jvdias 344f2f
--- bind-9.3.1/bin/named/named.8.redhat_doc	2004-06-03 01:35:47.000000000 -0400
jvdias 344f2f
+++ bind-9.3.1/bin/named/named.8	2005-05-17 21:22:25.000000000 -0400
jvdias 344f2f
@@ -164,6 +164,75 @@
jvdias 344f2f
 .TP
jvdias 344f2f
 \fB\fI/var/run/named.pid\fB\fR
jvdias 344f2f
 The default process-id file.
jvdias 344f2f
+.PP
jvdias 344f2f
+.SH "NOTES"
jvdias 344f2f
+.PP
jvdias 344f2f
+.TP
jvdias 344f2f
+\fBRed Hat SELinux BIND Security Profile:\fR
jvdias 344f2f
+.PP
jvdias 344f2f
+By default, Red Hat ships BIND with the most secure SELinux policy
jvdias 344f2f
+that will not prevent normal BIND operation and will prevent exploitation
jvdias 344f2f
+of all known BIND security vulnerabilities . See the selinux(8) man page
jvdias 344f2f
+for information about SElinux.
jvdias 344f2f
+.PP
jvdias 344f2f
+It is not necessary to run named in a chroot environment if the Red Hat
jvdias 344f2f
+SELinux policy for named is enabled. When enabled, this policy is far
jvdias 344f2f
+more secure than a chroot environment. Users are recommended to enable
jvdias 344f2f
+SELinux and remove the bind-chroot package.
jvdias 344f2f
+.PP
jvdias 344f2f
+With this extra security comes some restrictions:
jvdias 344f2f
+.PP
jvdias 344f2f
+By default, the SELinux policy does not allow named to write any master
jvdias 344f2f
+zone database files. Only the root user may create files in the $ROOTDIR/var/named
jvdias 344f2f
+zone database file directory (the options { "directory" } option), where
jvdias 344f2f
+$ROOTDIR is set in /etc/sysconfig/named.
jvdias 344f2f
+.PP
jvdias 344f2f
+The "named" group must be granted read privelege to 
jvdias 344f2f
+these files in order for named to be enabled to read them. 
jvdias 344f2f
+.PP
jvdias 344f2f
+Any file created in the zone database file directory is automatically assigned
jvdias 344f2f
+the SELinux file context named_zone_t .
jvdias 344f2f
+.PP
jvdias 344f2f
+By default, SELinux prevents any role from modifying named_zone_t files; this
jvdias 344f2f
+means that files in the zone database directory cannot be modified by dynamic
jvdias 344f2f
+DNS (DDNS) updates or zone transfers.
jvdias 344f2f
+.PP
jvdias 344f2f
+The Red Hat BIND distribution and SELinux policy creates two directories where
jvdias 344f2f
+named is allowed to create and modify files: $ROOTDIR/var/named/slaves and
jvdias 344f2f
+$ROOTDIR/var/named/data. By placing files you want named to modify, such as
jvdias 344f2f
+slave or DDNS updateable zone files and database / statistics dump files in 
jvdias 344f2f
+these directories, named will work normally and no further operator action is
jvdias 344f2f
+required. Files in these directories are automatically assigned the 'named_cache_t'
jvdias 344f2f
+file context, which SELinux allows named to write.
jvdias 344f2f
+.PP
jvdias 344f2f
+You can enable the named_t domain to write and create named_zone_t files by use
jvdias 344f2f
+of the SELinux tunable boolean variable "named_write_master_zones", using the
jvdias 344f2f
+setsebool(8) command or the system-config-security GUI . If you do this, you
jvdias 344f2f
+must also set the ENABLE_ZONE_WRITE variable in /etc/sysconfig/named to 
jvdias 344f2f
+1 / yes to set the ownership of files in the $ROOTDIR/var/named directory
jvdias 344f2f
+to named:named in order for named to be allowed to write them. 
jvdias 344f2f
+.PP
jvdias 344f2f
+\fBRed Hat BIND named_sdb SDB support:\fR
jvdias 344f2f
+.PP
jvdias 344f2f
+Red Hat ships the bind-sdb RPM that provides the /usr/sbin/named_sdb program,
jvdias 344f2f
+which is named compiled with the Simplified Database Backend modules that ISC
jvdias 344f2f
+provides in the "contrib/sdb" directory.
jvdias 344f2f
+.PP
jvdias 344f2f
+The SDB modules for LDAP, PostGreSQL and DirDB are compiled into named_sdb.
jvdias 344f2f
+.PP
jvdias 344f2f
+To run named_sdb, set the ENABLE_SDB variable in /etc/sysconfig/named to 1 or "yes",
jvdias 344f2f
+and then the "service named start" named initscript will run named_sdb instead
jvdias 344f2f
+of named .
jvdias 344f2f
+.PP
jvdias 344f2f
+See the documentation for the various SDB modules in /usr/share/doc/bind-sdb-*/ .
jvdias 344f2f
+.br
jvdias 344f2f
+.PP
jvdias 344f2f
+\fBRed Hat system-config-bind:\fR
jvdias 344f2f
+.PP
jvdias 344f2f
+Red Hat provides the system-config-bind GUI to configure named.conf and zone
jvdias 344f2f
+database files. Run the "system-config-bind" command and access the manual
jvdias 344f2f
+by selecting the Help menu.
jvdias 344f2f
+.PP
jvdias 344f2f
 .SH "SEE ALSO"
jvdias 344f2f
 .PP
jvdias 344f2f
 \fIRFC 1033\fR,