From: Francesco Vollero fvollero@redhat.com
With this patch we get a more easy and "invisible" way to set the bool in selinux to activate httpd_can_network_connect just after the installation of the rpm, allowing aeolus-configure to have it just working.
If this patch gonna be ack'd we should remove the puppet recipe that was activating it with aeolus-configure. --- aeolus-conductor.spec.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/aeolus-conductor.spec.in b/aeolus-conductor.spec.in index e5f7d62..7fb095b 100644 --- a/aeolus-conductor.spec.in +++ b/aeolus-conductor.spec.in @@ -64,6 +64,7 @@ Requires: %{name} = %{version}-%{release} Requires: httpd >= 2.0 Requires: rubygem(thin) >= 1.2.5 Requires(post): chkconfig +Requires(post): /usr/sbin/setsebool, /usr/sbin/selinuxenabled Requires(preun): chkconfig Requires(preun): initscripts
@@ -277,6 +278,10 @@ if [ ! -d %{app_root}/app ]; then fi
%post daemons +# Activate httpd_can_network_connect (for httpd mod_proxy module) +if /usr/sbin/selinuxenabled ; then + /usr/sbin/setsebool -P httpd_can_network_connect 1 2>/dev/null +fi # Register the services /sbin/chkconfig --add aeolus-conductor /sbin/chkconfig --add conductor-dbomatic
On 04/14/11 - 03:33:09PM, fvollero@redhat.com wrote:
From: Francesco Vollero fvollero@redhat.com
With this patch we get a more easy and "invisible" way to set the bool in selinux to activate httpd_can_network_connect just after the installation of the rpm, allowing aeolus-configure to have it just working.
If this patch gonna be ack'd we should remove the puppet recipe that was activating it with aeolus-configure.
aeolus-conductor.spec.in | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/aeolus-conductor.spec.in b/aeolus-conductor.spec.in index e5f7d62..7fb095b 100644 --- a/aeolus-conductor.spec.in +++ b/aeolus-conductor.spec.in @@ -64,6 +64,7 @@ Requires: %{name} = %{version}-%{release} Requires: httpd >= 2.0 Requires: rubygem(thin) >= 1.2.5 Requires(post): chkconfig +Requires(post): /usr/sbin/setsebool, /usr/sbin/selinuxenabled Requires(preun): chkconfig Requires(preun): initscripts
@@ -277,6 +278,10 @@ if [ ! -d %{app_root}/app ]; then fi
%post daemons +# Activate httpd_can_network_connect (for httpd mod_proxy module) +if /usr/sbin/selinuxenabled ; then
- /usr/sbin/setsebool -P httpd_can_network_connect 1 2>/dev/null
+fi # Register the services /sbin/chkconfig --add aeolus-conductor /sbin/chkconfig --add conductor-dbomatic
NACK. This lowers the security of the system by just installing a package.
While we can't work without it, this is a configuration-time decision, so belongs in aeolus-configure.
On Thu, Apr 14, 2011 at 09:46:04AM -0400, Chris Lalancette wrote:
On 04/14/11 - 03:33:09PM, fvollero@redhat.com wrote:
From: Francesco Vollero fvollero@redhat.com
With this patch we get a more easy and "invisible" way to set the bool in selinux to activate httpd_can_network_connect just after the installation of the rpm, allowing aeolus-configure to have it just working.
[snip]
NACK. This lowers the security of the system by just installing a package.
I accept your NACK but the explanation is inconsistent. Since aeolus-configure is doing the same identical thing, and, after you install the package one of the first thing that he's doing is to run this command.
And, since aeolus-configure need httpd_mod_proxy to be on, while running, i think its more logical that can be done as post installation configuration and not from some puppet recipe. Btw if what you said Chris, about raising down the security of the system with a package, i can argue to give a look on selinux policies about it. Activating mod_proxy if you need it, does not mean you are lowering the security of the system and btw, this rule *just* work on deamons, that mean, that you really want to use it. Is like that you want httpd and you dont want to let him communicate on port 80, its just silly.
So, maybe you want to give a good and reasonable explanation and/or going more in detail. Btw i can give you a list of rpm that are doing the same identical thing that i do, one for all, jabberd from where i take the idea. And i do this patch with a bless of SELinux guy, and i think they know better than me, what mean security, since they are creating our policies for RHEL and Fedora.
While we can't work without it, this is a configuration-time decision, so belongs in aeolus-configure.
If was just "i need it just for aeolus-configure stuff and after i close it again" i would agree with you, but since Conductor need it ALWAYS, its the same thing.
