[CentOS-docs] SELinux

[Ned Slider]

Manuel Wolfshant wrote:
> On 08/12/2008 07:12 PM, Ned Slider wrote:
>> Manuel Wolfshant wrote:
>>> Ned Slider wrote:
>>>> Hi list,
>>>>
>>>> I've knocked up a contribution on SELinux here:
>>>>
>>>> http://wiki.centos.org/HowTos/SELinux
>>>>
>>>> I've tried to pitch it as an introduction for those not already 
>>>> familiar with SELinux but also hopefully a useful reference.
>>>>
>>>> I'm relatively new to SELinux and have covered pretty much 
>>>> everything I know to the limits of my limited knowledge. If folks 
>>>> think other material needs to be covered then it may be more 
>>>> appropriate for them to make the additions rather than me. Consider 
>>>> it a "get the ball rolling" contribution that the community can add 
>>>> to as necessary :)
>>>>
>>>> Comments welcomed,
>>> I would add the following just before "Sumamry" (in case one wants to 
>>> edit the rules suggested by audit2allow):
>>>
>>>    Building module policy manually
>>>
>>>
>>> - grep sendmail /var/log/audit/audit.log | audit2allow -M postfix
>>> - while reviewing the generated postfix.te
>>>
>>>    module local 1.0;
>>>
>>>    require {
>>>            type httpd_log_t;
>>>            type postfix_postdrop_t;
>>>            class dir getattr;
>>>            class file { read getattr };
>>>    }
>>>
>>>    #============= postfix_postdrop_t ==============
>>>    allow postfix_postdrop_t httpd_log_t:file getattr;
>>>
>>>
>>
>> Wolfy,
>>
>> Are you able to supply an example of the audit.log AVC message(s) that 
>> are used to create this .te policy? It might be useful to show the 
>> actual AVC error messages in explaining this process.
>>
>> Thanks,
> here you are. I hope I have not trashed anything valuable but most of 
> the info must be here
> 

Thanks.

One wonders why postdrop is interested in /var/log/httpd/error_log?

> 
> 
> PS, for those who might be tempted to comment about the kernel version: 
> I already know what you want to say.
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> CentOS-docs mailing list
> CentOS-docs at centos.org
> http://lists.centos.org/mailman/listinfo/centos-docs