A bit of confusion over dkim_milter_t

[Erinn Looney-Triggs]

On 07/17/2013 02:19 PM, Dominick Grift wrote:
>  On Wed, 2013-07-17 at 14:08 -0800, Erinn Looney-Triggs wrote:
>> Sorry to respond to myself but I forgot the vitals:
>>
>> RHEL 6.4 x64
>> selinux-policy-3.7.19-195.el6_4.12.noarch
>>
>> -Erinn
> 
> Se its allowed to bind tcp socket to generic tcp port_t type ports if
> the allow_ypbind boolean is set ( sesearch with -ASCT would show you
> that(
> 
> allow_ypbind boolean is not recommended though since it is very coarse.
> 
> Instead use semanage to label the port (tcp:8891) with one of the
> available port types (seinfo -axport_type), then use audit2allow, after
> reproducing the event, to allow bind tcp socket to ports with that type
> 
> You can also create a new port type and use that:
> 
> cat > mytest.te <<EOF
> policy_module(mytest, 1.0.0)
> type myport_t;
> corenet_port(myport_t)
> 
> optional_policy(\`
> gen_require(\`
> 	type dkim_milter_t;
> ')
> 
> allow dkim_milter_t myport_t:tcp_socket name_bind;
> ')
> EOF
> 
> make -f /usr/share/selinux/devel/Makefile mytest.pp
> sudo semodule -i mytest.pp
> 
>>
>> --
>> selinux mailing list
>> selinux at lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> 
> 

Dominick,
Thanks a lot I figured there was some gap there that needed bridging in
my knowledge, and you kindly pointed me in the right direction.

-Erinn


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 555 bytes
Desc: OpenPGP digital signature
URL: <http://lists.fedoraproject.org/pipermail/selinux/attachments/20130718/f8f67ad7/attachment.sig>