrv
259       temporary files in the /tmp directories.
260
261
262
263       dirsrv_tmpfs_t
264
265       - Set files with the dirsrv_tmpfs_t type, if you want to  store  dirsrv
266       files on a tmpfs file system.
267
268
269
270       dirsrv_unit_file_t
271
272       -  Set files with the dirsrv_unit_file_t type, if you want to treat the
273       files as dirsrv unit content.
274
275
276
277       dirsrv_var_lib_t
278
279       - Set files with the dirsrv_var_lib_t type, if you want  to  store  the
280       dirsrv files under the /var/lib directory.
281
282
283
284       dirsrv_var_lock_t
285
286       -  Set  files with the dirsrv_var_lock_t type, if you want to treat the
287       files as dirsrv var lock data, stored under the /var/lock directory
288
289
290
291       dirsrv_var_log_t
292
293       - Set files with the dirsrv_var_log_t type, if you want  to  treat  the
294       data  as  dirsrv var log data, usually stored under the /var/log direc‐
295       tory.
296
297
298
299       dirsrv_var_run_t
300
301       - Set files with the dirsrv_var_run_t type, if you want  to  store  the
302       dirsrv files under the /run or /var/run directory.
303
304
305       Paths:
306            /var/run/slapd.*, /var/run/dirsrv(/.*)?
307
308
309       dirsrvadmin_config_t
310
311       -  Set  files  with the dirsrvadmin_config_t type, if you want to treat
312       the files as dirsrvadmin configuration data, usually stored  under  the
313       /etc directory.
314
315
316       Paths:
317            /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
318
319
320       dirsrvadmin_content_t
321
322       -  Set  files with the dirsrvadmin_content_t type, if you want to treat
323       the files as dirsrvadmin content.
324
325
326
327       dirsrvadmin_exec_t
328
329       - Set files with the dirsrvadmin_exec_t type, if you want to transition
330       an executable to the dirsrvadmin_t domain.
331
332
333       Paths:
334            /usr/sbin/stop-ds-admin,                 /usr/sbin/start-ds-admin,
335            /usr/sbin/restart-ds-admin
336
337
338       dirsrvadmin_htaccess_t
339
340       - Set files with the dirsrvadmin_htaccess_t type, if you want to  treat
341       the file as a dirsrvadmin access file.
342
343
344
345       dirsrvadmin_lock_t
346
347       -  Set files with the dirsrvadmin_lock_t type, if you want to treat the
348       files as dirsrvadmin lock data, stored under the /var/lock directory
349
350
351
352       dirsrvadmin_ra_content_t
353
354       - Set files with the dirsrvadmin_ra_content_t  type,  if  you  want  to
355       treat the files as dirsrvadmin read/append content.
356
357
358
359       dirsrvadmin_rw_content_t
360
361       -  Set  files  with  the  dirsrvadmin_rw_content_t type, if you want to
362       treat the files as dirsrvadmin read/write content.
363
364
365
366       dirsrvadmin_script_exec_t
367
368       - Set files with the dirsrvadmin_script_exec_t type,  if  you  want  to
369       transition an executable to the dirsrvadmin_script_t domain.
370
371
372       Paths:
373            /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
374
375
376       dirsrvadmin_tmp_t
377
378       -  Set  files  with  the  dirsrvadmin_tmp_t  type, if you want to store
379       dirsrvadmin temporary files in the /tmp directories.
380
381
382
383       dirsrvadmin_unconfined_script_exec_t
384
385       - Set files with the dirsrvadmin_unconfined_script_exec_t type, if  you
386       want to transition an executable to the dirsrvadmin_unconfined_script_t
387       domain.
388
389
390       Paths:
391            /usr/lib/dirsrv/cgi-bin/ds_create,  /usr/lib/dirsrv/cgi-bin/ds_re‐
392            move
393
394
395       dirsrvadmin_unit_file_t
396
397       - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
398       the files as dirsrvadmin unit content.
399
400
401
402       Note: File context can be temporarily modified with the chcon  command.
403       If  you want to permanently change the file context you need to use the
404       semanage fcontext command.  This will modify the SELinux labeling data‐
405       base.  You will need to use restorecon to apply the labels.
406
407

COMMANDS

409       semanage  fcontext  can also be used to manipulate default file context
410       mappings.
411
412       semanage permissive can also be used to manipulate  whether  or  not  a
413       process type is permissive.
414
415       semanage  module can also be used to enable/disable/install/remove pol‐
416       icy modules.
417
418       semanage boolean can also be used to manipulate the booleans
419
420
421       system-config-selinux is a GUI tool available to customize SELinux pol‐
422       icy settings.
423
424

AUTHOR

426       This manual page was auto-generated using sepolicy manpage .
427
428