dirsrv_selinux(8)

1dirsrv_selinux(8)            SELinux Policy dirsrv           dirsrv_selinux(8)
2
3
4

NAME

6       dirsrv_selinux  -  Security  Enhanced  Linux Policy for the dirsrv pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux  secures  the  dirsrv  processes  via  flexible
11       mandatory access control.
12
13       The  dirsrv  processes  execute with the dirsrv_t SELinux type. You can
14       check if you have these processes running by executing the  ps  command
15       with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep dirsrv_t
20
21
22

ENTRYPOINTS

24       The  dirsrv_t  SELinux  type  can be entered via the dirsrv_exec_t file
25       type.
26
27       The default entrypoint paths for the dirsrv_t domain are the following:
28
29       /usr/sbin/ns-slapd
30

PROCESS TYPES

32       SELinux defines process types (domains) for each process running on the
33       system
34
35       You can see the context of a process using the -Z option to ps
36
37       Policy  governs  the  access confined processes have to files.  SELinux
38       dirsrv policy is very flexible allowing users  to  setup  their  dirsrv
39       processes in as secure a method as possible.
40
41       The following process types are defined for dirsrv:
42
43       dirsrv_t, dirsrv_snmp_t, dirsrvadmin_t, dirsrvadmin_unconfined_script_t, dirsrvadmin_script_t
44
45       Note:  semanage  permissive -a dirsrv_t can be used to make the process
46       type dirsrv_t permissive. SELinux does not deny  access  to  permissive
47       process  types, but the AVC (SELinux denials) messages are still gener‐
48       ated.
49
50

BOOLEANS

52       SELinux policy is customizable based on least access required.   dirsrv
53       policy is extremely flexible and has several booleans that allow you to
54       manipulate the policy and run dirsrv with the tightest access possible.
55
56
57
58       If you want to dontaudit all  daemons  scheduling  requests  (setsched,
59       sys_nice),  you  must turn on the daemons_dontaudit_scheduling boolean.
60       Enabled by default.
61
62       setsebool -P daemons_dontaudit_scheduling 1
63
64
65
66       If you want to allow confined applications to run  with  kerberos,  you
67       must turn on the kerberos_enabled boolean. Enabled by default.
68
69       setsebool -P kerberos_enabled 1
70
71
72
73       If  you  want  to  allow  system  to run with NIS, you must turn on the
74       nis_enabled boolean. Disabled by default.
75
76       setsebool -P nis_enabled 1
77
78
79

MANAGED FILES

81       The SELinux process type dirsrv_t can manage  files  labeled  with  the
82       following file types.  The paths listed are the default paths for these
83       file types.  Note the processes UID still need to have DAC permissions.
84
85       cluster_conf_t
86
87            /etc/cluster(/.*)?
88
89       cluster_var_lib_t
90
91            /var/lib/pcsd(/.*)?
92            /var/lib/cluster(/.*)?
93            /var/lib/openais(/.*)?
94            /var/lib/pengine(/.*)?
95            /var/lib/corosync(/.*)?
96            /usr/lib/heartbeat(/.*)?
97            /var/lib/heartbeat(/.*)?
98            /var/lib/pacemaker(/.*)?
99
100       cluster_var_run_t
101
102            /var/run/crm(/.*)?
103            /var/run/cman_.*
104            /var/run/rsctmp(/.*)?
105            /var/run/aisexec.*
106            /var/run/heartbeat(/.*)?
107            /var/run/pcsd-ruby.socket
108            /var/run/corosync-qnetd(/.*)?
109            /var/run/corosync-qdevice(/.*)?
110            /var/run/corosync.pid
111            /var/run/cpglockd.pid
112            /var/run/rgmanager.pid
113            /var/run/cluster/rgmanager.sk
114
115       dirsrv_config_t
116
117            /etc/dirsrv(/.*)?
118
119       dirsrv_tmp_t
120
121
122       dirsrv_tmpfs_t
123
124            /dev/shm/slapd-.*
125
126       dirsrv_var_lib_t
127
128            /var/lib/dirsrv(/.*)?
129
130       dirsrv_var_lock_t
131
132            /var/lock/dirsrv(/.*)?
133
134       dirsrv_var_log_t
135
136            /var/log/dirsrv(/.*)?
137
138       dirsrv_var_run_t
139
140            /var/run/slapd.*
141            /var/run/dirsrv(/.*)?
142
143       faillog_t
144
145            /var/log/btmp.*
146            /var/log/faillog.*
147            /var/log/tallylog.*
148            /var/run/faillock(/.*)?
149
150       krb5_host_rcache_t
151
152            /var/tmp/krb5_0.rcache2
153            /var/cache/krb5rcache(/.*)?
154            /var/tmp/nfs_0
155            /var/tmp/DNS_25
156            /var/tmp/host_0
157            /var/tmp/imap_0
158            /var/tmp/HTTP_23
159            /var/tmp/HTTP_48
160            /var/tmp/ldap_55
161            /var/tmp/ldap_487
162            /var/tmp/ldapmap1_0
163
164       lastlog_t
165
166            /var/log/lastlog.*
167
168       root_t
169
170            /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
171            /
172            /initrd
173
174       security_t
175
176            /selinux
177
178       systemd_passwd_var_run_t
179
180            /var/run/systemd/ask-password(/.*)?
181            /var/run/systemd/ask-password-block(/.*)?
182
183

