cis-bind-v100-10-2

name	cis-bind-v100-10-2
description	Ensure BIND Processes Run in the named_t Confined Context Type (Automated)
category	cis-bind
version	1.0
author	cyberstrike-official
tags	["cis","bind","dns","isc-bind","bind9","selinux"]
cis_id	10.2
cis_benchmark	CIS ISC BIND DNS Server 9.11 Benchmark v1.0.0
tech_stack	["bind","isc-bind","dns","linux","selinux"]
cwe_ids	["CWE-732"]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 10.2 — Ensure BIND Processes Run in the named_t Confined Context Type

Profile Applicability

• Caching Only Name Server Level 2
• Authoritative Name Server Level 2

Description

SELinux includes customizable targeted policies that may be used to confine the BIND named server to enforce least privileges so that the server has only the minimal access to specified directories, files and network ports. Access is controlled by process types (domains) defined for the named process. There are about a dozen related types defined in a default named SELinux policy. The default SELinux policies work well for a default BIND installation, however testing of the SELinux policies with the specific BIND operations is highly recommended. All directories and files to be accessed by the named server process must have security labels with appropriate types. The following file context types are a sample of the most commonly used:

• named_cache_t - Directories and files with dynamically updated contents
• named_conf_t - Directories and Configuration files to be read, but not updated
• named_exec_t - BIND related Executables

The seinfo may be used list the types that are configured. For example, the following will list the relevant types that begin with named_

# seinfo -t | grep ' named_'

The semanage fcontext command may be used to list file context mapping. For example:

# semanage fcontext -l | grep ':named_'

Rationale

With the proper implementation of SELinux, vulnerabilities in the BIND named server may be prevented from being exploited due to the additional restrictions. For example, a vulnerability that allows an attacker to read inappropriate system files may be prevented from execution by SELinux because the inappropriate files are not labeled with necessary named specific context. Likewise writing to an unexpected directory or execution of unexpected content can be prevented by similar mandatory security labels enforced by SELinux.

Impact

Not specified.

Audit Procedure

Perform the following steps to determine if the recommended state is implemented: Check that the BIND named process is confined to the named_t SELinux context. The type is listed in the third colon separated field and should be named_t.

# ps -eZ | grep named
system_u:system_r:named_t:s0        1792 ?         00:00:00 named

The service is non-compliant if the output does not show a process type or shows a process type other than .