SELinux Bind Module

be> CommitDate: Sat Jul 9 17:07:02 2011 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=3Dproj/hardened-docs= .git;a=3Dcommit;h=3D4d84472b Adding bind and ldap module description --- xml/selinux/modules/bind.xml | 132 +++++++++++++++++++++++= ++++++ xml/selinux/modules/images/binddomain.png | Bin 0 -> 10588 bytes xml/selinux/modules/images/binddomain.svg | 4 + xml/selinux/modules/images/ldapdomain.png | Bin 0 -> 12588 bytes xml/selinux/modules/images/ldapdomain.svg | 4 + xml/selinux/modules/ldap.xml | 105 +++++++++++++++++++++++ 6 files changed, 245 insertions(+), 0 deletions(-) diff --git a/xml/selinux/modules/bind.xml b/xml/selinux/modules/bind.xml new file mode 100644 index 0000000..3ef655c --- /dev/null +++ b/xml/selinux/modules/bind.xml @@ -0,0 +1,132 @@ + + + + + +SELinux Bind Module + + Sven Vermeulen + + + +Within SELinux, the bind module is responsible for defining the BIND +domains and interactions. + + + + + + +1 +2011-07-09 + + +Structure +

+Domains + + +

+ +

+The named_t domain can only be transitioned towards through the +initrc_t domain (i.e. through init scripts). The ndc_t dom= ain +(for the named domain controller) can be transitioned towards through th= e +initrc_t and sysadm_t (general system administration) doma= ins. +

+ + +

+File Types/Labels + + +

+The following table lists the file type/labels defined in the bind +module. +

+ + + + + + + + + named_exec_t + Entrypoint + Entrypoint domain for the named binaries + + + named_initrc_exec_t + Entrypoint + Entrypoint domain for non-Gentoo init scripts + + + named_checkconf_exec_t + Entrypoint + Entrypoint for the checkconf binary + + + ndc_exec_t + Entrypoint + Entrypoint for the ndc binaries + + + dnssec_t + Configuration + Label for the key files used by the named daemon + + + named_zone_t + Configuration + Label for the primary zone files + + + named_cache_t + Configuration + Label for the cached zone files + + + named_conf_t + Configuration + Label for the named configuration files + + + named_log_t + Configuration + Label for the named log files + + + named_tmp_t + + Label for the named temporary files + + + named_var_run_t + + Label for the named runtime variable data + +

Type	Function	Description

+ + +

+ + +Using Bind +

+SELinux boolean: named_write_master_zones + + +

+The named policy offers one boolean called +named_write_master_zones which, when enabled, allows the named da= emon to +write to its master zone files (i.e. named_zone_t). This is used = in +master/slave setups. +

+ + +

+ + diff --git a/xml/selinux/modules/images/binddomain.png b/xml/selinux/modu= les/images/binddomain.png new file mode 100644 index 0000000..3a75402 Binary files /dev/null and b/xml/selinux/modules/images/binddomain.png di= ffer diff --git a/xml/selinux/modules/images/binddomain.svg b/xml/selinux/modu= les/images/binddomain.svg new file mode 100644 index 0000000..f443429 --- /dev/null +++ b/xml/selinux/modules/images/binddomain.svg @@ -0,0 +1,4 @@ + + + + diff --git a/xml/selinux/modules/images/ldapdomain.png b/xml/selinux/modu= les/images/ldapdomain.png new file mode 100644 index 0000000..9aa8b49 Binary files /dev/null and b/xml/selinux/modules/images/ldapdomain.png di= ffer diff --git a/xml/selinux/modules/images/ldapdomain.svg b/xml/selinux/modu= les/images/ldapdomain.svg new file mode 100644 index 0000000..8ac6c94 --- /dev/null +++ b/xml/selinux/modules/images/ldapdomain.svg @@ -0,0 +1,4 @@ + + + + diff --git a/xml/selinux/modules/ldap.xml b/xml/selinux/modules/ldap.xml new file mode 100644 index 0000000..2aa16f2 --- /dev/null +++ b/xml/selinux/modules/ldap.xml @@ -0,0 +1,105 @@ + + + + + +SELinux LDAP Module + + Sven Vermeulen + + + +Within SELinux, the ldap module is responsible for defining the openldap +domains and interactions. + + + + + + +1 +2011-07-09 + + +Structure +

+Domains + + +

+ +

+The slapd daemon runs within the slapd_t domain and can on= ly be +transitioned towards through the sysadm_t (general system adminis= trative +domain) or initrc_t (init script launched) domains. +

+ + +

+File Types/Labels + + +

+The following table lists the file type/labels defined in the ldap +module. +

+ + + + + + + + + slapd_exec_t + Entrypoint + Executable entry point for the slapd daemon binaries + + + slapd_etc_t + Configuration + Label for OpenLDAP configuration files + + + slapd_cert_t + Configuration + Label for certificate keystores used by OpenLDAP + + + slapd_db_t + Configuration + Label for the OpenLDAP database files (backend content) + + + slapd_replog_t + Configuration + Label for the slurpd replication log location + + + slapd_lock_t + + Label for the lock files (runtime) + + + slapd_tmp_t + + Label for the temporary files + + + slapd_var_run_t + + Label for the runtime variable data + + + slapd_initrc_exec_t + + Label for non-Gentoo init script + +

Type	Function	Description

+ + +

+ +