FILE CONTEXTS

185       SELinux requires files to have an extended attribute to define the file
186       type.
187
188       You can see the context of a file using the -Z option to ls
189
190       Policy  governs  the  access  confined  processes  have to these files.
191       SELinux dirsrv policy is very flexible allowing users  to  setup  their
192       dirsrv processes in as secure a method as possible.
193
194       EQUIVALENCE DIRECTORIES
195
196
197       dirsrv  policy  stores  data with multiple different file context types
198       under the /var/log/dirsrv directory.  If you would like  to  store  the
199       data  in a different directory you can use the semanage command to cre‐
200       ate an equivalence mapping.  If you wanted to store this data under the
201       /srv directory you would execute the following command:
202
203       semanage fcontext -a -e /var/log/dirsrv /srv/dirsrv
204       restorecon -R -v /srv/dirsrv
205
206       STANDARD FILE CONTEXT
207
208       SELinux defines the file context types for the dirsrv, if you wanted to
209       store files with these types in a different paths, you need to  execute
210       the  semanage  command  to  specify alternate labeling and then use re‐
211       storecon to put the labels on disk.
212
213       semanage fcontext -a -t dirsrv_exec_t '/srv/dirsrv/content(/.*)?'
214       restorecon -R -v /srv/mydirsrv_content
215
216       Note: SELinux often uses regular expressions  to  specify  labels  that
217       match multiple files.
218
219       The following file types are defined for dirsrv:
220
221
222
223       dirsrv_config_t
224
225       -  Set  files  with  the dirsrv_config_t type, if you want to treat the
226       files as dirsrv configuration data, usually stored under the  /etc  di‐
227       rectory.
228
229
230
231       dirsrv_exec_t
232
233       -  Set  files with the dirsrv_exec_t type, if you want to transition an
234       executable to the dirsrv_t domain.
235
236
237
238       dirsrv_share_t
239
240       - Set files with the dirsrv_share_t type, if  you  want  to  treat  the
241       files as dirsrv share data.
242
243
244
245       dirsrv_snmp_exec_t
246
247       - Set files with the dirsrv_snmp_exec_t type, if you want to transition
248       an executable to the dirsrv_snmp_t domain.
249
250
251       Paths:
252            /usr/sbin/ldap-agent, /usr/sbin/ldap-agent-bin
253
254
255       dirsrv_snmp_var_log_t
256
257       - Set files with the dirsrv_snmp_var_log_t type, if you want  to  treat
258       the data as dirsrv snmp var log data, usually stored under the /var/log
259       directory.
260
261
262
263       dirsrv_snmp_var_run_t
264
265       - Set files with the dirsrv_snmp_var_run_t type, if you want  to  store
266       the dirsrv snmp files under the /run or /var/run directory.
267
268
269
270       dirsrv_tmp_t
271
272       -  Set  files  with  the dirsrv_tmp_t type, if you want to store dirsrv
273       temporary files in the /tmp directories.
274
275
276
277       dirsrv_tmpfs_t
278
279       - Set files with the dirsrv_tmpfs_t type, if you want to  store  dirsrv
280       files on a tmpfs file system.
281
282
283
284       dirsrv_unit_file_t
285
286       -  Set files with the dirsrv_unit_file_t type, if you want to treat the
287       files as dirsrv unit content.
288
289
290
291       dirsrv_var_lib_t
292
293       - Set files with the dirsrv_var_lib_t type, if you want  to  store  the
294       dirsrv files under the /var/lib directory.
295
296
297
298       dirsrv_var_lock_t
299
300       -  Set  files with the dirsrv_var_lock_t type, if you want to treat the
301       files as dirsrv var lock data, stored under the /var/lock directory
302
303
304
305       dirsrv_var_log_t
306
307       - Set files with the dirsrv_var_log_t type, if you want  to  treat  the
308       data  as  dirsrv var log data, usually stored under the /var/log direc‐
