Marc Schwartz wrote:
Nicolas Mailhot wrote:
Paul Howarth a écrit :
On Sat, 2006-06-24 at 17:40 -0500, Marc Schwartz wrote:
'pyzor discover' updates the pyzor server list.
'razor-admin -discover' does the same for the razor servers.
Can these be made to write files somewhere other than /.razor etc?
Are the files written there just like the ones for regular users, e.g.
default preference settings?
actually razor discover and pyzor discover should just write
system-wide files in /var/cache in an ideal word, instead of having
every user re-download the list all by itself
Don't know if it's possible and if it is not, how difficult it would
be to fix.
Guys, let me propose something here, at least as one possibility.
In reviewing the docs for razor and pyzor, it would seem that there are
some default file locations as we are experiencing. By default, these
appear to be user specific (ie. ~/.pyzor and ~/.razor), where the user
could be me, root or the "system". This includes the server updating
process.
What I'm wondering is how this could end up creating directories /.razor
and /.pyzor since the root directory (as opposed to the /root directory)
is not the home directory of any user, and shouldn't be writable by
anyone other than root.
It occurs to me that one potential confounding variable here is that I
am running these processes as a local user on a single user system,
rather than a system-wide approach as one might do with a central server
processing incoming e-mail for multiple user accounts. That includes my
use of ~/.procmailrc as the primary means to process both virus (via
clamassassin/clamav) and spam (via SA + these additional tools).
Presumably a SysAdmin on a multi-user system would take a different
approach and perhaps would use other means to integrate the processing
of viri and spam (such as Amavis as Nicolas has mentioned). This would
afford other approaches to the default configuration of these other tools.
The spamassassin wiki has a page on this:
http://wiki.apache.org/spamassassin/UsingPyzor
To Nicolas' points below, there are some issues with these things moving
in a non-GPL mode, if they are not already there. I do note however
that both razor and pyzor are still in Extras for FC5 and are present in
Extras for devel (http://fedoraproject.org/extras/development/i386/). I
also whole heartedly support his contention that these tools
dramatically improve the processing of spam.
In either case, one option for me here within the notion of this being a
single user process, is to move the cron jobs that update razor and
pyzor from the system /etc/crontab to my user cron file vie "crontab -e"
(/var/spool/cron/marcs). I already have fetchmail and some backup
scripts running there anyway.
I think that would be a good move; it should at least prevent the
creation of directories straight under the root.
The dcc update process would need to stay in /etc/crontab since it
downloads, compiles and installs the system-wide dcc client.
Compiles as root? Ugh!
Another option, perhaps, would be for the FE razor and pyzor maintainers
to adjust the respective app defaults for FE with an eye towards SELinux
policy issues in future updates. In that way, perhaps the default
locations could be in /etc or /var as Nicolas notes above. That might
provide for a means to handle both single user and multi user
configurations, though the impact on other tools would need to be
considered as may be appropriate.
If we can figure how how to make them work sanely, I'm confident that
the maintainers would be open to suggestions (preferably with patches).
Paul.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
