[refpolicy] services_munin.patch

[refpolicy] services_munin.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/services_munin.patch

Label for munin initrc script

Fix label of /var/log/munin.*

Add cgi support

munin needs more capability and uses fifo_files can exec itself.

Add support for log file

[refpolicy] services_munin.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/services_munin.patch

Change to use attributes for the plugins
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx24rwACgkQrlYvE4MpobM1QgCgmYGLb4GSn2Ii0Q7cdu+zU2w/
mgcAnjO3s9OweQIVRytezbqQb9eheMdZ
=kyAC
-----END PGP SIGNATURE-----

[refpolicy] services_munin.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/services_munin.patch
munig cgi context
Uses sock_files in /tmp
Prints stuff and looks at postfix spool

[refpolicy] services_munin.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/services_munin.patch

munin html policy

munin uses rawio

Getattr on spool files.

[refpolicy] services_munin.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/services_munin.patch

New context for munin

Add munin_admin interface

munin_t needs chown/dac and sys_rawio capabilities

uses fifo, and execs itself

log files can be in a log directory

execs shell

communicates with the munin/apache  ports

calls getpw, lists inotify


reads fonts

runs ping and ifconfig

Added http types.

[refpolicy] services_munin.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F10/services_munin.patch

Add initrc support

fix labeling on /var/log

Add _admin interface

Needs chown dav_override sys_rawio capabilities

Uses fifo files

Handle log files


Read kernel systctls and network state

Connect and bind to munin ports

dontaudit read all processes
execs ifconfig
Domtrans to ping

Calls getpw so needs auth_use_nsswith

Lists spool

Communicates with fstools and mysql  Reads mta logs and sends mail

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkj1AKkACgkQrlYvE4MpobM7VACdGySOBTKcxD1kWqJzJ7WQx1ej
q6YAnAopj3EONgfJMLDxGUlFWtYAnKAY
=/uVO
-----END PGP SIGNATURE-----

[refpolicy] services_snort.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F10/services_snort.patch

New path for snort

snort now uses /var/run/snort

Add initrc script support

allow admin to start/stop service

Admin needs admin_pattern on all file types

snort uses the netlinkg_firewall_socket

connects to the prelude port

reads random devices

reads utmp file

resolves hostnames

playes with prelude

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkjanCcACgkQrlYvE4MpobMP3QCgo2zQdPjF9tnFxRDY5UDi+GrM
YlYAniNBcZ8xRMFmtWcLHUqskeFKN8ng
=W9eu
-----END PGP SIGNATURE-----

[refpolicy] services_snort.patch

[Christopher J. PeBenito]

On Wed, 2008-09-24 at 15:59 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F10/services_snort.patch
> 
> New path for snort
> 
> snort now uses /var/run/snort
> 
> Add initrc script support
> 
> allow admin to start/stop service
> 
> Admin needs admin_pattern on all file types
> 
> snort uses the netlinkg_firewall_socket
> 
> connects to the prelude port
> 
> reads random devices
> 
> reads utmp file
> 
> resolves hostnames
> 
> playes with prelude

Merged, except for the prelude bits.  It also sounds like that DNS
resolve should go in the prelude optional too.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] services_munin.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Add admin functions and initrc handling

needs chown setuid dac_override and sys_rawhio

Talks to itself over a fifo file

Manages its own logfile and directories.

Reads all sysctls and network state

Communicates with http and munin ports

Runs a ps command

calls getpw* functions so needs auth_use_nsswitch

Reads fonts

Executes ping and ifconfig

Starts fstools

Communicates with mysql

sends mail

Add apache scripts policy
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkjvvuUACgkQrlYvE4MpobPetACg2mUmok882mqwAOZP7bX6/sX6
FCMAnRDO9ZINe88BuAIOMzZRCDGwVC0X
=qTLK
-----END PGP SIGNATURE-----
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: services_munin.patch
Url: http://oss.tresys.com/pipermail/refpolicy/attachments/20081010/438a34c8/attachment.pl 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: services_munin.patch.sig
Type: application/octet-stream
Size: 72 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20081010/438a34c8/attachment.obj