[CentOS] httpd and krb5.conf

Quoting Doug Koobs <dkoobs at dkoobs.com>:

> Aleksandar Milivojevic said:
>> I've noticed that SELinux blocks httpd (standard CentOS httpd, simply
>> installed from RPM) from writing to krb5.conf file.  Question.  Why on
>> earth would httpd need write access to krb5.conf file?!  Sure, it might
>> need read access if it is configured to use Kerberos for authentication,
>> but write!?  I mean, web server that modifies one of the critical files
>> (which is used for authentication/authorization)?
>> _______________________________________________
> Allow me to display my ignorance of all thing SELinux:
>
> SELinux  is suppossed to restrict services and programs from 
> performing actions that
> they don't have a need to be doing. Since httpd has no reason to to 
> write to the
> krb5.conf file, SELinux restricts it. Kind of like a "Need to Know" 
> policy. If
> you're not familar with Mandatory Access Control, read up on it; I 
> think that is
> what SELinux is about.

Exactly.  But that doesn't answer my original question.

SELinux blocked access to the file httpd doesn't need to have access 
to. However, the question was why on startup httpd attempts to write to 
that file
(or at least open it for writing)?

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.