On Wed, Apr 17, 2013 at 7:12 AM, Daniel J Walsh <dwalsh@xxxxxxxxxx> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> write to any directory. I did a quick test and this is thankfully /NOT/ the
On 04/16/2013 03:23 PM, Richard Greenwood wrote:
> I have a CGI application named "mapserv" that needs to write to a specific
> location: "/rwg/mapserver/tmp". I ran audit2allow which produced the
> test.te file file below. I ran "semodule -i test.pp" and my CGI application
> is now happy, and so you would think that I should be happy also. But I am
> confused/concerned because I do not see "mapserv" nor do I see
> "/rwg/mapserver/tmp" in the te file. So my uninformed interpretation of the
> te file below is that I have just granted all httpd scripts permission to
> case, but how does selinx know that I am granting only the "mapserv"
> application write permissions to only the "/rwg/mapserver/tmp" directory? I
> feel like there is a big piece that I am completely missing.
>
> Thanks for your patience with a newbie. Rich
>
>
> module test 1.0;
>
> require { type httpd_sys_content_t; type httpd_sys_script_t; class dir
> add_name; class file { write create }; }
>
> #============= httpd_sys_script_t ============== allow httpd_sys_script_t
> httpd_sys_content_t:dir add_name; allow httpd_sys_script_t
> httpd_sys_content_t:file { write create };
>
>
> -- Richard Greenwood richard.greenwood@xxxxxxxxx
> -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxxI just wrote a blog on this.
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
http://danwalsh.livejournal.com/63137.html
Rejy, Dominick and Daniel,
Thank you for the detail explanations and blog post. I'm not really having a problem with my CGI app, nor am I trying to create a custom type. I'm just trying to get a better understanding of SELinux generally, and specifically what policies audit2allow is creating. Your answers have gotten me a little closer.-- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
