Re: please offer your good advices / new policies: exim, dovecot, maradns, (aptitude)

[Andreas Schuldei <andreas@schuldei.org>]

* Peter Gervai (grin@tolna.net) [030423 20:56]:
> (One line for every packet ever arriving on the network!)
> 
> I don't see the reason for this (I have wild guesses), and I don't see the
> solution. And I don't get why nobody had this problem before. Shall I
> dontaudit these (modifying dhcpc, newrole, sshd, ...)? Is there a better
> solution?

yes, that is what i did, too. (i think i asked the same question
here, too, and never got an answer.)

i have here collected over time:
dontaudit dhcpd_t sshd_t:packet_socket { recvfrom };
dontaudit dhcpd_t courier_tcpd_t:packet_socket { recvfrom };
dontaudit dhcpd_t netmsg_eth1_t:packet_socket { recvfrom };
dontaudit dhcpd_t icmp_socket_t:rawip_socket { recvfrom };
dontaudit dhcpd_t ping_t:rawip_socket { recvfrom };
dontaudit dhcpd_t named_t:packet_socket { recvfrom };
dontaudit dhcpd_t netmsg_eth0_t:packet_socket { recvfrom };
dontaudit dhcpd_t apt_t:packet_socket { recvfrom };
dontaudit dhcpd_t inetd_t:packet_socket { recvfrom };
dontaudit dhcpd_t postfix_master_t:packet_socket { recvfrom };
dontaudit dhcpd_t tcp_socket_t:packet_socket { recvfrom };
dontaudit dhcpd_t dhcpd_t:packet_socket { recvfrom };
dontaudit dhcpd_t icmp_socket_t:packet_socket { recvfrom };
dontaudit dhcpd_t sysadm_ssh_t:packet_socket { recvfrom };

basicly, these are all the services i run on that box.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.