[ale] SElinux, Fedora3, and postgresql

[James P. Kinney III]

On Sat, 2004-11-27 at 08:52, Chris Ricker wrote:
> On Fri, 26 Nov 2004, James P. Kinney III wrote:
> 
> > Success! Found the tool audit2allow and added the following to the
> > policy.conf file:
> 
> Good deal -- that's what I was going to recommend doing with the avc: 
> denied's. The main thing to watch with that is that what it does will often 
> be too permissive....
> 
> > #line 83
> > allow httpd_sys_script_t port_type:{ tcp_socket udp_socket } { send_msg
> > recv_msg };
> > #line 83
> > allow httpd_sys_script_t sysctl_kernel_t:dir search;
> > #line 83
> > allow httpd_sys_script_t sysctl_t:dir search;
> > #line 83
> > allow httpd_sys_script_t tmp_t:sock_file write;
> > #line 83
> > allow httpd_sys_script_t httpd_sys_content_t:lnk_file read;
> > #line 83
> > allow httpd_sys_script_t sysctl_kernel_t:file read;
> > #line 83
> > allow httpd_sys_script_t unconfined_t:unix_stream_socket connectto;
> > 
> > 
> > NOTE** This allows sql-ledger to run on FC3. I have NOT done a full
> > policy analysis to determine if this opens up more than I want to have
> > open.
> 
> I'd think you probably want to change the domain of sql-ledger to be
> different from any other CGIs, and do your allows just for whatever domain
> you use for sql-ledger. Right now, it's going to treat the entire
> httpd_sys_script_t domain (which includes all CGIs) the same.... If that's
> the only CGI you plan on having on there, though, I wouldn't worry about it.
> 
Good point. For now, sql-ledger will be the only cgi but others may join
the system later. I'll put sql-ledger into its own domain and muddle
around on those permissions for a while.

> later,
> chris
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
> 
> !DSPAM:41a886db4801085616282!
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part