hkp port

hkp port

[Russell Coker]

http://etbe.coker.com.au/2007/11/06/squid-and-se-linux/

As described in the above URL I believe that port 11371 (for GPG key transfer) 
needs to be labelled as http_port_t to permit GPG to use Squid.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: hkp port

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Russell Coker wrote:
> http://etbe.coker.com.au/2007/11/06/squid-and-se-linux/
> 
> As described in the above URL I believe that port 11371 (for GPG key transfer) 
> needs to be labelled as http_port_t to permit GPG to use Squid.
> 
Why not just create a new type for this port



network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0)

Then give connect access to apache and squid.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHMOrWrlYvE4MpobMRAn5iAJ4vJwqjiXSWAbuYuVAzu/HOWNtwvQCcDiFC
hblVcIld2Kb303R0igVStYo=
=IB7s
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: hkp port

[Russell Coker]

On Wednesday 07 November 2007 09:29, Daniel J Walsh <dwalsh@redhat.com> wrote:
> Russell Coker wrote:
> > http://etbe.coker.com.au/2007/11/06/squid-and-se-linux/
> >
> > As described in the above URL I believe that port 11371 (for GPG key
> > transfer) needs to be labelled as http_port_t to permit GPG to use Squid.
>
> Why not just create a new type for this port
>
> network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0)
>
> Then give connect access to apache and squid.

A quick probe of some servers revealed that three of them didn't completely 
implement the HTTP protocol (IE they weren't proper web servers) and a fourth 
was running pks_www (which apparently is a stand-alone daemon not typically 
run from a web server).

So it seems that it's not web servers used for this and therefore a new port 
type is justified.

Policy for a key server daemon would be good too, I'll write it if I get some 
spare time.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.