Re: postfix, procmail and SELinux - No Go

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Nicolas Mailhot wrote:
Paul Howarth a écrit :
On Sat, 2006-06-24 at 17:40 -0500, Marc Schwartz wrote:

'pyzor discover' updates the pyzor server list.

'razor-admin -discover' does the same for the razor servers.
Can these be made to write files somewhere other than /.razor etc?

Are the files written there just like the ones for regular users, e.g.
default preference settings?

actually razor discover and pyzor discover should just write
system-wide files in /var/cache in an ideal word, instead of having
every user re-download the list all by itself

Don't know if it's possible and if it is not, how difficult it would
be to fix.

Guys, let me propose something here, at least as one possibility.

In reviewing the docs for razor and pyzor, it would seem that there are some default file locations as we are experiencing. By default, these appear to be user specific (ie. ~/.pyzor and ~/.razor), where the user could be me, root or the "system". This includes the server updating process.

It occurs to me that one potential confounding variable here is that I am running these processes as a local user on a single user system, rather than a system-wide approach as one might do with a central server processing incoming e-mail for multiple user accounts. That includes my use of ~/.procmailrc as the primary means to process both virus (via clamassassin/clamav) and spam (via SA + these additional tools).

Presumably a SysAdmin on a multi-user system would take a different approach and perhaps would use other means to integrate the processing of viri and spam (such as Amavis as Nicolas has mentioned). This would afford other approaches to the default configuration of these other tools.

To Nicolas' points below, there are some issues with these things moving in a non-GPL mode, if they are not already there. I do note however that both razor and pyzor are still in Extras for FC5 and are present in Extras for devel (http://fedoraproject.org/extras/development/i386/). I also whole heartedly support his contention that these tools dramatically improve the processing of spam.

In either case, one option for me here within the notion of this being a single user process, is to move the cron jobs that update razor and pyzor from the system /etc/crontab to my user cron file vie "crontab -e" (/var/spool/cron/marcs). I already have fetchmail and some backup scripts running there anyway.

The dcc update process would need to stay in /etc/crontab since it downloads, compiles and installs the system-wide dcc client.

In this way, the files that are getting updated would be limited to my local user files (and perhaps still root's files), rather than the system files in /.razor and /.pyzor.

Thoughts?

Another option, perhaps, would be for the FE razor and pyzor maintainers to adjust the respective app defaults for FE with an eye towards SELinux policy issues in future updates. In that way, perhaps the default locations could be in /etc or /var as Nicolas notes above. That might provide for a means to handle both single user and multi user configurations, though the impact on other tools would need to be considered as may be appropriate.

Paul, I will respond to your follow up shortly, as soon as I have installed the updated policy files.

Regards,

Marc


BTW

- dcc is closed software, will never make it in FC or FE

- razor used to be FOSS but acquired some "not for commercial use"
features recently, so it's on the way out (dunno if it's still in FE
repos)

- pyzor is completely FOSS but seems to be going the sleeping beauty
way. What's worse the central pyzor server is on the sdsl setup of the
main developper and drops from the net every other week for long periods

It's all a shame because anyone who has run sa with and without
razor/pyzor will attest they improve sa efficentcy dramatically.

Since pyzor is in python maybe the Fedora project could setup a
central pyzor server for its users ?

--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux