* Kerberos Patch
@ 2008-08-11 22:19 Daniel J Walsh
0 siblings, 0 replies; only message in thread
From: Daniel J Walsh @ 2008-08-11 22:19 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
http://people.fedoraproject.org/~dwalsh/SELinux/F10/services_kerberos.patch
kpropd policy
Had to add a lot of policy to handle host_rcache_t files.
Kerberos library, has builtin SELinux awareness that causes it to change
the context of files it creates to the system default labeling.
In general case we need to dontaudit calls of setfscreate and validation
of the file context
dns is done outside of kerberos and should not be allowed within the domain.
For domains that create keytabs we need a template to allow them to
label them properly.
Allow userdomain and login programs to connect to kerberos master ports
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkiguuQACgkQrlYvE4MpobOcXwCfRI116zquF4YFWpkNr0Mr9ikp
X74AnijDJIgAvPMuwDWpO9f9TMDYCbI/
=YjwO
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2008-08-11 22:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-08-11 22:19 Kerberos Patch Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.