[refpolicy] [ apache patch 1/1] Run nginx in the httpd_t domain.

[domg472@gmail.com (Dominick Grift)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/23/2011 02:53 PM, Russell Coker wrote:
> On Thu, 24 Mar 2011, "Christopher J. PeBenito" <cpebenito@tresys.com> wrote:
>> On 03/18/11 07:03, Dominick Grift wrote:
>>> http://lists.fedoraproject.org/pipermail/selinux/2011-March/013583.html
>>
>> I don't agree with nginx running in httpd_t.  Its more than a web server
>> (reverse proxy server and mail proxy server too).  If someone uses these
>> other features and they require more rules, we don't want them added to
>> httpd_t.
> 
> http://httpd.apache.org/docs/2.0/mod/mod_proxy.html
> 
> Apache also supports running as a forward or reverse HTTP proxy server and as 
> a FTP proxy server.
> 
> It seems to me that the only case where a different policy for Nginx and 
> Apache is a benefit is if Nginx and Apache are running on the same system but 
> doing different tasks - EG Nginx as a mail proxy and Apache as a HTTP server.  
> This is probably a sufficient reason for having a different domain.

The same would apply for lighttpd vs apache. Yes they also both run in
the httpd_t domain.

> 
> Now if we have different domains for multiple web servers will we have 
> different type for content files that they server?
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2KAc0ACgkQMlxVo39jgT+ZUwCcCoypllwmxQOLv+GYxjFR5nJD
GbkAn1AtxblzqtNNTp9q5jDnOlWZthcJ
=/1Cq
-----END PGP SIGNATURE-----