-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Matthew Miller wrote:
> On Wed, Sep 26, 2007 at 09:28:58PM -0400, Jesse Keating wrote:
>>> AFAIK, selinux only knows about a couple servers, like apache, having
>>> data in /srv. If SE Linux is going to protect the data, a standard
>>> mapping between /srv and /var for everything should be worked out so
>>> that policy can be adapted.
>> Therein lies the problem. /srv/ is open ground for sysadmins to use,
>> we can't prepopulate it with anything, and we can't assume what the
>> local admin will use for a scheme. /srv/<site>/{web,ftp,backup}
>> or /srv/{web,ftp,backup}/<site> or some other combo.
>
> Can we make it easy for the SE Linux tools to let the admin choose their
> local /srv policy?
>
We can do it, using semanage commands, but not necessarily easy.
Currently regex match the default location of files stored on disk.
/srv/([^/]*/)?www(/.*)? system_u:object_r:httpd_sys_content_t:s0
/var/www(/.*)? system_u:object_r:httpd_sys_content_t:s0
/var/www/[^/]*/cgi-bin(/.*)? system_u:object_r:httpd_sys_script_exec_t:s0
/var/www/perl(/.*)? system_u:object_r:httpd_sys_script_exec_t:s0
/var/www/icons(/.*)? system_u:object_r:httpd_sys_content_t:s0
/var/www/html/[^/]*/cgi-bin(/.*)?
system_u:object_r:httpd_sys_script_exec_t:s0
/var/www/cgi-bin(/.*)? system_u:object_r:httpd_sys_script_exec_t:s0
/var/www/calamaris(/.*)? system_u:object_r:calamaris_www_t:s0
/var/www/apcupsd/multimon.cgi --
system_u:object_r:httpd_apcupsd_cgi_script_exec_t:s0
/var/www/apcupsd/upsimage.cgi --
system_u:object_r:httpd_apcupsd_cgi_script_exec_t:s0
/var/www/apcupsd/upsstats.cgi --
system_u:object_r:httpd_apcupsd_cgi_script_exec_t:s0
/var/www/apcupsd/upsfstats.cgi --
system_u:object_r:httpd_apcupsd_cgi_script_exec_t:s0
/var/www/cgi-bin/cgi --
system_u:object_r:httpd_mycgi_script_exec_t:s0
We could start to build tools that would allow you to change this location.
semanage fcontext -a -t httpd_sys_script_exec_t /srv/web/cgi-bin(/.*)?
Would add a context to this path.
system-config-selinux has graphical tools to do this, but it still
involves users choosing contexts and file paths.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFG+6/FrlYvE4MpobMRAh/QAKC4Tm7B/kuxe/AFcncavaIe6vZnXQCbBpKI
jcIYqF8EgcrXGHL89a18Uxs=
=g8xn
-----END PGP SIGNATURE-----
--
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-devel-list
