Re: SELinux policy for Fedora Directory Server 1.1.0

["Pär Aronsson" <par.aronsson@telia.com>]

tisdag 18 mars 2008 skrev Daniel J Walsh:
> Pär Aronsson wrote:
> > Hello,
> >
> > Attached is a SELinux policy for the Fedora Directory Server 1.1.0.
> > It is composed of three parts.
> > * dirsrv - directory server and setup programs
> > * dirsrv-admin - administration server and setup programs
> > * fedora-idm-console - java based console for administration
> >
> > The policies were developed on a CentOS 5.1 with the following packages:
> > fedora-ds-base-1.1.0-3.fc6
> > fedora-ds-admin-1.1.1-1.fc6
> > fedora-ds-console-1.1.0-5.fc6
> > selinux-policy-2.4.6-106.el5_1.3
> > kernel-2.6.18-53.1.4.el5
> >
> > I've succesfully tested the policies in targeted and strict mode.
> >
> > The dirsrv-admin policy requires that the apache policy module is loaded.
> > Also run:
> > setsebool -P httpd_enable_cgi on
> >
> > Comment out the following in /usr/sbin/start-ds-admin (line 63-65):
> > if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> > 	SELINUX_CMD="runcon -t unconfined_t --"
> > fi
> >
> > I had trouble with the replication plugin so I haven't been able to do
> > any testing with replication.
> >
> > Any comments are welcome.
> >
> > // Pär Aronsson
>
> Just started looking at this policy
> dirsrv.te looks pretty good,  I have never setup a directory server, so
> I am guessing on some of this stuff.
>
> You want 	logging_search_logs($1) in
> dirsrv_read_setuplog
>
> The fedora-idm-console stuff makes no sense.  Looks like you are trying
> to fix bugs in javaplugin policy.
>
> Not sure if you want/need  dirserv-admin policy?  If this is just stuff
> to be run in cgi, just extend it.
>
> ALso not sure you need dirsrv_setup_t  Why not leave in admin context?

Thanks Dan!

How should I handle the fedora-idm-console? A patch? Against what? The console 
need read access to the directory server db-files. There's an interface for 
it in dirsrv policy. What should I do with that in a patch?

The cgi-scripts in dirsrv-admin are run from httpd and from the 
fedora-idm-console. Most of the policy extends the apache_content_template 
interface. The rest is for the start script.
Can you suggest how it should be dealt with?

The setup- and migration utilities in dirsrv and dirsrv-admin create files 
in /tmp that may contain sensitive information and need be readable by the 
daemons. I couldn't find another way to make the files private. Any 
suggestions?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.