<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
<a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list-request@redhat.com">fedora-selinux-list-request@redhat.com</a> wrote:
<blockquote cite="mid20050808160017.0E52D737B3@hormel.redhat.com"
type="cite"><br>
<table class="header-part1" border="0" cellpadding="0" cellspacing="0"
width="100%">
<tbody>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">Subject:
</div>
Re: [Bug 164992] New: Mod_proxy does not work with SElinux default
policy</td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">From: </div>
Joe Orton <a class="moz-txt-link-rfc2396E" href="mailto:jorton@redhat.com"><jorton@redhat.com></a></td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">Date: </div>
Mon, 8 Aug 2005 16:40:42 +0100</td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">To: </div>
Daniel J Walsh <a class="moz-txt-link-rfc2396E" href="mailto:dwalsh@redhat.com"><dwalsh@redhat.com></a></td>
</tr>
</tbody>
</table>
<table class="header-part2" border="0" cellpadding="0" cellspacing="0"
width="100%">
<tbody>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">To: </div>
Daniel J Walsh <a class="moz-txt-link-rfc2396E" href="mailto:dwalsh@redhat.com"><dwalsh@redhat.com></a></td>
</tr>
<tr>
<td>
<div class="headerdisplayname" style="display: inline;">CC: </div>
<a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a></td>
</tr>
</tbody>
</table>
<br>
<pre wrap="">On Fri, Aug 05, 2005 at 02:49:37PM -0400, Daniel J Walsh wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Joe Orton wrote:
</pre>
<blockquote type="cite">
<pre wrap="">No, when mod_proxy is used as a generic HTTP proxy (a not entirely
uncommon configuration) it needs to be able to connect to any remote
port on any remote address.
</pre>
</blockquote>
<pre wrap="">Defaulting apache to can_network_connect_any=1 could allow a subverted
apache web server to be setup as a spammer, or a launch site for further
attacks. So I don't think this would be a good idea.
</pre>
</blockquote>
<pre wrap=""><!---->
Currently the following is known to be broken in the default
configuration:
1) web applications which connect to remote {my,postgre}SQL databases
(and similarly, I guess, the Apache SQL-based-authentication modules)
</pre>
</blockquote>
This answers my previous question about why a phpBB forum could not
connect to the postgreSQL database if SElinux is enforcing.<br>
<blockquote cite="mid20050808160017.0E52D737B3@hormel.redhat.com"
type="cite">
<pre wrap="">
2) all mod_proxy configurations (reverse proxy, forward proxy)
3) the parent connect()-to-listening-port "reap idle children"
interface, which has the impact:
a) one log message written to error_log per second when the server
acquiesces after a period of above-normal load and tries to reap idle
children
b) graceful restart does not work properly
The above all represent important functionality.
</pre>
</blockquote>
Agreed.<br>
<blockquote cite="mid20050808160017.0E52D737B3@hormel.redhat.com"
type="cite">
<pre wrap="">
I'm not convinced that the security vs usability tradeoff is being won
in favour of enabling the boolean by default.
</pre>
</blockquote>
I don't quite understand this sentence. Are you saying the boolean
should be enabled by default? We certainly need the functionality. When
security gets in the way of getting the job done, then we have lost the
war.<br>
<br>
Regards,<br>
John<br>
<blockquote cite="mid20050808160017.0E52D737B3@hormel.redhat.com"
type="cite">
<pre wrap="">
Regards,
joe
</pre>
<pre wrap="">
<hr size="4" width="90%">
--
fedora-selinux-list mailing list
<a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a>
<a class="moz-txt-link-freetext" href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a></pre>
</blockquote>
</body>
</html>