|
 |
ad33c6 |
From facdbb0f2a266c6a3a1fa823afaa09cbd3fc38a5 Mon Sep 17 00:00:00 2001
|
|
|
ad33c6 |
From: Petr Mensik <pemensik@redhat.com>
|
|
|
ad33c6 |
Date: Thu, 26 Nov 2020 12:13:10 +0100
|
|
|
ad33c6 |
Subject: [PATCH] Note specific Red Hat changes in manual page
|
|
|
ad33c6 |
|
|
|
ad33c6 |
Change docbook template instead of generated manual page. Remove
|
|
|
ad33c6 |
system-config-bind reference, package were discontinued.
|
|
|
ad33c6 |
---
|
|
|
ad33c6 |
bin/named/named.docbook | 73 +++++++++++++++++++++++++++++++++++++++++
|
|
|
ad33c6 |
1 file changed, 73 insertions(+)
|
|
|
ad33c6 |
|
|
|
ad33c6 |
diff --git a/bin/named/named.docbook b/bin/named/named.docbook
|
|
|
ad33c6 |
index 7e743a9..802bec3 100644
|
|
|
ad33c6 |
--- a/bin/named/named.docbook
|
|
|
ad33c6 |
+++ b/bin/named/named.docbook
|
|
|
ad33c6 |
@@ -516,6 +516,79 @@
|
|
|
ad33c6 |
|
|
|
ad33c6 |
</refsection>
|
|
|
ad33c6 |
|
|
|
ad33c6 |
+ <refsection><info><title>NOTES</title></info>
|
|
|
ad33c6 |
+ <refsection><info><title>Red Hat SELinux BIND Security Profile</title></info>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ By default, Red Hat ships BIND with the most secure SELinux policy
|
|
|
ad33c6 |
+ that will not prevent normal BIND operation and will prevent exploitation
|
|
|
ad33c6 |
+ of all known BIND security vulnerabilities . See the selinux(8) man page
|
|
|
ad33c6 |
+ for information about SElinux.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ It is not necessary to run named in a chroot environment if the Red Hat
|
|
|
ad33c6 |
+ SELinux policy for named is enabled. When enabled, this policy is far
|
|
|
ad33c6 |
+ more secure than a chroot environment. Users are recommended to enable
|
|
|
ad33c6 |
+ SELinux and remove the bind-chroot package.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ With this extra security comes some restrictions:
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ By default, the SELinux policy allows named to write any master
|
|
|
ad33c6 |
+ zone database files. Only the root user may create files in the $ROOTDIR/var/named
|
|
|
ad33c6 |
+ zone database file directory (the options { "directory" } option), where
|
|
|
ad33c6 |
+ $ROOTDIR is set in /etc/sysconfig/named.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ The "named" group must be granted read privelege to
|
|
|
ad33c6 |
+ these files in order for named to be enabled to read them.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ Any file created in the zone database file directory is automatically assigned
|
|
|
ad33c6 |
+ the SELinux file context named_zone_t .
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ By default, SELinux prevents any role from modifying named_zone_t files; this
|
|
|
ad33c6 |
+ means that files in the zone database directory cannot be modified by dynamic
|
|
|
ad33c6 |
+ DNS (DDNS) updates or zone transfers.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ The Red Hat BIND distribution and SELinux policy creates three directories where
|
|
|
ad33c6 |
+ named is allowed to create and modify files: /var/named/slaves, /var/named/dynamic
|
|
|
ad33c6 |
+ /var/named/data. By placing files you want named to modify, such as
|
|
|
ad33c6 |
+ slave or DDNS updateable zone files and database / statistics dump files in
|
|
|
ad33c6 |
+ these directories, named will work normally and no further operator action is
|
|
|
ad33c6 |
+ required. Files in these directories are automatically assigned the 'named_cache_t'
|
|
|
ad33c6 |
+ file context, which SELinux allows named to write.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+ </refsection>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <refsection><info><title>Red Hat BIND SDB support</title></info>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ Red Hat ships named with compiled in Simplified Database Backend modules that ISC
|
|
|
ad33c6 |
+ provides in the "contrib/sdb" directory. Install bind-sdb package if you want use them.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ The SDB modules for LDAP, PostGreSQL, DirDB and SQLite are compiled into <command>named-sdb</command>.
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ <para>
|
|
|
ad33c6 |
+ See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
|
|
|
ad33c6 |
+ </para>
|
|
|
ad33c6 |
+ </refsection>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
+ </refsection>
|
|
|
ad33c6 |
+
|
|
|
ad33c6 |
<refsection><info><title>SEE ALSO</title></info>
|
|
|
ad33c6 |
|
|
|
ad33c6 |
<para><citetitle>RFC 1033</citetitle>,
|
|
|
ad33c6 |
--
|
|
|
ad33c6 |
2.26.2
|
|
|
ad33c6 |
|