Docs/Drafts/Managing Confined Services/Information Plan

Information Plan

• Existing Red Hat Knowledgebase articles.

Purpose of the documentation

Provide administrators with a guide that details how to work with and manage confined services in Fedora 11. Documentation will cover:

• brief introduction to SELinux.
• performing system administration tasks without turning SELinux off.
• troubleshoot issues (include Red Hat Bugzilla and permissive domains).
• allow administrators to manage SELinux without employing someone else to do so.

Audience

System administrators.

Audience goals

Perform system administration tasks without turning SELinux off:

• share files via Samba, FTP, NFS, and HTTP.
• share files between multiple services.
• manage BIND (for example, accept zone updates).
• label files so that services can access them (semanage fcontext).
• customize the ports services listen on (semanage port -a).
• use non-default directories to store files for services.

Table of Contents ideas

1. Introduction

- brief introduction to SELinux.
- brief introduction to confined and unconfined services.

2. Apache HTTP Server
- what httpd is and does.
	2.1 The Apache HTTP Server and SELinux
	- explain default behavior:
				  * ports to listen on (http_port_t).
				  * files/directories httpd can and cannot access.
	2.2. Types
                 - how to list them.
		 - defined types.
		 - how to change them and when to change them (chcon, semanage).

	2.3. Booleans
		- how to list httpd related Booleans.
		- describe each Boolean.
		- getsebool and setsebool.

	2.4. Configuration examples
		- see man pages.
		- non-default directories for services.
		- customized port numbers.
		- sharing files.

Repeat #2 for Samba, FTP, NFS, BIND, etc...

X. Troubleshooting