309       tory.
310
311
312
313       dirsrv_var_run_t
314
315       - Set files with the dirsrv_var_run_t type, if you want  to  store  the
316       dirsrv files under the /run or /var/run directory.
317
318
319       Paths:
320            /var/run/slapd.*, /var/run/dirsrv(/.*)?
321
322
323       dirsrvadmin_config_t
324
325       -  Set  files  with the dirsrvadmin_config_t type, if you want to treat
326       the files as dirsrvadmin configuration data, usually stored  under  the
327       /etc directory.
328
329
330       Paths:
331            /etc/dirsrv/dsgw(/.*)?, /etc/dirsrv/admin-serv(/.*)?
332
333
334       dirsrvadmin_content_t
335
336       -  Set  files with the dirsrvadmin_content_t type, if you want to treat
337       the files as dirsrvadmin content.
338
339
340
341       dirsrvadmin_exec_t
342
343       - Set files with the dirsrvadmin_exec_t type, if you want to transition
344       an executable to the dirsrvadmin_t domain.
345
346
347       Paths:
348            /usr/sbin/stop-ds-admin,                 /usr/sbin/start-ds-admin,
349            /usr/sbin/restart-ds-admin
350
351
352       dirsrvadmin_htaccess_t
353
354       - Set files with the dirsrvadmin_htaccess_t type, if you want to  treat
355       the file as a dirsrvadmin access file.
356
357
358
359       dirsrvadmin_lock_t
360
361       -  Set files with the dirsrvadmin_lock_t type, if you want to treat the
362       files as dirsrvadmin lock data, stored under the /var/lock directory
363
364
365
366       dirsrvadmin_ra_content_t
367
368       - Set files with the dirsrvadmin_ra_content_t  type,  if  you  want  to
369       treat the files as dirsrvadmin read/append content.
370
371
372
373       dirsrvadmin_rw_content_t
374
375       -  Set  files  with  the  dirsrvadmin_rw_content_t type, if you want to
376       treat the files as dirsrvadmin read/write content.
377
378
379
380       dirsrvadmin_script_exec_t
381
382       - Set files with the dirsrvadmin_script_exec_t type,  if  you  want  to
383       transition an executable to the dirsrvadmin_script_t domain.
384
385
386       Paths:
387            /usr/lib/dirsrv/cgi-bin(/.*)?, /usr/lib/dirsrv/dsgw-cgi-bin(/.*)?
388
389
390       dirsrvadmin_tmp_t
391
392       -  Set  files  with  the  dirsrvadmin_tmp_t  type, if you want to store
393       dirsrvadmin temporary files in the /tmp directories.
394
395
396
397       dirsrvadmin_unconfined_script_exec_t
398
399       - Set files with the dirsrvadmin_unconfined_script_exec_t type, if  you
400       want to transition an executable to the dirsrvadmin_unconfined_script_t
401       domain.
402
403
404       Paths:
405            /usr/lib/dirsrv/cgi-bin/ds_create,  /usr/lib/dirsrv/cgi-bin/ds_re‐
406            move
407
408
409       dirsrvadmin_unit_file_t
410
411       - Set files with the dirsrvadmin_unit_file_t type, if you want to treat
412       the files as dirsrvadmin unit content.
413
414
415
416       Note: File context can be temporarily modified with the chcon  command.
417       If  you want to permanently change the file context you need to use the
418       semanage fcontext command.  This will modify the SELinux labeling data‐
419       base.  You will need to use restorecon to apply the labels.
420
421

COMMANDS

423       semanage  fcontext  can also be used to manipulate default file context
424       mappings.
425
426       semanage permissive can also be used to manipulate  whether  or  not  a
427       process type is permissive.
428
429       semanage  module can also be used to enable/disable/install/remove pol‐
430       icy modules.
431
432       semanage boolean can also be used to manipulate the booleans
433
434
435       system-config-selinux is a GUI tool available to customize SELinux pol‐
436       icy settings.
437
438

AUTHOR

440       This manual page was auto-generated using sepolicy manpage .
441
442