SELinux/httpd integration
by Joe Orton
I think one thing that would help would be making the sets of example
httpd module configurations self-documentating w.r.t. SELinux for some
of the modules.
So for instance, how do I get Subversion/mod_dav_svn working with an
SELinux-enabled httpd? Can we make it such that an SVN repos is as easy
to set up as:
# cd /src/svn
# svnadmin create mystuff
# vi /etc/httpd/conf.d/subversion.conf
- uncomment the defaults?
even with SELinux enabled? The commented default in subversion.conf
here could be:
<Location /repos>
DAV svn
SVNParentPath /srv/svn
</Location>
A more generic example would be if we provide a /srv/www directory or
something to which the httpd domain is allowed read+write access by
default; somewhere to put the PHP webapps.
Does this make sense?
joe
19 years, 4 months
- 6
- 22
init labeling question for targeted policy
by Karsten Wade
My question about the targeted policy presumes that init re-execs itself
after loading the policy, whereby it picks up the unconfined_t domain
from the policy, as defined by a rule in
/etc/selinux/targeted/src/policy/domains/unconfined.te.
role system_r types unconfined_t;
What rule tells init to re-exec itself in the targeted policy? Or is
init doing something differently now?
Here is how far I've gotten in figuring this out.
In the strict policy there is an explicit transition rule for init. The
file programs/misc/kernel.te has this rule:
domain_auto_trans(kernel_t, init_exec_t, init_t)
In the targeted policy, kernel.te is in domains/misc/unused, so is not
called into play. Correct? The transition behavior certainly isn't
used, i.e., init transitions to unconfined_t instead of init_t.
Therefore, I'm looking for a default behavior that init falls back on
since it doesn't have specific SELinux coverage.
In macros/global_macros.te the macro domain_auto_trans(init_t,
$1_exec_t, $1_t) is defined. However, I don't find that macro used,
i.e., domain_auto_trans(init_t) or somesuch. In addition, I'm not even
sure that init would be in the domain init_t to qualify for this macro
since in targeted it's in unconfined_t.
In define(`unconfined_domain', there is this rule:
allow $1 self:process transition;
That says that init is allowed to transition to itself, but it doesn't
tell init to do the transition and seems otherwise unrelated.
Which one of these paths, if any, is leading in the right direction?
thx - Karsten
--
Karsten Wade, RHCE, Tech Writer
a lemon is just a melon in disguise
http://people.redhat.com/kwade/
gpg fingerprint: 2680 DBFD D968 3141 0115 5F1B D992 0E06 AD0E 0C41
19 years, 4 months
- 4
- 8