On 11/3/19 9:31 AM, Sam Varshavchik wrote:
Does anyone happen to know if the dhcp failover configuration that's documented here: https://kb.isc.org/docs/aa-00502 is supported by Fedora's selinux policy. Perusing it, failover seems to use a dedicated port(s), so selinux needs to bless dhcp's binding to that port(s). I couldn't figure out what is or isn't in Fedora's selinux polixy by searching what's in the selinux-policy-targeted and selinux-policy-devel rpms; and I was unable to find any useful selinux documentation, either in the supplied rpm or web searches. It would be nice to know this in advance before attempting to wreck my LAN for an afternoon, trying to get this to work with selinux enabled. I thought I could determine whether Fedora's selinux with respect to dhcp and ports 647 and 7911 (the dhcpd.conf man pages makes it clear that ports 519 and 520 from the above docs are outdated) by figuring out where is the selinux policy restricts privoxy to port 8118; but a grep of all the files in selinux-policy-targeted or selinux-policy-devel finds nothing that appears to specify that the privoxy_t domain is allowed to bind port 8118. The selinux-doc RPM appears to be just robo-generated documentation that just repeats the stuff that I found in the other RPMs.
I believe doing sepolicy network -d privoxy_t will supply you with the info you need. sepolicy is provided by the policycoreutils-devel package. FWIW, when looking for selinux guidance I find it useful to post to their dedicated list. -- The key to getting good answers is to ask good questions. _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
