From: Daniel J Walsh <dwalsh@redhat.com>
To: "Pär Aronsson" <par.aronsson@telia.com>
Cc: selinux@tycho.nsa.gov, fedora-directory-users@redhat.com
Subject: Re: SELinux policy for Fedora Directory Server 1.1.0
Date: Tue, 18 Mar 2008 10:34:43 -0400 [thread overview]
Message-ID: <47DFD303.4080004@redhat.com> (raw)
In-Reply-To: <200803111734.10289.par.aronsson@telia.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Pär Aronsson wrote:
> Hello,
>
> Attached is a SELinux policy for the Fedora Directory Server 1.1.0.
> It is composed of three parts.
> * dirsrv - directory server and setup programs
> * dirsrv-admin - administration server and setup programs
> * fedora-idm-console - java based console for administration
>
> The policies were developed on a CentOS 5.1 with the following packages:
> fedora-ds-base-1.1.0-3.fc6
> fedora-ds-admin-1.1.1-1.fc6
> fedora-ds-console-1.1.0-5.fc6
> selinux-policy-2.4.6-106.el5_1.3
> kernel-2.6.18-53.1.4.el5
>
> I've succesfully tested the policies in targeted and strict mode.
>
> The dirsrv-admin policy requires that the apache policy module is loaded.
> Also run:
> setsebool -P httpd_enable_cgi on
>
> Comment out the following in /usr/sbin/start-ds-admin (line 63-65):
> if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> SELINUX_CMD="runcon -t unconfined_t --"
> fi
>
> I had trouble with the replication plugin so I haven't been able to do any
> testing with replication.
>
> Any comments are welcome.
>
> // Pär Aronsson
>
Just started looking at this policy
dirsrv.te looks pretty good, I have never setup a directory server, so
I am guessing on some of this stuff.
You want logging_search_logs($1) in
dirsrv_read_setuplog
The fedora-idm-console stuff makes no sense. Looks like you are trying
to fix bugs in javaplugin policy.
Not sure if you want/need dirserv-admin policy? If this is just stuff
to be run in cgi, just extend it.
ALso not sure you need dirsrv_setup_t Why not leave in admin context?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkff0wIACgkQrlYvE4MpobPytQCbBlFzyMaq83N79iPxQTbk/G5k
/SkAn2TL7xy7VwL1oDaj62isjxNnqd9O
=jUQi
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2008-03-18 14:34 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-03-11 16:34 SELinux policy for Fedora Directory Server 1.1.0 Pär Aronsson
2008-03-18 14:34 ` Daniel J Walsh [this message]
2008-03-26 17:23 ` Pär Aronsson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47DFD303.4080004@redhat.com \
--to=dwalsh@redhat.com \
--cc=fedora-directory-users@redhat.com \
--cc=par.aronsson@telia.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.