<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> <a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list-request@redhat.com">fedora-selinux-list-request@redhat.com</a> wrote: <blockquote cite="mid20050809160017.AE5F073A3F@hormel.redhat.com" type="cite"> <pre wrap="">Send fedora-selinux-list mailing list submissions to </pre> <blockquote type="cite"> <pre wrap=""> I'm not convinced that the security vs usability tradeoff is being won in favour of enabling the boolean by default. I don't quite understand this sentence. Are you saying the boolean should be enabled by default? We certainly need the functionality. When security gets in the way of getting the job done, then we have lost the war. </pre> </blockquote> <pre wrap=""> Sorry, I inverted the logic! I'm arguing that the httpd_can_network_connect boolean should be enabled by default, yes. joe </pre> </blockquote> Thanks for clearing that up. I think possible there could be more granularity, but the need for php and other CGI languages to extract data from a database and present it as web pages and the ability to act as proxys are pretty basic to the use of Linux as servers. Of course the issues of runaway log messages and graceful restart are important too. So where do we go? John <blockquote cite="mid20050809160017.AE5F073A3F@hormel.redhat.com" type="cite"> <pre wrap=""></pre> <pre wrap=""> <hr size="4" width="90%"> -- fedora-selinux-list mailing list <a class="moz-txt-link-abbreviated" href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a> <a class="moz-txt-link-freetext" href="http://www.redhat.com/mailman/listinfo/fedora-selinux-list">http://www.redhat.com/mailman/listinfo/fedora-selinux-list</a></pre> </blockquote> </body> </html>