nsd_crond_selinux(8)

✨ nsd_crond_selinux(8) ✨

Hey bestie! Welcome to the nsd_crond_selinux(8) manual page — aka the glow-up guide for the Security Enhanced Linux Policy that wraps around your nsd_crond processes. It's giving secure, it's giving mandatory access control, and we're gonna walk through it together. 💅

---

🌸 NAME 🌸

nsd_crond_selinux — Security Enhanced Linux Policy for the nsd_crond processes. That's the whole vibe.

💖 DESCRIPTION 💖

Security-Enhanced Linux secures the nsd_crond processes via flexible mandatory access control. (Literally the coolest way to lock things down.)

Your nsd_crond processes execute with the nsd_crond_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier, like this:

ps -eZ | grep nsd_crond_t

That's it. Slay.

🚪 ENTRYPOINTS 🚪

The nsd_crond_t SELinux type can be entered via the nsd_exec_t file type. (Think of it as the VIP door into the domain.)

The default entrypoint paths for the nsd_crond_t domain are, and I quote:

• /usr/bin/nsd
• /usr/bin/nsdc
• /usr/bin/zonec
• /usr/bin/nsd-notify
• /usr/bin/nsd-control
• /usr/bin/nsd-checkconf
• /usr/bin/nsd-checkzone
• /usr/bin/nsd-control-setup

Those are the paths, periodt.

🧬 PROCESS TYPES 🧬

SELinux defines process types (aka domains) for each process running on the system. You can see the context of a process using the -Z option to ps.

Policy governs the access confined processes have to files. The SELinux nsd_crond policy is very flexible, allowing users to set up their nsd_crond processes in as secure a method as possible. (Flexible but secure? We love a multitalented icon.)

The following process types are defined for nsd_crond:

• nsd_crond_t

Note: semanage permissive -a nsd_crond_t can be used to make the process type nsd_crond_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So it's not a free-for-all, just a vibes thing. 😭

🎛️ BOOLEANS 🎛️

SELinux policy is customizable based on least access required. The nsd_crond policy is extremely flexible and has several booleans that let you manipulate the policy and run nsd_crond with the tightest access possible. (Tightest access = main character energy.)

• fips_mode — If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default. Turn it on with:

setsebool -P fips_mode 1

• nis_enabled — If you want to allow the system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default. Turn it on with:

setsebool -P nis_enabled 1

Those are the booleans, bestie. No skips.

🗂️ MANAGED FILES 🗂️

The SELinux process type nsd_crond_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions. (SELinux doesn't override DAC, okay? It's not magic, just very good.)

• krb5_host_rcache_t

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

• nsd_zone_t

/var/lib/nsd(/.*)?
/etc/nsd/primary(/.*)?
/etc/nsd/secondary(/.*)?
/etc/nsd/nsd.db

🛠️ COMMANDS 🛠️

Here are the tools you can use, and what they do:

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. (A whole GUI, for the visual besties.)

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. So technically it wrote itself. Iconic.

🔗 SEE ALSO 🔗

Go check out these other pages for more context and lore:

• selinux(8)
• nsd_crond(8)
• semanage(8)
• restorecon(8)
• chcon(1)
• sepolicy(8)
• setsebool(8)

---

That's the whole page, bestie. This was nsd_crond_selinux(8) from the nsd_crond manual, dated 26-10-06. Stay secure, stay slay. 💖✨