FC4 httpd_can_network_connect boolean
russell at coker.com.au
Mon Aug 1 13:47:57 UTC 2005
On Monday 01 August 2005 18:33, Joe Orton <jorton at redhat.com> wrote:
> Very useful that this has been introduced - but I had presumed that it
> applies only to non-local addresses.
> The httpd parent process needs to be able to make connections to the
> local address/ports to which the children are bound. After a period of
> load, when there are idle children stuck in accept(), the parent will
> make a few connect()s to wake them up.
> Can this policy be limited to non-local addresses?
James, can we limit it to local addresses?
Steve, should we consider changing policy more widely to allow programs to
connect to their own ports?
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
More information about the fedora-selinux-list