tisdag 18 mars 2008 skrev Daniel J Walsh: > Pär Aronsson wrote: > > Hello, > > > > Attached is a SELinux policy for the Fedora Directory Server 1.1.0. > > It is composed of three parts. > > * dirsrv - directory server and setup programs > > * dirsrv-admin - administration server and setup programs > > * fedora-idm-console - java based console for administration > > > > The policies were developed on a CentOS 5.1 with the following packages: > > fedora-ds-base-1.1.0-3.fc6 > > fedora-ds-admin-1.1.1-1.fc6 > > fedora-ds-console-1.1.0-5.fc6 > > selinux-policy-2.4.6-106.el5_1.3 > > kernel-2.6.18-53.1.4.el5 > > > > I've succesfully tested the policies in targeted and strict mode. > > > > The dirsrv-admin policy requires that the apache policy module is loaded. > > Also run: > > setsebool -P httpd_enable_cgi on > > > > Comment out the following in /usr/sbin/start-ds-admin (line 63-65): > > if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then > > SELINUX_CMD="runcon -t unconfined_t --" > > fi > > > > I had trouble with the replication plugin so I haven't been able to do > > any testing with replication. > > > > Any comments are welcome. > > > > // Pär Aronsson > > Just started looking at this policy > dirsrv.te looks pretty good, I have never setup a directory server, so > I am guessing on some of this stuff. > > You want logging_search_logs($1) in > dirsrv_read_setuplog > > The fedora-idm-console stuff makes no sense. Looks like you are trying > to fix bugs in javaplugin policy. > > Not sure if you want/need dirserv-admin policy? If this is just stuff > to be run in cgi, just extend it. > > ALso not sure you need dirsrv_setup_t Why not leave in admin context? Thanks Dan! How should I handle the fedora-idm-console? A patch? Against what? The console need read access to the directory server db-files. There's an interface for it in dirsrv policy. What should I do with that in a patch? The cgi-scripts in dirsrv-admin are run from httpd and from the fedora-idm-console. Most of the policy extends the apache_content_template interface. The rest is for the start script. Can you suggest how it should be dealt with? The setup- and migration utilities in dirsrv and dirsrv-admin create files in /tmp that may contain sensitive information and need be readable by the daemons. I couldn't find another way to make the files private. Any suggestions? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