Cheers, Francesco Vollero
-- Chris Lalancette
On 04/15/11 - 02:49:22AM, Francesco Vollero wrote:
On Thu, Apr 14, 2011 at 09:46:04AM -0400, Chris Lalancette wrote:
On 04/14/11 - 03:33:09PM, fvollero@redhat.com wrote:
From: Francesco Vollero fvollero@redhat.com
With this patch we get a more easy and "invisible" way to set the bool in selinux to activate httpd_can_network_connect just after the installation of the rpm, allowing aeolus-configure to have it just working.
[snip]
NACK. This lowers the security of the system by just installing a package.
I accept your NACK but the explanation is inconsistent. Since aeolus-configure is doing the same identical thing, and, after you install the package one of the first thing that he's doing is to run this command.
And, since aeolus-configure need httpd_mod_proxy to be on, while running, i think its more logical that can be done as post installation configuration and not from some puppet recipe. Btw if what you said Chris, about raising down the security of the system with a package, i can argue to give a look on selinux policies about it. Activating mod_proxy if you need it, does not mean you are lowering the security of the system and btw, this rule *just* work on deamons, that mean, that you really want to use it. Is like that you want httpd and you dont want to let him communicate on port 80, its just silly.
So, maybe you want to give a good and reasonable explanation and/or going more in detail. Btw i can give you a list of rpm that are doing the same identical thing that i do, one for all, jabberd from where i take the idea. And i do this patch with a bless of SELinux guy, and i think they know better than me, what mean security, since they are creating our policies for RHEL and Fedora.
(I just looked at the jabberd spec file, andd I do not see the place where it turns on an SELinux boolean. Can you point it out in more detail?)
While we can't work without it, this is a configuration-time decision, so belongs in aeolus-configure.
If was just "i need it just for aeolus-configure stuff and after i close it again" i would agree with you, but since Conductor need it ALWAYS, its the same thing.
But it is not the same thing. I have ~1700 packages installed on my laptop, and I am certainly not using all of them. I would be pretty upset if the mere fact of installing one of them caused my system to have less security. Once the user goes to the trouble of running aeolus-configure, then they have signalled a desire to use Conductor, and at that point it is appropriate to setup the boolean.
On Fri, Apr 15, 2011 at 09:02:31AM -0400, Chris Lalancette wrote:
On 04/15/11 - 02:49:22AM, Francesco Vollero wrote:
On Thu, Apr 14, 2011 at 09:46:04AM -0400, Chris Lalancette wrote:
On 04/14/11 - 03:33:09PM, fvollero@redhat.com wrote:
From: Francesco Vollero fvollero@redhat.com
With this patch we get a more easy and "invisible" way to set the bool in selinux to activate httpd_can_network_connect just after the installation of the rpm, allowing aeolus-configure to have it just working.
[snip]
NACK. This lowers the security of the system by just installing a package.
I accept your NACK but the explanation is inconsistent. Since aeolus-configure is doing the same identical thing, and, after you install the package one of the first thing that he's doing is to run this command.
And, since aeolus-configure need httpd_mod_proxy to be on, while running, i think its more logical that can be done as post installation configuration and not from some puppet recipe. Btw if what you said Chris, about raising down the security of the system with a package, i can argue to give a look on selinux policies about it. Activating mod_proxy if you need it, does not mean you are lowering the security of the system and btw, this rule *just* work on deamons, that mean, that you really want to use it. Is like that you want httpd and you dont want to let him communicate on port 80, its just silly.
So, maybe you want to give a good and reasonable explanation and/or going more in detail. Btw i can give you a list of rpm that are doing the same identical thing that i do, one for all, jabberd from where i take the idea. And i do this patch with a bless of SELinux guy, and i think they know better than me, what mean security, since they are creating our policies for RHEL and Fedora.
(I just looked at the jabberd spec file, andd I do not see the place where it turns on an SELinux boolean. Can you point it out in more detail?)
Sorry i cited the wrong package, I was referring to spacewalk:
git clone git://git.fedorahosted.org/spacewalk.git/ grep -r setsebool ./spacewalk
While we can't work without it, this is a configuration-time decision, so belongs in aeolus-configure.
If was just "i need it just for aeolus-configure stuff and after i close it again" i would agree with you, but since Conductor need it ALWAYS, its the same thing.
But it is not the same thing. I have ~1700 packages installed on my laptop, and I am certainly not using all of them. I would be pretty upset if the mere fact of installing one of them caused my system to have less security. Once the user goes to the trouble of running aeolus-configure, then they have signalled a desire to use Conductor, and at that point it is appropriate to setup the boolean.
Ok. Obviously in this moment aeolus-configure is not acting in this way. What about disabling "by default" the enforcing mode?
Anyway, thanks for your feedback.
aeolus-devel@lists.fedorahosted.org
-
Chris Lalancette -
Francesco Vollero