|
 |
8a47aa |
From 402403b4bbb4f603693378e86b6c97997ccb0401 Mon Sep 17 00:00:00 2001
|
|
|
b8ccda |
From: Petr Mensik <pemensik@redhat.com>
|
|
|
b8ccda |
Date: Wed, 17 Jun 2020 23:17:13 +0200
|
|
|
b8ccda |
Subject: [PATCH] Update man named with Red Hat specifics
|
|
|
b8ccda |
|
|
|
b8ccda |
This is almost unmodified text and requires revalidation. Some of those
|
|
|
b8ccda |
statements are no longer correct.
|
|
|
b8ccda |
---
|
|
|
8a47aa |
bin/named/named.rst | 41 +++++++++++++++++++++++++++++++++++++++++
|
|
|
8a47aa |
1 file changed, 41 insertions(+)
|
|
|
b8ccda |
|
|
|
b8ccda |
diff --git a/bin/named/named.rst b/bin/named/named.rst
|
|
|
8a47aa |
index ea440b2..fa51984 100644
|
|
|
b8ccda |
--- a/bin/named/named.rst
|
|
|
b8ccda |
+++ b/bin/named/named.rst
|
|
|
8a47aa |
@@ -212,6 +212,47 @@ Files
|
|
|
8a47aa |
|named_pid|
|
|
|
b8ccda |
The default process-id file.
|
|
|
b8ccda |
|
|
|
b8ccda |
+Notes
|
|
|
b8ccda |
+~~~~~
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+**Red Hat SELinux BIND Security Profile:**
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+By default, Red Hat ships BIND with the most secure SELinux policy
|
|
|
b8ccda |
+that will not prevent normal BIND operation and will prevent exploitation
|
|
|
8a47aa |
+of all known BIND security vulnerabilities . See the selinux(8) man page
|
|
|
b8ccda |
+for information about SElinux.
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+It is not necessary to run named in a chroot environment if the Red Hat
|
|
|
b8ccda |
+SELinux policy for named is enabled. When enabled, this policy is far
|
|
|
b8ccda |
+more secure than a chroot environment. Users are recommended to enable
|
|
|
b8ccda |
+SELinux and remove the bind-chroot package.
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+*With this extra security comes some restrictions:*
|
|
|
b8ccda |
+
|
|
|
8a47aa |
+By default, the SELinux policy does not allow named to write any master
|
|
|
8a47aa |
+zone database files. Only the root user may create files in the $ROOTDIR/var/named
|
|
|
8a47aa |
+zone database file directory (the options { "directory" } option), where
|
|
|
8a47aa |
+$ROOTDIR is set in /etc/sysconfig/named.
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+The "named" group must be granted read privelege to
|
|
|
b8ccda |
+these files in order for named to be enabled to read them.
|
|
|
b8ccda |
+
|
|
|
b8ccda |
+Any file created in the zone database file directory is automatically assigned
|
|
|
b8ccda |
+the SELinux file context *named_zone_t* .
|
|
|
b8ccda |
+
|
|
|
8a47aa |
+By default, SELinux prevents any role from modifying *named_zone_t* files; this
|
|
|
8a47aa |
+means that files in the zone database directory cannot be modified by dynamic
|
|
|
8a47aa |
+DNS (DDNS) updates or zone transfers.
|
|
|
8a47aa |
+
|
|
|
b8ccda |
+The Red Hat BIND distribution and SELinux policy creates three directories where
|
|
|
8a47aa |
+named is allowed to create and modify files: */var/named/slaves*, */var/named/dynamic*
|
|
|
8a47aa |
+*/var/named/data*. By placing files you want named to modify, such as
|
|
|
8a47aa |
+slave or DDNS updateable zone files and database / statistics dump files in
|
|
|
8a47aa |
+these directories, named will work normally and no further operator action is
|
|
|
8a47aa |
+required. Files in these directories are automatically assigned the '*named_cache_t*'
|
|
|
8a47aa |
+file context, which SELinux allows named to write.
|
|
|
8a47aa |
+
|
|
|
b8ccda |
+
|
|
|
b8ccda |
See Also
|
|
|
b8ccda |
~~~~~~~~
|
|
|
b8ccda |
|
|
|
b8ccda |
--
|
|
|
8a47aa |
2.34.1
|
|
|
b8ccda |
|